Deliver Digital Products at Scale

  • Buy Link or Shortcode: {j2store}156|cart{/j2store}
  • member rating overall impact: 10.0/10 Overall Impact
  • member rating average dollars saved: $86,499 Average $ Saved
  • member rating average days saved: 53 Average Days Saved
  • Parent Category Name: Development
  • Parent Category Link: /development
  • Products are the lifeblood of an organization. They provide the capabilities the business needs to deliver value to both internal and external customers and stakeholders.
  • Product organizations are expected to continually deliver evolving value to the overall organization as they grow.
  • You need to clearly convey the direction and strategy of a broad product portfolio to gain alignment, support, and funding from your organization.

Our Advice

Critical Insight

  • Product delivery requires significant shifts in the way you complete development work and deliver value to your users. Make the changes that improve end-user value and enterprise alignment.
  • Your organizational goals and strategy are achieved through capabilities that deliver value. Your product hierarchy is the mechanism to translate enterprise goals, priorities, and constraints down to the product level where changes can be made.
  • Recognize that each product owner represents one of three primary perspectives: business, technical, and operational. Although all share the same capabilities, how they approach their responsibilities is influenced by their perspective.
  • The quality of your product backlog – and your ability to realize business value from your delivery pipeline – is directly related to the input, content, and prioritization of items in your product roadmap.
  • Your product family roadmap and product roadmap tell different stories. The product family roadmap represents the overall connection of products to the enterprise strategy, while the product roadmap focuses on the fulfillment of the product’s vision.
  • Although products can be delivered with any software development lifecycle, methodology, delivery team structure, or organizational design, high-performing product teams optimize their structure to fit the needs of product and product family delivery.

Impact and Result

  • Understand the importance of product families for scaling product delivery.
  • Define products in your context and organize products into operational families.
  • Use product family roadmaps to align product roadmaps to enterprise goals and priorities.
  • Evaluate the different approaches to improve your product family delivery pipelines and milestones.

Deliver Digital Products at Scale Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should define enterprise product families to scale your product delivery capability, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Become a product-centric organization

Define products in your organization’s context and explore product families as a way to organize products at scale.

  • Deliver Digital Products at Scale – Phase 1: Become a Product-Centric Organization
  • Deliver Digital Products at Scale Workbook
  • Digital Product Family Strategy Playbook

2. Organize products into product families

Identify an approach to group the inventory of products into one or more product families.

  • Deliver Digital Products at Scale – Phase 2: Organize Products Into Product Families

3. Ensure alignment between products and families

Confirm alignment between your products and product families via the product family roadmap and a shared definition of delivered value.

  • Deliver Digital Products at Scale – Phase 3: Ensure Alignment Between Products and Families

4. Bridge the gap between product families and delivery

Agree on a delivery approach that best aligns with your product families.

  • Deliver Digital Products at Scale – Phase 4: Bridge the Gap Between Product Families and Delivery
  • Deliver Digital Products at Scale Readiness Assessment

5. Build your transformation roadmap and communication plan

Define your communication plan and transformation roadmap for transitioning to delivering products at the scale of your organization.

  • Deliver Digital Products at Scale – Phase 5: Transformation Roadmap and Communication

Infographic

Workshop: Deliver Digital Products at Scale

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Become a Product-Centric Organization

The Purpose

Define products in your organization’s context and explore product families as a way to organize products at scale.

Key Benefits Achieved

An understanding of the case for product practices

A concise definition of products and product families

Activities

1.1 Understand your organizational factors driving product-centric delivery.

1.2 Establish your organization’s product inventory.

1.3 Determine your approach to scale product families.

Outputs

Organizational drivers and goals for a product-centric delivery

Definition of product

Product scaling principles

Scaling approach and direction

Pilot list of products to scale

2 Organize Products Into Product Families

The Purpose

Identify a suitable approach to group the inventory of products into one or more product families.

Key Benefits Achieved

A scaling approach for products that fits your organization

Activities

2.1 Define your product families.

Outputs

Product family mapping

Enabling applications

Dependent applications

Product family canvas

3 Ensure Alignment Between Products and Families

The Purpose

Confirm alignment between your products and product families via the product family roadmap and a shared definition of delivered value.

Key Benefits Achieved

Recognition of the product family roadmap and a shared definition of value as key concepts to maintain alignment between your products and product families

Activities

3.1 Leverage product family roadmaps.

3.2 Use stakeholder management to improve roadmap communication.

3.3 Configure your product family roadmaps.

3.4 Confirm product family to product alignment.

Outputs

Current approach for communication of product family strategy

List of product family stakeholders and a prioritization plan for communication

Defined key pieces of a product family roadmap

An approach to confirming alignment between products and product families through a shared definition of business value

4 Bridge the Gap Between Product Families and Delivery

The Purpose

Agree on the delivery approach that best aligns with your product families.

Key Benefits Achieved

An understanding of the team configuration and operating model required to deliver value through your product families

Activities

4.1 Assess your organization’s delivery readiness.

4.2 Understand your delivery options.

4.3 Determine your operating model.

4.4 Identify how to fund product delivery.

4.5 Learn how to introduce your digital product family strategy.

4.6 Communicate changes on updates to your strategy.

4.7 Determine your next steps.

Outputs

Assessment results on your organization’s delivery maturity

A preferred approach to structuring product delivery

Your preferred operating model for delivering product families

Understanding of your preferred approach for product family funding

Product family transformation roadmap

Your plan for communicating your roadmap

List of actionable next steps to start on your journey

5 Advisory: Next Steps and Wrap-Up (offsite)

The Purpose

Implement your communication plan and transformation roadmap for transitioning to delivering products at the scale of your organization.

Key Benefits Achieved

New product family organization and supporting product delivery approach

Activities

5.1 Execute communication plan and product family changes.

5.2 Review the pilot family implementation and update the transformation roadmap.

5.3 Begin advisory calls for related blueprints.

Outputs

Organizational communication of product families and product family roadmaps

Product family implementation and updated transformation roadmap

Support for product owners, backlog and roadmap management, and other topics

Further reading

Deliver Digital Products at Scale

Deliver value at the scale of your organization through defining enterprise product families.

Analyst Perspective

Product families align enterprise goals to product changes and value realization.

A picture of Info-Tech analyst Banu Raghuraman. A picture of Info-Tech analyst Ari Glaizel. A picture of Info-Tech analyst Hans Eckman

Our world is changing faster than ever, and the need for business agility continues to grow. Organizations are shifting from long-term project delivery to smaller, iterative product delivery models to be able to embrace change and respond to challenges and opportunities faster.

Unfortunately, many organizations focus on product delivery at the tactical level. Product teams may be individually successful, but how well are their changes aligned to division and enterprise goals and priorities?

Grouping products into operationally aligned families is key to delivering the right value to the right stakeholders at the right time.

Product families translate enterprise goals, constraints, and priorities down to the individual product level so product owners can make better decisions and more effectively manage their roadmaps and backlogs. By scaling products into families and using product family roadmaps to align product roadmaps, product owners can deliver the capabilities that allow organizations to reach their goals.

In this blueprint, we’ll provide the tools and guidance to help you define what “product” means to your organization, use scaling patterns to build product families, align product and product family roadmaps, and identify impacts to your delivery and organizational design models.

Banu Raghuraman, Ari Glaizel, and Hans Eckman

Applications Practice

Info-Tech Research Group

Deliver Digital Products at Scale

Deliver value at the scale of your organization through defining enterprise product families.

EXECUTIVE BRIEF

Executive Summary

Your Challenge

  • Products are the lifeblood of an organization. They deliver the capabilities needed to deliver value to customers, internal users, and stakeholders.
  • The shift to becoming a product organization is intended to continually increase the value you provide to the broader organization as you grow and evolve.
  • You need to clearly convey the direction and strategy of your product portfolio to gain alignment, support, and funding from your organization.

Common Obstacles

  • IT organizations are traditionally organized to deliver initiatives in specific periods of time. This conflicts with product delivery, which continuously delivers value over the lifetime of a product.
  • Delivering multiple products together creates additional challenges because each product has its own pedigree, history, and goals.
  • Product owners struggle to prioritize changes to deliver product value. This creates a gap and conflict between product and enterprise goals.

Info-Tech’s Approach

Info-Tech’s approach will guide you through:

  • Understanding the importance of product families in scaling product delivery.
  • Defining products in your context and organizing products into operational families.
  • Using product family roadmaps to align product roadmaps to enterprise goals and priorities.
  • Evaluating the different approaches to improve your product family delivery pipelines and milestones.

Info-Tech Insight

Changes can only be made at the individual product or service level. To achieve enterprise goals and priorities, organizations needed to organize and scale products into operational families. This structure allows product managers to translate goals and constraints to the product level and allows product owners to deliver changes that support enabling capabilities. In this blueprint, we’ll help you define your products, scale them using the best patterns, and align your roadmaps and delivery models to improve throughput and value delivery.

Info-Tech’s approach

Operationally align product delivery to enterprise goals

A flowchart is shown on how to operationally align product delivery to enterprise goals.

The Info-Tech difference:

  1. Start by piloting product families to determine which approaches work best for your organization.
  2. Create a common definition of what a product is and identify products in your inventory.
  3. Use scaling patterns to build operationally aligned product families.
  4. Develop a roadmap strategy to align families and products to enterprise goals and priorities.
  5. Use products and families to evaluate delivery and organizational design improvements.

Deliver Digital Products at Scale via Enterprise Product Families

An infographic on the Enterprise Product Families is shown.

Product does not mean the same thing to everyone

Do not expect a universal definition of products.

Every organization and industry has a different definition of what a product is. Organizations structure their people, processes, and technologies according to their definition of the products they manage. Conflicting product definitions between teams increase confusion and misalignment of product roadmaps.

“A product [is] something (physical or not) that is created through a process and that provides benefits to a market.”

- Mike Cohn, Founding Member of Agile Alliance and Scrum Alliance

“A product is something ... that is created and then made available to customers, usually with a distinct name or order number.”

- TechTarget

“A product is the physical object ... , software or service from which customer gets direct utility plus a number of other factors, services, and perceptions that make the product useful, desirable [and] convenient.”

- Mark Curphey

Organizations need a common understanding of what a product is and how it pertains to the business. This understanding needs to be accepted across the organization.

“There is not a lot of guidance in the industry on how to define [products]. This is dangerous because what will happen is that product backlogs will be formed in too many areas. All that does is create dependencies and coordination across teams … and backlogs.”

– Chad Beier, "How Do You Define a Product?” Scrum.org

What is a product?

“A tangible solution, tool, or service (physical or digital) that enables the long-term and evolving delivery of value to customers and stakeholders based on business and user requirements.”

Info-Tech Insight

A proper definition of product recognizes three key facts:

  1. Products are long-term endeavors that don’t end after the project finishes.
  2. Products are not just “apps” but can be software or services that drive the delivery of value.
  3. There is more than one stakeholder group that derives value from the product or service.

Products and services share the same foundation and best practices

For the purpose of this blueprint, product/service and product owner/service owner are used interchangeably. Product is used for consistency but would apply to services as well.

Product = Service

“Product” and “service” are terms that each organization needs to define to fit its culture and customers (internal and external). The most important aspect is consistent use and understanding of:

  • External products
  • Internal products
  • External services
  • Internal services
  • Products as a service (PaaS)
  • Productizing services (SaaS)

Recognize the different product owner perspectives

Business:

  • Customer facing, revenue generating

Technical:

  • IT systems and tools

Operations:

  • Keep the lights on processes

Info-Tech Best Practice

Product owners must translate needs and constraints from their perspective into the language of their audience. Kathy Borneman, Digital Product Owner at SunTrust Bank, noted the challenges of finding a common language between lines of business and IT (e.g. what is a unit?).

Info-Tech Insight

Recognize that product owners represent one of three primary perspectives. Although all share the same capabilities, how they approach their responsibilities is influenced by their perspective.

“A Product Owner in its most beneficial form acts like an Entrepreneur, like a 'mini-CEO'. The Product Owner is someone who really 'owns' the product.”

– Robbin Schuurman, “Tips for Starting Product Owners”

Identify the differences between a project-centric and a product-centric organization

Project

Product

Fund projects

Funding

Fund products or teams

Line of business sponsor

Prioritization

Product owner

Makes specific changes to a product

Product management

Improve product maturity and support

Assign people to work

Work allocation

Assign work to product teams

Project manager manages

Capacity management

Team manages capacity

Info-Tech Insight

Product delivery requires significant shifts in the way you complete development work and deliver value to your users. Make the changes that support improving end-user value and enterprise alignment.

Projects can be a mechanism for delivering product changes and improvements

A flowchart is shown to demonstrate the difference between project lifecycle, hybrid lifecycle and product lifecycle.

Projects within products

Regardless of whether you recognize yourself as a product-based or project-based shop, the same basic principles should apply. The purpose of projects is to deliver the scope of a product release. The shift to product delivery leverages a product roadmap and backlog as the mechanism for defining and managing the scope of the release. Eventually, teams progress to continuous integration/continuous delivery (CI/CD) where they can release on demand or as scheduled, requiring org change management.

Define product value by aligning backlog delivery with roadmap goals

In each product plan, the backlogs show what you will deliver. Roadmaps identify when and in what order you will deliver value, capabilities, and goals.

An image is shown to demonstrate the relationship between the product backlog and the product roadmap.

Product roadmaps guide delivery and communicate your strategy

In Deliver on Your Digital Product Vision, we demonstrate how the product roadmap is core to value realization. The product roadmap is your communicated path, and as a product owner, you use it to align teams and changes to your defined goals while aligning your product to enterprise goals and strategy.

An example of a product roadmap is shown to demonstrate how it is the core to value realization.

Adapted from: Pichler, "What Is Product Management?""

Info-Tech Insight

The quality of your product backlog – and your ability to realize business value from your delivery pipeline – is directly related to the input, content, and prioritization of items in your product roadmap.

Use Agile DevOps principles to expedite product-centric delivery and management

Delivering products does not necessarily require an Agile DevOps mindset. However, Agile methods facilitate the journey because product thinking is baked into them.

A flowchart is shown to demonstrate the product deliery maturity and the Agile DevOps used.
Based on: Ambysoft, 2018

Organizations start with Waterfall to improve the predictable delivery of product features.

Iterative development shifts the focus from delivery of features to delivery of user value.

Agile further shifts delivery to consider ROI. Often, the highest-value backlog items aren’t the ones with the highest ROI.

Lean and DevOps improve your delivery pipeline by providing full integration between product owners, development teams, and operations.

CI/CD reduces time in process by allowing release on demand and simplifying release and support activities.

Although teams will adopt parts of all these stages during their journey, it isn’t until you’ve adopted a fully integrated delivery chain that you’ve become product centric.

Scale products into related families to improve value delivery and alignment

Defining product families builds a network of related products into coordinated value delivery streams.

A flowchart is shown to demonstrate the relations between product family and the delivery streams.

“As with basic product management, scaling an organization is all about articulating the vision and communicating it effectively. Using a well-defined framework helps you align the growth of your organization with that of the company. In fact, how the product organization is structured is very helpful in driving the vision of what you as a product company are going to do.”

– Rich Mironov, Mironov Consulting

Product families translate enterprise goals into value-enabling capabilities

A flowchart is shown to demonstrate the relationship between enterprise strategy and enabling capabilities.

Info-Tech Insight

Your organizational goals and strategy are achieved through capabilities that deliver value. Your product hierarchy is the mechanism to translate enterprise goals, priorities, and constraints down to the product level where changes can be made.

Arrange product families by operational groups, not solely by your org chart

A flowchart is shown to demonstrate how to arrange product families by operational groups.

1. To align product changes with enterprise goals and priorities, you need to organize your products into operational groups based on the capabilities or business functions the product and family support.

2. Product managers translate these goals, priorities, and constraints into their product families, so they are actionable at the next level, whether that level is another product family or products implementing enhancements to meet these goals.

3. The product family manager ensures that the product changes enhance the capabilities that allow you to realize your product family, division, and enterprise goals.

4. Enabling capabilities realize value and help reach your goals, which then drives your next set of enterprise goals and strategy.

Approach alignment from both directions, validating by the opposite way

Defining your product families is not a one-way street. Often, we start from either the top or the bottom depending on our scaling principles. We use multiple patterns to find the best arrangement and grouping of our products and families.

It may be helpful to work partway, then approach your scaling from the opposite direction, meeting in the middle. This way you are taking advantage of the strengths in both approaches.

Once you have your proposed structure, validate the grouping by applying the principles from the opposite direction to ensure each product and family is in the best starting group.

As the needs of your organization change, you may need to realign your product families into your new business architecture and operational structure.

A top-down alignment example is shown.

When to use: You have a business architecture defined or clear market/functional grouping of value streams.

A bottom-up alignment example is shown.

When to use: You are starting from an Application Portfolio Management application inventory to build or validate application families.

Leverage patterns for scaling products

Organizing your products and families is easier when leveraging these grouping patterns. Each is explained in greater detail on the following slides

Value Stream Alignment

Enterprise Applications

Shared Services

Technical

Organizational Alignment

  • Business architecture
    • Value stream
    • Capability
    • Function
  • Market/customer segment
  • Line of business (LoB)
  • Example: Customer group > value stream > products
  • Enabling capabilities
  • Enterprise platforms
  • Supporting apps
  • Example: HR > Workday/Peoplesoft > ModulesSupporting: Job board, healthcare administrator
  • Organization of related services into service family
  • Direct hierarchy does not necessarily exist within the family
  • Examples: End-user support and ticketing, workflow and collaboration tools
  • Domain grouping of IT infrastructure, platforms, apps, skills, or languages
  • Often used in combination with Shared Services grouping or LoB-specific apps
  • Examples: Java, .NET, low-code, database, network
  • Used at higher levels of the organization where products are aligned under divisions
  • Separation of product managers from organizational structure no longer needed because the management team owns product management role

Leverage the product family roadmap for alignment

It’s more than a set of colorful boxes. It’s the map to align everyone to where you are going.

Your product family roadmap

    ✓ Lays out a strategy for your product family.

    ✓ Is a statement of intent for your family of products.

    ✓ Communicates direction for the entire product family and product teams.

    ✓ Directly connects to the organization’s goals.

However, it is not:

    x Representative of a hard commitment.

    x A simple combination of your current product roadmaps.

Before connecting your family roadmap to products, think about what each roadmap typically presents

An example of a product family roadmap is shown and how it can be connected to the products.

Info-Tech Insight

Your product family roadmap and product roadmap tell different stories. The product family roadmap represents the overall connection of products to the enterprise strategy, while the product roadmap focuses on the fulfillment of the product’s vision.

Product family roadmaps are more strategic by nature

While individual product roadmaps can be different levels of tactical or strategic depending on a variety of market factors, your options are more limited when defining roadmaps for product families.

Product

TACTICAL

A roadmap that is technical, committed, and detailed.

Product Family

STRATEGIC

A roadmap that is strategic, goal based, high level, and flexible.

Info-Tech Insight

Roadmaps for your product family are, by design, less detailed. This does not mean they aren’t actionable! Your product family roadmap should be able to communicate clear intentions around the future delivery of value in both the near and long term.

Consider volatility when structuring product family roadmaps

A roadmap is shown without any changes.

There is no such thing as a roadmap that never changes.

Your product family roadmap represents a broad statement of intent and high-level tactics to get closer to the organization’s goals.

A roadmap is shown with changes.

All good product family roadmaps embrace change!

Your strategic intentions are subject to volatility, especially those planned further in the future. The more costs you incur in planning, the more you leave yourself exposed to inefficiency and waste if those plans change.

Info-Tech Insight

A good product family roadmap is intended to manage and communicate the inevitable changes as a result of market volatility and changes in strategy.

Product delivery realizes value for your product family

While planning and analysis are done at the family level, work and delivery are done at the individual product level.

PRODUCT STRATEGY

What are the artifacts?

What are you saying?

Defined at the family level?

Defined at the product level?

Vision

I want to...

Strategic focus

Delivery focus

Goals

To get there we need to...

Roadmap

To achieve our goals, we’ll deliver...

Backlog

The work will be done in this order...

Release Plan

We will deliver in the following ways...

Typical elements of a product family roadmap

While there are others, these represent what will commonly appear across most family-based roadmaps.

An example is shown to highlight the typical elements of a product family roadmap.

GROUP/CATEGORY: Groups are collections of artifacts. In a product family context, these are usually product family goals, value streams, or products.

ARTIFACT: An artifact is one of many kinds of tangible by-products produced during the delivery of products. For a product family, the artifacts represented are capabilities or value streams.

MILESTONE: Points in the timeline when established sets of artifacts are complete. This is a critical tool in the alignment of products in a given family.

TIME HORIZON: Separated periods within the projected timeline covered by the roadmap.

Connecting your product family roadmaps to product roadmaps

Your product and product family roadmaps should be connected at an artifact level that is common between both. Typically, this is done with capabilities, but it can be done at a more granular level if an understanding of capabilities isn’t available.

An example is shown on how the product family roadmpas can be connected to the product roadmaps.

Multiple roadmap views can communicate differently, yet tell the same truth

Audience

Business/ IT Leaders

Users/Customers

Delivery Teams

Roadmap View

Portfolio

Product Family

Technology

Objectives

To provide a snapshot of the portfolio and priority products

To visualize and validate product strategy

To coordinate broad technology and architecture decisions

Artifacts

Line items or sections of the roadmap are made up of individual products, and an artifact represents a disposition at its highest level.

Artifacts are generally grouped by product teams and consist of strategic goals and the features that realize those goals.

Artifacts are grouped by the teams who deliver that work and consist of technical capabilities that support the broader delivery of value for the product family.

Your communication objectives are linked to your audience; ensure you know your audience and speak their language

I want to...

I need to talk to...

Because they are focused on...

ALIGN PRODUCT TEAMS

Get my delivery teams on the same page.

Architects

Products Owners

PRODUCTS

A product that delivers value against a common set of goals and objectives.

SHOWCASE CHANGES

Inform users and customers of product strategy.

Bus. Process Owners

End Users

FUNCTIONALITY

A group of functionality that business customers see as a single unit.

ARTICULATE RESOURCE REQUIREMENTS

Inform the business of product development requirements.

IT Management

Business Stakeholders

FUNDING

An initiative that those with the money see as a single budget.

Assess the impacts of product-centric delivery on your teams and org design

Product delivery can exist within any org structure or delivery model. However, when making the shift toward product management, consider optimizing your org design and product team structure to match your capacity and throughput needs.

A flowchart is shown to see how the impacts of product-centric delivery can impact team and org designs.

Determine which delivery team structure best fits your product pipeline

Four delivery team structures are shown. The four are: functional roles, shared service and resource pools, product or system, and skills and competencies.

Weigh the pros and cons of IT operating models to find the best fit

There are many different operating models. LoB/Product Aligned and Hybrid Functional align themselves most closely with how products and product families are typically delivered.

  1. LoB/Product Aligned – Decentralized Model: Line of Business, Geographically, Product, or Functionally Aligned
  2. A decentralized IT operating model that embeds specific functions within LoBs/product teams and provides cross-organizational support for their initiatives.

  3. Hybrid Functional: Functional/Product Aligned
  4. A best-of-both-worlds model that balances the benefits of centralized and decentralized approaches to achieve both customer responsiveness and economies of scale.

  5. Hybrid Service Model: Product-Aligned Operating Model
  6. A model that supports what is commonly referred to as a matrix organization, organizing by highly related service categories and introducing the role of the service owner.

  7. Centralized: Plan-Build-Run
  8. A highly typical IT operating model that focuses on centralized strategic control and oversight in delivering cost-optimized and effective solutions.

  9. Centralized: Demand-Develop-Service
  10. A centralized IT operating model that lends well to more mature operating environments. Aimed at leveraging economies of scale in an end-to-end services delivery model.

Consider how investment spending will differ in a product environment

Reward for delivering outcomes, not features

Autonomy

Flexibility

Accountability

Fund what delivers value

Allocate iteratively

Measure and adjust

Fund long-lived delivery of value through products (not projects).

Give autonomy to the team to decide exactly what to build.

Allocate to a pool based on higher-level business case.

Provide funds in smaller amounts to different product teams and initiatives based on need.

Product teams define metrics that contribute to given outcomes.

Track progress and allocate more (or less) funds as appropriate.

Adapted from Bain, 2019

Info-Tech Insight

Changes to funding require changes to product and Agile practices to ensure product ownership and accountability.

Why is having a common value measure important?

CIO-CEO Alignment Diagnostic

A stacked bar graph is shown to demonstrate CIO-CEO Alignment Diagnostic. A bar titled: Business Value Metrics is highlighted. 51% had some improvement necessary and 32% had significant improvement necessary.

Over 700 Info-Tech members have implemented the Balanced Value Measurement Framework.

“The cynic knows the price of everything and the value of nothing.”

– Oscar Wilde

“Price is what you pay. Value is what you get.”

– Warren Buffett

Understanding where you derive value is critical to building solid roadmaps.

Measure delivery and success

Metrics and measurements are powerful tools to drive behavior change and decision making in your organization. However, metrics are highly prone to creating unexpected outcomes, so use them with great care. Use metrics judiciously to uncover insights but avoid gaming or ambivalent behavior, productivity loss, and unintended consequences.

Build good practices in your selection and use of metrics:

  • Choose the metrics that are as close to measuring the desired outcome as possible.
  • Select the fewest metrics possible and ensure they are of the highest value to your team, the safest from gaming behaviors and unintended consequences, and the easiest to gather and report.
  • Never use metrics for reward or punishment; use them to develop your team.
  • Automate as much metrics gathering and reporting as possible.
  • Focus on trends rather than precise metrics values.
  • Review and change your metrics periodically.

Executive Brief Case Study

INDUSTRY: Public Sector & Financial Services

SOURCE: Info-Tech Interviews

A tale of two product transformations

Two of the organizations we interviewed shared the challenges they experienced defining product families and the impact these challenges had on their digital transformations.

A major financial services organization (2,000+ people in IT) had employed a top-down line of business–focused approach and found itself caught in a vicious circle of moving applications between families to resolve cross-LoB dependencies.

A similarly sized public sector organization suffered from a similar challenge as grouping from the bottom up based on technology areas led to teams fragmented across multiple business units employing different applications built on similar technology foundations.

Results

Both organizations struggled for over a year to structure their product families. This materially delayed key aspects of their product-centric transformation, resulting in additional effort and expenditure delivering solutions piecemeal as opposed to as a part of a holistic product family. It took embracing a hybrid top-down and bottom-up approach and beginning with pilot product families to make progress on their transformation.

A picture of Cole Cioran is shown.

Cole Cioran

Practice Lead,

Applications Practice

Info-Tech Research Group

There is no such thing as a perfect product-family structure. There will always be trade-offs when you need to manage shifting demand from stakeholder groups spanning customers, business units, process owners, and technology owners.

Focusing on a single approach to structure your product families inevitably leads to decisions that are readily challenged or are brittle in the face of changing demand.

The key to accelerating a product-centric transformation is to build a hybrid model that embraces top-down and bottom-up perspectives to structure and evolve product families over time. Add a robust pilot to evaluate the structure and you have the key to unlocking the potential of product delivery in your organization.

Info-Tech’s methodology for Deliver Digital Products at Scale

1. Become a Product-Centric Organization

2. Organize Products Into Product Families

3. Ensure Alignment Between Products and Families

4. Bridge the Gap Between Product Families and Delivery

5. Build Your Transformation Roadmap and Communication Plan

Phase Steps

1.1 Understand the organizational factors driving product-centric delivery

1.2 Establish your organization’s product inventory

2.1 Determine your approach to scale product families

2.2 Define your product families

3.1 Leverage product family roadmaps

3.2 Use stakeholder management to improve roadmap communication

3.3 Configure your product family roadmaps

3.4 Confirm goal and value alignment of products and their product families

4.1 Assess your organization’s delivery readiness

4.2 Understand your delivery options

4.3 Determine your operating model

4.4 Identify how to fund product family delivery

5.1 Introduce your digital product family strategy

5.2 Communicate changes on updates to your strategy

5.3 Determine your next steps

Phase Outcomes
  • Organizational drivers and goals for a product-centric delivery
  • Definition of product
  • Pilot list of products to scale
  • Product scaling principles
  • Scaling approach and direction
  • Product family mapping
  • Enabling applications
  • Dependent applications
  • Product family canvas
  • Approach for communication of product family strategy
  • Stakeholder management plan
  • Defined key pieces of a product family roadmap
  • An approach to confirming alignment between products and product families
  • Assessment of delivery maturity
  • Approach to structuring product delivery
  • Operating model for product delivery
  • Approach for product family funding
  • Product family transformation roadmap
  • Your plan for communicating your roadmap
  • List of actionable next steps to start on your journey

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

Deliver Digital Products at Scale Workbook

Use this supporting workbook to document interim results from a number of exercises that will contribute to your overall strategy.

A screenshot of the Scale Workbook is shown.

Deliver Digital Products at Scale Readiness Assessment

Your strategy needs to encompass your approaches to delivery. Understand where you need to focus using this simple assessment.

A screenshot of the Scale Readiness Assessment is shown.

Key deliverable:

Digital Product Family Strategy Playbook

Record the results from the exercises to help you define, detail, and deliver digital products at scale.

A screenshot of the Digital Product Family Strategy Playbook is shown.

Blueprint benefits

IT Benefits

  • Improved product delivery ROI.
  • Improved IT satisfaction and business support.
  • Greater alignment between product delivery and product family goals.
  • Improved alignment between product delivery and organizational models.
  • Better support for Agile/DevOps adoption.

Business Benefits

  • Increased value realization across product families.
  • Faster delivery of enterprise capabilities.
  • Improved IT satisfaction and business support.
  • Greater alignment between product delivery and product family goals.
  • Uniform understanding of product and product family roadmaps and key milestones.

Measure the value of this blueprint

Align product family metrics to product delivery and value realization.

Member Outcome Suggested Metric Estimated Impact

Increase business application satisfaction

Satisfaction with business applications (CIO Business Vision diagnostic)

20% increase within one year after implementation

Increase effectiveness of application portfolio management

Effectiveness of application portfolio management (Management & Governance diagnostic)

20% increase within one year after implementation

Increase importance and effectiveness of application portfolio

Importance and effectiveness to business ( Application Portfolio Assessment diagnostic)

20% increase within one year after implementation

Increase satisfaction of support of business operations

Support to business (CIO Business Vision diagnostic.

20% increase within one year after implementation

Successfully deliver committed work (productivity)

Number of successful deliveries; burndown

20% increase within one year after implementation

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation

"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keeps us on track."

Workshop

"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

Consulting

"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

What does a typical GI on this topic look like?

Phase 1: Become a Product-Centric Organization

Phase 2: Organize Products Into Product Families

Phase 3: Ensure Alignment Between Products and Families

Phase 4: Bridge the Gap Between Product Families and Delivery

Call #1: Scope requirements, objectives, and your specific challenges.

Call #2: Define products and product families in your context.

Call #3: Understand the list of products in your context.

Call #4: Define your scaling principles and goals.

Call #5: Select a pilot and define your product families.

Call #6: Understand the product family roadmap as a method to align products to families.

Call #7: Define components of your product family roadmap and confirm alignment.

Call #8: Assess your delivery readiness.

Call #9: Discuss delivery, operating, and funding models relevant to delivering product families.

Call #10: Wrap up.

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization. A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

Workshop Overview

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

Day 1

Become a Product-Centric Organization

Day 2

Organize Products Into Product Families

Day 3

Ensure Alignment Between Products and Families

Day 4

Bridge the Gap Between Product Families and Delivery

Advisory

Next Steps and Wrap-Up (offsite)

Activities

1.1 Understand your organizational factors driving product-centric delivery.

1.2 Establish your organization’s product inventory.

2.1 Determine your approach to scale product families.

2.2 Define your product families.

3.1 Leverage product family roadmaps.

3.2 Use stakeholder management to improve roadmap communication.

3.3 Configure your product family roadmaps.

3.4 Confirm product family to product alignment.

4.1 Assess your organization’s delivery readiness.

4.2 Understand your delivery options.

4.3 Determine your operating model.

4.4 Identify how to fund product family delivery.

5.1 Learn how to introduce your digital product family strategy.

5.2 Communicate changes on updates to your strategy.

5.3 Determine your next steps.

  1. Execute communication plan and product family changes.
  2. Review the pilot family implementation and update the transformation roadmap.
  3. Begin advisory calls for related blueprints.

Key Deliverables

  1. Organizational drivers and goals for a product-centric delivery
  2. Definition of product
  3. Product scaling principles
  4. Scaling approach and direction
  5. Pilot list of products to scale
  1. Product family mapping
  2. Enabling applications
  3. Dependent applications
  4. Product family canvas
  1. Current approach for communication of product family strategy
  2. List of product family stakeholders and a prioritization plan for communication
  3. Defined key pieces of a product family roadmap
  4. An approach to confirming alignment between products and product families through a shared definition of business value
  1. Assessment results on your organization’s delivery maturity
  2. A preferred approach to structuring product delivery
  3. Your preferred operating model for delivering product families
  4. Understanding your preferred approach for product family funding
  5. Product family transformation roadmap
  6. Your plan for communicating your roadmap
  7. List of actionable next steps to start on your journey
  1. Organizational communication of product families and product family roadmaps
  2. Product family implementation and updated transformation roadmap
  3. Support for product owners, backlog and roadmap management, and other topics

Phase 1

Become a Product-Centric Organization

Phase 1Phase 2Phase 3Phase 4Phase 5

1.1 Understand the organizational factors driving product-centric delivery

1.2 Establish your organization’s product inventory

2.1 Determine your approach to scale product families

2.2 Define your product families

3.1 Leverage product family roadmaps

3.2 Use stakeholder management to improve roadmap communication

3.3 Configure your product family roadmaps

3.4 Confirm product family to product alignment

4.1 Assess your organization’s delivery readiness

4.2 Understand your delivery options

4.3 Determine your operating model

4.4 Identify how to fund product family delivery

5.1 Learn how to introduce your digital product family strategy

5.2 Communicate changes on updates to your strategy

5.3 Determine your next steps

This phase will walk you through the following activities:

1.1.1 Understand your drivers for product-centric delivery

1.1.2 Identify the differences between project and product delivery

1.1.3 Define the goals for your product-centric organization

1.2.1 Define “product” in your context

1.2.2 Identify and establish a pilot list of products

This phase involves the following participants:

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Step 1.1

Understand the organizational factors driving product-centric delivery

Activities

1.1.1 Understand your drivers for product-centric delivery

1.1.2 Identify the differences between project and product delivery

1.1.3 Define the goals for your product-centric organization

This phase involves the following participants:

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Outcomes of this step

  • Organizational drivers to move to product-centric delivery
  • List of differences between project and product delivery
  • Goals for product-centric delivery

1.1.1 Understand your drivers for product-centric delivery

30-60 minutes

  1. Identify your pain points in the current delivery model.
  2. What is the root cause of these pain points?
  3. How will a product-centric delivery model fix the root cause?
  4. Record the results in the Deliver Digital Products at Scale Workbook.
Pain Points Root Causes Drivers
  • Lack of ownership
  • Siloed departments
  • Accountability

Output

  • Organizational drivers to move to product-centric delivery.

Participants

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers
  • Business analysts

Record the results in the Deliver Digital Products at Scale Workbook.

1.1.2 Identify the differences between project and product delivery

30-60 minutes

  1. Consider project delivery and product delivery.
  2. Discuss what some differences are between the two.
  3. Note: This exercise is not about identifying the advantages and disadvantages of each style of delivery. This is to identify the variation between the two.

  4. Record the results in the Deliver Digital Products at Scale Workbook.
Project Delivery Product Delivery
Point in time What is changed
Method of funding changes Needs an owner

Output

  • List of differences between project and product delivery

Participants

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers
  • Business analysts

Record the results in the Deliver Digital Products at Scale Workbook.

Identify the differences between a project-centric and a product-centric organization

Project Product
Fund projects Funding Fund products or teams
Line of business sponsor Prioritization Product owner
Makes specific changes to a product Product management Improves product maturity and support
Assignment of people to work Work allocation Assignment of work to product teams
Project manager manages Capacity management Team manages capacity

Info-Tech Insight

Product delivery requires significant shifts in the way you complete development work and deliver value to your users. Make the changes that support improving end-user value and enterprise alignment.

Projects can be a mechanism for funding product changes and improvements

A flowchart is shown to demonstrate the difference between project lifecycle, hybrid lifecycle, and product lifecycle.

Projects within products

Regardless of whether you recognize yourself as a product-based or project-based shop, the same basic principles should apply.

The purpose of projects is to deliver the scope of a product release. The shift to product delivery leverages a product roadmap and backlog as the mechanism for defining and managing the scope of the release.

Eventually, teams progress to continuous integration/continuous delivery (CI/CD) where they can release on demand or as scheduled, requiring org change management.

Use Agile DevOps principles to expedite product-centric delivery and management

Delivering products does not necessarily require an Agile DevOps mindset. However, Agile methods facilitate the journey because product thinking is baked into them.

A flowchart is shown to demonstrate the product delivery maturity and the Agile DevOps used.

Based on: Ambysoft, 2018

Organizations start with Waterfall to improve the predictable delivery of product features.

Iterative development shifts the focus from delivery of features to delivery of user value.

Agile further shifts delivery to consider ROI. Often, the highest-value backlog items aren’t the ones with the highest ROI.

Lean and DevOps improve your delivery pipeline by providing full integration between product owners, development teams, and operations.

CI/CD reduces time in process by allowing release on demand and simplifying release and support activities.

Although teams will adopt parts of all these stages during their journey, it isn’t until you’ve adopted a fully integrated delivery chain that you’ve become product centric.

1.1.3 Define the goals for your product-centric organization

30 minutes

  1. Review your list of drivers from exercise 1.1.1 and the differences between project and product delivery from exercise 1.1.2.
  2. Define your goals for achieving a product-centric organization.
  3. Note: Your drivers may have already covered the goals. If so, review if you would like to change the drivers based on your renewed understanding of the differences between project and product delivery.

Pain PointsRoot CausesDriversGoals
  • Lack of ownership
  • Siloed departments
  • Accountability
  • End-to-end ownership

Output

  • Goals for product-centric delivery

Participants

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Record the results in the Deliver Digital Products at Scale Workbook.

Step 1.2

Establish your organization’s product inventory

Activities

1.2.1 Define “product” in your context

1.2.2 Identify and establish a pilot list of products

This step involves the following participants:

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Outcomes of this step

  • Your organizational definition of products and services
  • A pilot list of active products

Product does not mean the same thing to everyone

Do not expect a universal definition of products.

Every organization and industry has a different definition of what a product is. Organizations structure their people, processes, and technologies according to their definition of the products they manage. Conflicting product definitions between teams increase confusion and misalignment of product roadmaps.

“A product [is] something (physical or not) that is created through a process and that provides benefits to a market.”

- Mike Cohn, Founding Member of Agile Alliance and Scrum Alliance

“A product is something ... that is created and then made available to customers, usually with a distinct name or order number.”

- TechTarget

“A product is the physical object ... , software or service from which customer gets direct utility plus a number of other factors, services, and perceptions that make the product useful, desirable [and] convenient.”

- Mark Curphey

Organizations need a common understanding of what a product is and how it pertains to the business. This understanding needs to be accepted across the organization.

“There is not a lot of guidance in the industry on how to define [products]. This is dangerous because what will happen is that product backlogs will be formed in too many areas. All that does is create dependencies and coordination across teams … and backlogs.”

– Chad Beier, "How Do You Define a Product?” Scrum.org

Products and services share the same foundation and best practices

For the purpose of this blueprint, product/service and product owner/service owner are used interchangeably. Product is used for consistency but would apply to services as well.

Product = Service

“Product” and “service” are terms that each organization needs to define to fit its culture and customers (internal and external). The most important aspect is consistent use and understanding of:

  • External products
  • Internal products
  • External services
  • Internal services
  • Products as a service (PaaS)
  • Productizing services (SaaS)

Recognize the different product owner perspectives

Business:

  • Customer facing, revenue generating

Technical:

  • IT systems and tools

Operations

  • Keep the lights on processes

Info-Tech Best Practice

Product owners must translate needs and constraints from their perspective into the language of their audience. Kathy Borneman, Digital Product Owner at SunTrust Bank, noted the challenges of finding a common language between lines of business and IT (e.g. what is a unit?).

Info-Tech Insight

Recognize that product owners represent one of three primary perspectives. Although all share the same capabilities, how they approach their responsibilities is influenced by their perspective.

“A Product Owner in its most beneficial form acts like an Entrepreneur, like a 'mini-CEO'. The Product Owner is someone who really 'owns' the product.”

– Robbin Schuurman, “Tips for Starting Product Owners”

Your product definition should include everything required to support it, not just what users see.

A picture of an iceburg is shown, showing the ice both above and below the water to demonstrate that the product definition should include everything, not just what users see. On top of the picture are various words to go with the product definition. They inlude: funding, external relationships, adoption, product strategy, stakeholder managment. The product defitions that may not be seen include: Product governance, business functionality, user support, managing and governing data, maintenance and enhancement, R-and-D, requirements analysis and design, code, and knowledge management.

Establish where product management would be beneficial in the organization

What does not need product ownership?

  • Individual features
  • Transactions
  • Unstructured data
  • One-time solutions
  • Non-repeatable processes
  • Solutions that have no users or consumers
  • People or teams

Characteristics of a discrete product

  • Has end users or consumers
  • Delivers quantifiable value
  • Evolves or changes over time
  • Has predictable delivery
  • Has definable boundaries
  • Has a cost to produce and operate

Product capabilities deliver value!

These are the various facets of a product. As a product owner, you are responsible for managing these facets through your capabilities and activities.

A flowchart is shown that demonstrates the various facets of a product.

It is easy to lose sight of what matters when we look at a product from a single point of view. Despite what The Agile Manifesto says, working software is not valuable without the knowledge and support that people need in order to adopt, use, and maintain it. If you build it, they will not come. Product leaders must consider the needs of all stakeholders when designing and building products.

Define product value by aligning backlog delivery with roadmap goals

In each product plan, the backlogs show what you will deliver. Roadmaps identify when and in what order you will deliver value, capabilities, and goals.

An image is shown to demonstrate the relationship between the product backlog and the product roadmap.

Product roadmaps guide delivery and communicate your strategy

In Deliver on Your Digital Product Vision, we demonstrate how the product roadmap is core to value realization. The product roadmap is your communicated path, and as a product owner, you use it to align teams and changes to your defined goals while aligning your product to enterprise goals and strategy.

An example of a product roadmap is shown to demonstrate how it is the core to value realization.

Info-Tech Insight

The quality of your product backlog – and your ability to realize business value from your delivery pipeline – is directly related to the input, content, and prioritization of items in your product roadmap.

What is a product?

Not all organizations will define products in the same way. Take this as a general example:

“A tangible solution, tool, or service (physical or digital) that enables the long-term and evolving delivery of value to customers and stakeholders based on business and user requirements.”

Info-Tech Insight

A proper definition of product recognizes three key facts:

  1. Products are long-term endeavors that don’t end after the project finishes.
  2. Products are not just “apps” but can be software or services that drive the delivery of value.
  3. There is more than one stakeholder group that derives value from the product or service.

1.2.1 Define “product” in your context

30-60 minutes

  1. Discuss what “product” means in your organization.
  2. Create a common, enterprise-wide definition for “product.”
  3. Record the results in the Deliver Digital Products at Scale Workbook.

For example:

  • An application, platform, or application family.
  • Discrete items that deliver value to a user/customer.

Output

  • Your enterprise/organizational definition of products and services

Participants

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Record the results in the Deliver Digital Products at Scale Workbook.

1.2.2 Identify and establish a pilot list of products

1-2 hours

  1. Review any current documented application inventory. If you have these details in an existing document, share it with the team. Select the group of applications for your family scaling pilot.
  2. List your initial application inventory on the Product List tab of the Deliver Digital Products at Scale Workbook.
  • For each of the products listed, add the vision and goals of the product. Refer to Deliver on Your Digital Product Vision to learn more about identifying vision and goals or to complete the product vision canvas.
  • You’ll add business capabilities and vision in Phase 2, but you can add these now if they are available in your existing inventory.
  • Output

    • A pilot list of active products

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    Phase 2

    Organize Products Into Product Families

    Phase 1Phase 2Phase 3Phase 4Phase 5

    1.1 Understand the organizational factors driving product-centric delivery

    1.2 Establish your organization’s product inventory

    2.1 Determine your approach to scale product families

    2.2 Define your product families

    3.1 Leverage product family roadmaps

    3.2 Use stakeholder management to improve roadmap communication

    3.3 Configure your product family roadmaps

    3.4 Confirm product family to product alignment

    4.1 Assess your organization’s delivery readiness

    4.2 Understand your delivery options

    4.3 Determine your operating model

    4.4 Identify how to fund product family delivery

    5.1 Learn how to introduce your digital product family strategy

    5.2 Communicate changes on updates to your strategy

    5.3 Determine your next steps

    This phase will walk you through the following activities:

    2.1.1 Define your scaling principles and goals

    2.1.2 Define your pilot product family areas and direction

    2.2.1 Arrange your applications and services into product families

    2.2.2 Define enabling and supporting applications

    2.2.3 Build your product family canvas

    This phase involves the following participants:

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Step 2.1

    Determine your approach to scale product families

    Activities

    2.1.1 Define your scaling principles and goals

    2.1.2 Define your pilot product family areas and direction

    This step involves the following participants:

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Outcomes of this step

    • List of product scaling principles
    • Scope of product scaling pilot and target areas
    • Scaling approach and direction

    Use consistent terminology for product and service families

    In this blueprint, we refer to any grouping of products or services as a “family.” Your organization may prefer other terms, such as product/service line, portfolio, group, etc. The underlying principles for grouping and managing product families are the same, so define the terminology that fits best with your culture. The same is true for “products” and “services,” which may also be referred to in different terms.

    An example flowchart is displayed to demonstrate the terminology for product and service families.

    A product family is a logical and operational grouping of related products or services. The grouping provides a scaled hierarchy to translate goals, priorities, strategy, and constraints down the grouping while aligning value realization upwards.

    Group product families by related purpose to improve business value

    Families should be scaled by how the products operationally relate to each other, with clear boundaries and common purpose.

    A product family contains...

    • Vision
    • Goals
    • Cumulative roadmap of the products within the family

    A product family can be grouped by...

    • Function
    • Value stream and capability
    • Customer segments or end-user group
    • Strategic purpose
    • Underlying architecture
    • Common technology or support structures
    • And many more
    A flowchart is shown to demonstrate the product family and product relations.

    Scale products into related families to improve value delivery and alignment

    Defining product families builds a network of related products into coordinated value delivery streams.

    A flowchart is shown to demonstrate the relations between product family and the delivery streams.

    “As with basic product management, scaling an organization is all about articulating the vision and communicating it effectively. Using a well-defined framework helps you align the growth of your organization with that of the company. In fact, how the product organization is structured is very helpful in driving the vision of what you as a product company are going to do.”

    – Rich Mironov, Mironov Consulting

    Product families translate enterprise goals into value-enabling capabilities

    A flowchart is shown to demonstrate the relationship between enterprise strategy and enabling capabilities.

    Info-Tech Insight

    Your organizational goals and strategy are achieved through capabilities that deliver value. Your product hierarchy is the mechanism to translate enterprise goals, priorities, and constraints down to the product level where changes can be made.

    Arrange product families by operational groups, not solely by your org chart

    A flowchart is shown to demonstrate how to arrange product families by operational groups.

    1. To align product changes with enterprise goals and priorities, you need to organize your products into operational groups based on the capabilities or business functions the product and family support.

    2. Product managers translate these goals, priorities, and constraints into their product families, so they are actionable at the next level, whether that level is another product family or products implementing enhancements to meet these goals.

    3. The product family manager ensures that the product changes enhance the capabilities that allow you to realize your product family, division, and enterprise goals.

    4. Enabling capabilities realize value and help reach your goals, which then drives your next set of enterprise goals and strategy.

    Product families need owners with a more strategic focus

    Product Owner

    (More tactical product delivery focus)

    • Backlog management and prioritization
    • Product vision and product roadmap
    • Epic/story definition, refinement in conjunction with business stakeholders
    • Sprint planning with Scrum Master and delivery team
    • Working with Scrum Master to minimize disruption to team velocity
    • Ensuring alignment between business and Scrum teams during sprints
    • Profit and loss (P&L) product analysis and monitoring

    Product Manager

    (More strategic product family focus)

    • Product strategy, positioning, and messaging
    • Product family vision and product roadmap
    • Competitive analysis and positioning
    • New product innovation/definition
    • Release timing and focus (release themes)
    • Ongoing optimization of product-related marketing and sales activities
    • P&L product analysis and monitoring

    Info-Tech Insight

    “Product owner” and “product manager” are terms that should be adapted to fit your culture and product hierarchy. These are not management relationships but rather a way to structure related products and services that touch the same end users. Use the terms that work best in your culture.

    Download Build a Better Product Owner for role support.

    2.1.1 Define your scaling principles and goals

    30-60 minutes

    1. Discuss the guiding principles for your product scaling model. Your guiding principles should consider key business priorities, organizational culture, and division/team objectives, such as improving:
    • Business agility and ability to respond to changes and needs.
    • Alignment of product roadmaps to enterprise goals and priorities.
    • Collaboration between stakeholders and product delivery teams.
    • Resource utilization and productivity.
    • The quality and value of products.
    • Coordination between related products and services.

    Output

    • List of product scaling principles

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    Start scaling with a pilot

    You will likely use a combination of patterns that work best for each product area. Pilot your product scaling with a domain, team, or functional area before organizing your entire portfolio.

    Learn more about each pattern.

    Discuss the pros and cons of each.

    Select a pilot product area.

    Select a pattern.

    Approach alignment from both directions, validating by the opposite way

    Defining your product families is not a one-way street. Often, we start from either the top or the bottom depending on our scaling principles. We use multiple patterns to find the best arrangement and grouping of our products and families.

    It may be helpful to work partway, then approach your scaling from the opposite direction, meeting in the middle. This way you are taking advantage of the strengths in both approaches.

    Once you have your proposed structure, validate the grouping by applying the principles from the opposite direction to ensure each product and family is in the best starting group.

    As the needs of your organization change, you may need to realign your product families into your new business architecture and operational structure.

    A top-down alignment example is shown.

    When to use: You have a business architecture defined or clear market/functional grouping of value streams.

    A bottom-up alignment example is shown.

    When to use: You are starting from an Application Portfolio Management application inventory to build or validate application families.

    Top-down examples: Start with your enterprise structure or market grouping

    A top-down example flowchart is shown.

    Examples:

    Market Alignment
    • Consumer Banking
      • DDA: Checking, Savings, Money Market
      • Revolving Credit: Credit Cards, Line of Credit
      • Term Credit: Mortgage, Auto, Boat, Installment
    Enterprise Applications
    • Human Resources
      • Benefits: Health, Dental, Life, Retirement
      • Human Capital: Hiring, Performance, Training
      • Hiring: Posting, Interviews, Onboarding
    Shared Service
    • End-User Support
      • Desktop: New Systems, Software, Errors
      • Security: Access Requests, Password Reset, Attestations
    Business Architecture
    • Value Stream
      • Capability
        • Applications
        • Services

    Bottom-up examples: Start with your inventory

    Based on your current inventory, start organizing products and services into related groups using one of the five scaling models discussed in the next step.

    A bottom-up example flowchart is shown.

    Examples:

    Technical Grouping
    • Custom Apps: Java, .NET, Python
    • Cloud: Azure, AWS, Virtual Environments
    • Low Code: ServiceNow, Appian
    Functional/Capability Grouping
    • CRM: Salesforce, Microsoft CRM
    • Security Platforms: IAM, SSO, Scanning
    • Workflow: Remedy, ServiceNow
    Shared Services Grouping
    • Workflow: Appian, Pega, ServiceNow
    • Collaboration: SharePoint, Teams
    • Data: Dictionary, Lake, BI/Reporting

    2.1.2 Define your pilot product family areas and direction

    30-60 minutes

    1. Using your inventory of products for your pilot, consider the top-down and bottom-up approaches.
    2. Identify areas where you will begin arranging your product into families.
    3. Prioritize these pilot areas into waves:
      1. First pilot areas
      2. Second pilot areas
      3. Third pilot areas
    4. Discuss and decide whether a top-down or bottom-up approach is the best place to start for each pilot group.
    5. Prioritize your pilot families in the order in which you want to organize them. This is a guide to help you get started, and you may change the order during the scaling pattern exercise.

    Output

    • Scope of product scaling pilot and target areas

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    Step 2.2

    Define your product families

    Activities

    2.2.1 Arrange your applications and services into product families

    2.2.2 Define enabling and supporting applications

    2.2.3 Build your product family canvas

    This step involves the following participants:

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Outcomes of this step

    • Product family mapping
    • Product families
    • Enabling applications
    • Dependent applications
    • Product family canvas

    Use three perspectives to guide scaling pattern selection

    • One size does not fit all. There is no single or static product model that fits all product teams.
    • Structure relationships based on your organizational needs and capabilities.
    • Be flexible. Product ownership is designed to enable value delivery.
    • Avoid structures that promote proxy product ownership.
    • Make decisions based on products and services, not people. Then assign people to the roles.
    Alignment perspectives:

    Value Stream

    Align products based on the defined sources of value for a collection of products or services.

    For example: Wholesale channel for products that may also be sold directly to consumers, such as wireless network service.

    Users/Consumers

    Align products based on a common group of users or product consumers.

    For example: Consumer vs. small business vs. enterprise customers in banking, insurance, and healthcare.

    Common Domain

    Align products based on a common domain knowledge or skill set needed to deliver and support the products.

    For example: Applications in a shared service framework supporting other products.

    Leverage patterns for scaling products

    Organizing your products and families is easier when leveraging these grouping patterns. Each is explained in greater detail on the following slides

    Value Stream AlignmentEnterprise ApplicationsShared ServicesTechnicalOrganizational Alignment
    • Business architecture
      • Value stream
      • Capability
      • Function
    • Market/customer segment
    • Line of business (LoB)
    • Example: Customer group > value stream > products
    • Enabling capabilities
    • Enterprise platforms
    • Supporting apps
    • Example: HR > Workday/Peoplesoft > ModulesSupporting: Job board, healthcare administrator
    • Organization of related services into service family
    • Direct hierarchy does not necessarily exist within the family
    • Examples: End-user support and ticketing, workflow and collaboration tools
    • Domain grouping of IT infrastructure, platforms, apps, skills, or languages
    • Often used in combination with Shared Services grouping or LoB-specific apps
    • Examples: Java, .NET, low-code, database, network
    • Used at higher levels of the organization where products are aligned under divisions
    • Separation of product managers from organizational structure no longer needed because the management team owns product management role

    Select the best family pattern to improve alignment

    A flowchart is shown on how to select the best family pattern to improve alignment.

    Use scenarios to help select patterns

    Top-Down

    Bottom-Up

    We have a business architecture defined.

    (See Document Your Business Architecture and industry reference architectures for help.)

    Start with your business architecture

    Start with market segments

    We want to be more customer first or customer centric.

    Start with market segments

    Our organization has rigid lines of business and organizational boundaries.

    Start with LoB structure

    Most products are specific to a business unit or division. Start with LoB structure

    Products are aligned to people, not how we are operationally organized.

    Start with market or LoB structure

    We are focusing on enterprise or enabling applications.

    1. Start with enterprise app and service team

    2. Align supporting apps

    We already have applications and services grouped into teams but want to evaluate if they are grouped in the best families.

    Validate using multiple patterns

    Validate using multiple patterns

    Our applications and services are shared across the enterprise or support multiple products, value streams, or shared capabilities.

    Our applications or services are domain, knowledge, or technology specific.

    Start by grouping inventory

    We are starting from an application inventory. (See the APM Research Center for help.)

    Start by grouping inventory

    Pattern: Value Stream – Capability

    Grouping products into capabilities defined in your business architecture is recommended because it aligns people/processes (services) and products (tools) into their value stream and delivery grouping. This requires an accurate capability map to implement.

    Example:

    • Healthcare is delivered through a series of distinct value streams (top chevrons) and shared services supporting all streams.
    • Diagnosing Health Needs is executed through the Admissions, Testing, Imaging, and Triage capabilities.
    • Products and services are needed to deliver each capability.
    • Shared capabilities can also be grouped into families to better align capability delivery and maturity to ensure that the enterprise goals and needs are being met in each value stream the capabilities support.
    An example is shown to demonstrate how to group products into capabilities.

    Sample business architecture/ capability map for healthcare

    A sample business architecture/capability map for healthcare is shown.

    Your business architecture maps your value streams (value delivered to your customer or user personas) to the capabilities that deliver that value. A capability is the people, processes, and/or tools needed to deliver each value function.

    Defining capabilities are specific to a value stream. Shared capabilities support multiple value streams. Enabling capabilities are core “keep the lights on” capabilities and enterprise functions needed to run your organization.

    See Info-Tech’s industry coverage and reference architectures.

    Download Document Your Business Architecture

    Pattern: Value Stream – Market

    Market/Customer Segment Alignment focuses products into the channels, verticals, or market segments in the same way customers and users view the organization.

    An example is shown to demonstrate how products can be placed into channels, verticals, or market segments.

    Example:

    • Customers want one stop to solve all their issues, needs, and transactions.
    • Banking includes consumer, small business, and enterprise.
    • Consumer banking can be grouped by type of financial service: deposit accounts (checking, savings, money market), revolving credit (credit cards, lines of credit), term lending (mortgage, auto, installment).
    • Each group of services has a unique set of applications and services that support the consumer product, with some core systems supporting the entire relationship.

    Pattern: Value Stream – Line of Business (LoB)

    Line of Business Alignment uses the operational structure as the basis for organizing products and services into families that support each area.

    An example of the operational structure as the basis is shown.

    Example:

    • LoB alignment favors continuity of services, tools, and skills based on internal operations over unified customer services.
    • A hospital requires care and services from many different operational teams.
    • Emergency services may be internally organized by the type of care and emergency to allow specialized equipment and resources to diagnose and treat the patients, relying on support teams for imaging and diagnostics to support care.
    • This model may be efficient and logical from an internal viewpoint but can cause gaps in customer services without careful coordination between product teams.

    Pattern: Enterprise Applications

    A division or group delivers enabling capabilities, and the team’s operational alignment maps directly to the modules/components of an enterprise application and other applications that support the specific business function.

    An example flowchart is shown with enterprise applications.

    Example:

    • Human resources is one corporate function. Within HR, however, there are subfunctions that operate independently.
    • Each operational team is supported by one or more applications or modules within a primary HR system.
    • Even though the teams work independently, the information they manage is shared with or ties into processes used by other teams. Coordination of efforts helps provide a higher level of service and consistency.

    For additional information about HRMS, please download Get the Most Out of Your HRMS.

    Pattern: Shared Services

    Grouping by service type, knowledge area, or technology allows for specialization while families align service delivery to shared business capabilities.

    An example is shown with the shared services.

    Example:

    • Recommended for governance, risk, and compliance; infrastructure; security; end-user support; and shared platforms (workflow, collaboration, imaging/record retention). Direct hierarchies do not necessarily exist within the shared service family.
    • Service groupings are common for service owners (also known as support managers, operations managers, etc.).
    • End-user ticketing comes through a common request system, is routed to the team responsible for triage, and then is routed to a team for resolution.
    • Collaboration tools and workflow tools are enablers of other applications, and product families might support multiple apps or platforms delivering that shared capability.

    Pattern: Technical

    Technical grouping is used in Shared Services or as a family grouping method within a Value Stream Alignment (Capability, Market, LoB) product family.

    An example of technical grouping is shown.

    Example:

    • Within Shared Services, Technical product grouping focuses on domains requiring specific experience and knowledge not common to typical product teams. This can also support insourcing so other product teams do not have to build their own capacity.
    • Within a Market or LoB team, these same technical groups support specific tools and services within that product family only while also specializing in the business domain.
    • Alignment into tool, platform, or skill areas improves delivery capabilities and resource scalability.

    Pattern: Organizational Alignment

    Eventually in your product hierarchy, the management structure functions as the product management team.

    • When planning your product families, be careful determining when to merge product families into the management team structure.
    • Since the goal of scaling products into families is to align product delivery roadmaps to enterprise goals and enable value realization, the primary focus of scaling must be operational.
    • Alignment to the organizational chart should only occur when the product families report into an HR manager who has ownership for the delivery and value realization for all product and services within that family.
    Am example of organizational alignment is shown.

    Download Build a Better Product Owner for role support.

    2.2.1 Arrange your applications and services into product families

    1-4 hours

    1. (Optional but recommended) Define your value streams and capabilities on the App Capability List tab in the Deliver Digital Products at Scale Workbook.
    2. On the Product Families tab, build your product family hierarchy using the following structure:
    • Value Stream > Capability > Family 3 > Family 2 > Family 1 > Product/Service.
    • If you are not using a Value Stream > Capability grouping, you can leave these blank for now.
    A screenshot of the App Capability List in the Deliver Disital Products at Scale Workbook is shown.
  • If you previously completed an application inventory using one of our application portfolio management (APM) resources, you can paste values here. Do not paste cells, as Excel may create a cell reference or replace the current conditional formatting.
  • Output

    • Product family mapping

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    2.2.2 Define enabling and supporting applications

    1-4 hours

    1. Review your grouping from the reverse direction or with different patterns to validate the grouping. Consider each grouping.
    • Does it operationally align the products and families to best cascade enterprise goals and priorities while validating enabling capabilities?
    • In the next phase, when defining your roadmap strategy, you may wish to revisit this phase and adjust as needed.
  • Select and enter enabling or dependent applications to the right of each product.
  • A screenshot from the Deliver Digitial Products at Scale Workbook is shown.

    Output

    • Product families
    • Enabling applications
    • Dependent applications

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    Use a product canvas to define key elements of your product family

    A product canvas is an excellent tool for quickly providing important information about a product family.

    Product owners/managers

    Provide target state to align child product and product family roadmaps.

    Stakeholders

    Communicate high-level concepts and key metrics with leadership teams and stakeholders.

    Strategy teams

    Use the canvas as a tool for brainstorming, scoping, and ideation.

    Operations teams

    Share background overview to align operational team with end-user value.

    Impacted users

    Refine communication strategy and support based on user impacts and value realization.

    Download Deliver on Your Digital Product Vision.

    Product Family Canvas: Define your core information

    A screenshot of the product family canvas is shown.

    Problem Statement: The problem or need the product family is addressing

    Business Goals: List of business objectives or goals for the product

    Personas/Customers/Users: List of groups who consume the product/service

    Vision: Vision, unique value proposition, elevator pitch, or positioning statement

    Child Product Families or Products: List of product families or products within this family

    Stakeholders: List of key resources, stakeholders, and teams needed to support the product or service

    Download Deliver on Your Digital Product Vision.

    2.2.3 Build your product family canvas

    30-60 minutes

    1. Complete the following fields to build your product family canvas in your Digital Product Family Strategy Playbook:
      1. Product family name
      2. Product family owner
      3. Parent product family name
      4. Problem that the family is intending to solve (For additional help articulating your problem statement, refer to Deliver on Your Digital Product Vision.)
      5. Product family vision/goals (For additional help writing your vision, refer to Deliver on Your Digital Product Vision..)
      6. Child product or product family name(s)
      7. Primary customers/users (For additional help with your product personas, download and complete Deliver on Your Digital Product Vision..)
      8. Stakeholders (If you aren’t sure who your stakeholders are, fill this in after completing the stakeholder management exercises in phase 3.)

    Output

    • Product family canvas

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers
    • Business analysts

    Record the results in the Digital Product Family Strategy Playbook.

    A screenshot of the Product Family Canvas is shown.

    Phase 3

    Ensure Alignment Between Products and Families

    Phase 1Phase 2Phase 3Phase 4Phase 5

    1.1 Understand the organizational factors driving product-centric delivery

    1.2 Establish your organization’s product inventory

    2.1 Determine your approach to scale product families

    2.2 Define your product families

    3.1 Leverage product family roadmaps

    3.2 Use stakeholder management to improve roadmap communication

    3.3 Configure your product family roadmaps

    3.4 Confirm product family to product alignment

    4.1 Assess your organization’s delivery readiness

    4.2 Understand your delivery options

    4.3 Determine your operating model

    4.4 Identify how to fund product family delivery

    5.1 Learn how to introduce your digital product family strategy

    5.2 Communicate changes on updates to your strategy

    5.3 Determine your next steps

    This phase will walk you through the following activities:

    • 3.1.1 Evaluate your current approach to product family communication
    • 3.2.1 Visualize interrelationships among stakeholders to identify key influencers
    • 3.2.2 Group stakeholders into categories
    • 3.2.3 Prioritize your stakeholders
    • 3.3.1 Define the communication objectives and audience of your product family roadmaps
    • 3.3.2 Identify the level of detail that you want your product family roadmap artifacts to represent
    • 3.4.1 Validate business value alignment between products and their product families

    This phase involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Step 3.1

    Leverage product family roadmaps

    Activities

    3.1.1 Evaluate your current approach to product family communication

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Outcomes of this step

    • Understanding of what a product family roadmap is
    • Comparison of Info-Tech’s position on product families to how you currently communicate about product families

    Aligning products’ goals with families

    Without alignment between product family goals and their underlying products, you aren’t seeing the full picture.

    An example of a product roadmap is shown to demonstrate how it is the core to value realization.

    Adapted from: Pichler," What Is Product Management?"

    • Aligning product strategy to enterprise goals needs to happen through the product family.
    • A product roadmap has traditionally been used to express the overall intent and visualization of the product strategy.
    • Connecting the strategy of your products with your enterprise goals can be done through the product family roadmap.

    Leveraging product family roadmaps

    It’s more than a set of colorful boxes.

      ✓ Lays out a strategy for your product family.

      ✓ Is a statement of intent for your family of products.

      ✓ Communicates direction for the entire product family and product teams.

      ✓ Directly connects to the organization’s goals.

    However, it is not:

      x Representative of a hard commitment.

      x A simple combination of your current product roadmaps.

      x A technical implementation plan.

    Product family roadmaps

    A roadmap is shown without any changes.

    There is no such thing as a roadmap that never changes.

    Your product family roadmap represents a broad statement of intent and high-level tactics to get closer to the organization’s goals.

    A roadmap is shown with changes.

    All good product family roadmaps embrace change!

    Your strategic intentions are subject to volatility, especially those planned further in the future. The more costs you incur in planning, the more you leave yourself exposed to inefficiency and waste if those plans change.

    Info-Tech Insight

    A good product family roadmap is intended to manage and communicate the inevitable changes as a result of market volatility and changes in strategy.

    Product family roadmaps are more strategic by nature

    While individual product roadmaps can be different levels of tactical or strategic depending on a variety of market factors, your options are more limited when defining roadmaps for product families.

    An image is displayed to show the relationships between product and product family, and how the roadmaps could be tactical or strategic.

    Info-Tech Insight

    Roadmaps for your product family are, by design, less detailed. This does not mean they aren’t actionable! Your product family roadmap should be able to communicate clear intentions around the future delivery of value in both the near and long term.

    Reminder: Your enterprise vision provides alignment for your product family roadmaps

    Not knowing the difference between enterprise vision and goals will prevent you from both dreaming big and achieving your dream.

    Your enterprise vision represents your “north star” – where you want to go. It represents what you want to do.

    • Your enterprise goals represent what you need to achieve in order to reach your enterprise vision.
    • A key element of operationalizing your vision.
    • Your strategy, initiatives, and features will align with one or more goals.

    Download Deliver on Your Digital Product Vision for support.

    Multiple roadmap views can communicate differently, yet tell the same truth

    Audience

    Business/ IT Leaders

    Users/Customers

    Delivery Teams

    Roadmap View

    Portfolio

    Product Family

    Technology

    Objectives

    To provide a snapshot of the portfolio and priority products

    To visualize and validate product strategy

    To coordinate broad technology and architecture decisions

    Artifacts

    Line items or sections of the roadmap are made up of individual products, and an artifact represents a disposition at its highest level.

    Artifacts are generally grouped by product teams and consist of strategic goals and the features that realize those goals.

    Artifacts are grouped by the teams who deliver that work and consist of technical capabilities that support the broader delivery of value for the product family.

    Typical elements of a product family roadmap

    While there are others, these represent what will commonly appear across most family-based roadmaps.

    An example is shown to highlight the typical elements of a product family roadmap.

    GROUP/CATEGORY: Groups are collections of artifacts. In a product family context, these are usually product family goals, value streams, or products.

    ARTIFACT: An artifact is one of many kinds of tangible by-products produced during the delivery of products. For a product family, the artifacts represented are capabilities or value streams.

    MILESTONE: Points in the timeline when established sets of artifacts are complete. This is a critical tool in the alignment of products in a given family.

    TIME HORIZON: Separated periods within the projected timeline covered by the roadmap.

    3.1.1 Evaluate your current approach to product family communication

    1-2 hours

    1. Write down how you currently communicate your intentions for your products and family of products.
    2. Compare and contrast this to how this blueprint defines product families and product family roadmaps.
    3. Consider the similarities and the key gaps between your current approach and Info-Tech’s definition of product family roadmaps.

    Output

    • Your documented approach to product family communication

    Participants

    • Product owners
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    Step 3.2

    Use stakeholder management to improve roadmap communication

    Activities

    3.2.1 Visualize interrelationships among stakeholders to identify key influencers

    3.2.2 Group stakeholders into categories

    3.2.3 Prioritize your stakeholders

    Info-Tech Note

    If you have done the stakeholder exercises in Deliver on Your Digital Product Vision or Build a Better Product Owner u don’t need to repeat the exercises from scratch.

    You can bring the results forward and update them based on your prior work.

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Outcomes of this step

    • Relationships among stakeholders and influencers
    • Categorization of stakeholders and influencers
    • Stakeholder and influencer prioritization

    Reminder: Not everyone is a user!

    USERS

    Individuals who directly obtain value from usage of the product.

    STAKEHOLDERS

    Represent individuals who provide the context, alignment, and constraints that influence or control what you will be able to accomplish.

    FUNDERS

    Individuals both external and internal that fund the product initiative. Sometimes they are lumped in as stakeholders. However, motivations can be different.

    For more information, see Deliver on Your Digital Product Vision.

    A stakeholder strategy is a key part of product family attainment

    A roadmap is only “good” when it effectively communicates to stakeholders. Understanding your stakeholders is the first step in delivering great product family roadmaps.

    A picture is shown that has 4 characters with puzzle pieces, each repersenting a key to product family attainment. The four keys are: Stakeholder management, product lifecycle, project delivery, and operational support.

    Create a stakeholder network map for product roadmaps and prioritization

    Follow the trail of breadcrumbs from your direct stakeholders to their influencers to uncover hidden stakeholders.

    An example stakeholder network map is displayed.

    Legend

    Black arrows: indicate the direction of professional influence

    Dashed green arrows: indicate bidirectional, informal influence relationships

    Info-Tech Insight

    Your stakeholder map defines the influence landscape your product family operates in. It is every bit as important as the teams who enhance, support, and operate your product directly.

    Use connectors to determine who may be influencing your direct stakeholders. They may not have any formal authority within the organization, but they may have informal yet substantial relationships with your stakeholders.

    3.2.1 Visualize interrelationships among stakeholders to identify key influencers

    60 minutes

    1. List direct stakeholders for your product.
    2. Determine the stakeholders of your stakeholders and consider adding each of them to the stakeholder list.
    3. Assess who has either formal or informal influence over your stakeholders; add these influencers to your stakeholder list.
    4. Construct a diagram linking stakeholders and their influencers together.
    • Use black arrows to indicate the direction of professional influence.
    • Use dashed green arrows to indicate bidirectional, informal influence relationships.

    Output

    • Relationships among stakeholders and influencers

    Participants

    • Product owners
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    Categorize your stakeholders with a prioritization map

    A stakeholder prioritization map helps product leaders categorize their stakeholders by their level of influence and ownership in the product and/or teams.

    An example stakeholder prioritization map is shown.

    There are four areas in the map, and the stakeholders within each area should be treated differently.

    Players – players have a high interest in the initiative and the influence to effect change over the initiative. Their support is critical, and a lack of support can cause significant impediment to the objectives.

    Mediators – mediators have a low interest but significant influence over the initiative. They can help to provide balance and objective opinions to issues that arise.

    Noisemakers – noisemakers have low influence but high interest. They tend to be very vocal and engaged, either positively or negatively, but have little ability to enact their wishes.

    Spectators – generally, spectators are apathetic and have little influence over or interest in the initiative.

    3.2.2 Group stakeholders into categories

    30-60 minutes

    1. Identify your stakeholders’ interest in and influence on your product as high, medium, or low by rating the attributes below.
    2. Map your results to the model below to determine each stakeholder’s category.
    Level of Influence
    • Power: Ability of a stakeholder to effect change.
    • Urgency: Degree of immediacy demanded.
    • Legitimacy: Perceived validity of stakeholder’s claim.
    • Volume: How loud their “voice” is or could become.
    • Contribution: What they have that is of value to you.
    Level of Interest

    How much are the stakeholder’s individual performance and goals directly tied to the success or failure of the product?

    The example stakeholder prioritization map is shown with the stakeholders grouped into the categories.

    Output

    • Categorization of stakeholders and influencers

    Participants

    • Product owners
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    Prioritize your stakeholders

    There may be too many stakeholders to be able to manage them all. Focus your attention on the stakeholders that matter most.

    Level of Support

    Stakeholder Category

    Supporter

    Evangelist

    Neutral Blocker

    Player

    Critical

    High

    High

    Critical

    Mediator

    Medium

    Low

    Low

    Medium

    Noisemaker

    High

    Medium

    Medium

    High

    Spectator

    Low

    Irrelevant

    Irrelevant

    Low

    Consider the three dimensions for stakeholder prioritization: influence, interest, and support. Support can be determined by answering the following question: How likely is it that this stakeholder would recommend your product?

    These parameters are used to prioritize which stakeholders are most important and should receive your focused attention.

    3.2.3 Prioritize your stakeholders

    30 minutes

    1. Identify the level of support of each stakeholder by answering the following question: How likely is it that this stakeholder would endorse your product?
    2. Prioritize your stakeholders using the prioritization scheme on the previous slide.

    Stakeholder

    Category

    Level of Support

    Prioritization

    CMO

    Spectator

    Neutral

    Irrelevant

    CIO

    Player

    Supporter

    Critical

    Output

    • Stakeholder and influencer prioritization

    Participants

    • Product owners
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    Define strategies for engaging stakeholders by type

    An example is shown to demonstrate how to define strategies to engage staeholders by type.

    Type

    Quadrant

    Actions

    Players

    High influence, high interest – actively engage

    Keep them updated on the progress of the project. Continuously involve Players in the process and maintain their engagement and interest by demonstrating their value to its success.

    Mediators

    High influence, low interest – keep satisfied

    They can be the game changers in groups of stakeholders. Turn them into supporters by gaining their confidence and trust and including them in important decision-making steps. In turn, they can help you influence other stakeholders.

    Noisemakers

    Low influence, high interest – keep informed

    Try to increase their influence (or decrease it if they are detractors) by providing them with key information, supporting them in meetings, and using Mediators to help them.

    Spectators

    Low influence, low interest – monitor

    They are followers. Keep them in the loop by providing clarity on objectives and status updates.

    Info-Tech Insight

    Each group of stakeholders draws attention and resources away from critical tasks. By properly identifying your stakeholder groups, the product owner can develop corresponding actions to manage stakeholders in each group. This can dramatically reduce wasted effort trying to satisfy Spectators and Noisemakers, while ensuring the needs of Mediators and Players are met.

    Step 3.3

    Configure your product family roadmaps

    Activities

    3.3.1 Define the communication objectives and audience of your product family roadmaps

    3.3.2 Identify the level of detail that you want your product family roadmap artifacts to represent

    Info-Tech Note

    If you are unfamiliar with product roadmaps, Deliver on Your Digital Product Vision contains more detailed exercises we recommend you review before focusing on product family roadmaps.

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Outcomes of this step

    • An understanding of the key communication objectives and target stakeholder audience for your product family roadmaps
    • A position on the level of detail you want your product family roadmap to operate at

    Your communication objectives are linked to your audience; ensure you know your audience and speak their language

    I want to... I need to talk to... Because they are focused on...
    ALIGN PRODUCT TEAMS Get my delivery teams on the same page. Architects Products Owners PRODUCTS A product that delivers value against a common set of goals and objectives.
    SHOWCASE CHANGES Inform users and customers of product strategy. Bus. Process Owners End Users FUNCTIONALITY A group of functionality that business customers see as a single unit.
    ARTICULATE RESOURCE REQUIREMENTS Inform the business of product development requirements. IT Management Business Stakeholders FUNDING An initiative that those with the money see as a single budget.

    3.3.1 Define the communication objectives and audience of your product family roadmaps

    30-60 minutes

    1. Explicitly state the communication objectives and audience of your roadmap.
    • Think of finishing this sentence: This roadmap is designed for … in order to …
  • You may want to consider including more than a single audience or objective.
  • Example:
  • Roadmap

    Audience

    Statement

    Internal Strategic Roadmap

    Internal Stakeholders

    This roadmap is designed to detail the strategy for delivery. It tends to use language that represents internal initiatives and names.

    Customer Strategic Roadmap

    External Customers

    This roadmap is designed to showcase and validate future strategic plans and internal teams to coordinate the development of features and enablers.

    Output

    • Roadmap list with communication objectives and audience

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    The length of time horizons on your roadmap depend on the needs of the underlying products or families

    Info-Tech InsightAn example timeline is shown.

    Given the relationship between product and product family roadmaps, the product family roadmap needs to serve the time horizons of its respective products.

    This translates into product family roadmaps with timelines that, at a minimum, cover the full scope of the respective product roadmaps.

    Based on your communication objectives, consider different ways to visualize your product family roadmap

    Swimline/Stream-Based roadmap example.

    Swimlane/Stream-Based – Understanding when groups of items intend to be delivered.

    An example is shown that has an overall plan with rough intentions around delivery.

    Now, Next, Later – Communicate an overall plan with rough intentions around delivery without specific date ranges.

    An example of a sunrise roadmap is shown.

    Sunrise Roadmap – Articulate the journey toward a given target state across multiple streams.

    Before connecting your family roadmap to products, think about what each roadmap typically presents

    An example of a product family roadmap is shown and how it can be connected to the products.

    Info-Tech Insight

    Your product family roadmap and product roadmap tell different stories. The product family roadmap represents the overall connection of products to the enterprise strategy, while the product roadmap focuses on the fulfillment of the product’s vision.

    Example: Connecting your product family roadmaps to product roadmaps

    Your roadmaps should be connected at an artifact level that is common between both. Typically, this is done with capabilities, but you can do it at a more granular level if an understanding of capabilities isn’t available.

    Example is shown connecting product family roadmaps to product roadmaps.

    3.3.2 Identify the level of detail that you want your product family roadmap artifacts to represent

    30-60 minutes

    1. Consider the different available artifacts for a product family (goals, value stream, capabilities).
    2. List the roadmaps that you wish to represent.
    3. Based on how you currently articulate details on your product families, consider:
    • What do you want to use as the level of granularity for the artifact? Consider selecting something that has a direct connection to the product roadmap itself (for example, capabilities).
    • For some roadmaps you will want to categorize your artifacts – what would work best in those cases?

    Examples

    Level of Hierarchy

    Artifact Type

    Roadmap 1

    Goals

    Capability

    Roadmap 2

    Roadmap 3

    Output

    • Details on your roadmap granularity

    Participants

    • Product owners
    • Product managers
    • Portfolio managers

    Record the results in the Deliver Digital Products at Scale Workbook.

    Step 3.4

    Confirm goal and value alignment of products and their product families

    Activities

    3.4.1 Validate business value alignment between products and their product families

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Outcomes of this step

    • Validation of the alignment between your product families and products

    Confirming product to family value alignment

    It isn’t always obvious whether you have the right value delivery alignment between products and product families.

    An example is shown to demonstrate product-to-family-alignment.

    Product-to-family alignment can be validated in two different ways:

    1. Initial value alignment
    2. Confirm the perceived business value at a family level is aligned with what is being delivered at a product level.

    3. Value measurement during the lifetime of the product
    4. Validate family roadmap attainment through progression toward the specified product goals.

    For more detail on calculating business value, see Build a Value Measurement Framework.

    To evaluate a product family’s contribution, you need a common definition of value

    Why is having a common value measure important?

    CIO-CEO Alignment Diagnostic

    A stacked bar graph is shown to demonstrate CIO-CEO Alignment Diagnostic. A bar titled Business Value Metrics is highlighted. 51% had some improvement necessary and 32% had significant improvement necessary.

    Over 700 Info-Tech members have implemented the Balanced Value Measurement Framework.

    “The cynic knows the price of everything and the value of nothing.”

    – Oscar Wilde

    “Price is what you pay. Value is what you get.”

    – Warren Buffett

    Understanding where you derive value is critical to building solid roadmaps.

    All value in your product family is not created equal

    Business value is the value of the business outcome the application produces and how effective the product is at producing that outcome. Dissecting value by the benefit type and the value source allows you to see the many ways in which a product or service brings value to your organization. Capture the value of your products in short, concise statements, like an elevator pitch.

    A business value matrix is shown.

    Increase Revenue

    Product or service functions that are specifically related to the impact on your organization’s ability to generate revenue.

    Reduce Costs

    Reduction of overhead. The ways in which your product limits the operational costs of business functions.

    Enhance Services

    Functions that enable business capabilities that improve the organization’s ability to perform its internal operations.

    Reach Customers

    Application functions that enable and improve the interaction with customers or produce market information and insights.

    Financial Benefits vs. Improved Capabilities

    • Financial Benefit refers to the degree to which the value source can be measured through monetary metrics and is often quite tangible.
    • Human Benefit refers to how a product or service can deliver value through a user’s experience.

    Inward vs. Outward Orientation

    • Inward refers to value sources that have an internal impact and improve your organization’s effectiveness and efficiency in performing its operations.
    • Outward refers to value sources that come from your interaction with external factors, such as the market or your customers.

    3.4.1 Validate business value alignment between products and their product families

    30-60 minutes

    1. Draw the 2x2 Business Value Matrix on a flip chart or open the Business Value Matrix tab in the Deliver Digital Products at Scale Workbook to use in this exercise.
    2. Brainstorm and record the different types of business value that your product and product family produce on the sticky notes (one item per sticky note).
    3. As a team, evaluate how the product value delivered contributes to the product family value delivered. Note any gaps or differences between the two.

    Download and complete Build a Value Measurement Framework for full support in focusing product delivery on business value–driven outcomes.

    A business value matrix is shown.

    Output

    • Confirmation of value alignment between product families and their respective products

    Participants

    • Product owners
    • Product managers

    Record the results in the Deliver Digital Products at Scale Workbook.

    Example: Validate business value alignment between products and their product families

    An example of a business value matrix is shown.

    Measure product value with metrics tied to your business value sources and objectives

    Assign metrics to your business value sources

    Business Value Category

    Source Examples

    Metric Examples

    Profit Generation

    Revenue

    Customer Lifetime Value (LTV)

    Data Monetization

    Average Revenue per User (ARPU)

    Cost Reduction

    Reduce Labor Costs

    Contract Labor Cost

    Reduce Overhead

    Effective Cost per Install (eCPI)

    Service Enablement

    Limit Failure Risk

    Mean Time to Mitigate Fixes

    Collaboration

    Completion Time Relative to Deadline

    Customer and Market Reach

    Customer Satisfaction

    Net Promoter Score

    Customer Trends

    Number of Customer Profiles

    The importance of measuring business value through metrics

    The better an organization is at using business value metrics to evaluate IT’s performance, the more satisfied the organization is with IT’s performance as a business partner. In fact, those that say they’re effective at business value metrics have satisfaction scores that are 30% higher than those that believe significant improvements are necessary (Info-Tech’s IT diagnostics).

    Assigning metrics to your prioritized values source will allow you to more accurately measure a product’s value to the organization and identify optimization opportunities. See Info-Tech’s Related Research: Value, Delivery Metrics, Estimation blueprint for more information.

    Your product delivery pipeline connects your roadmap with business value realization

    The effectiveness of your product roadmap needs to be evaluated based on delivery capacity and throughput.

    A product roadmap is shown with additional details to demonstrate delivery capacity and throughput.

    When thinking about product delivery metrics, be careful what you ask for…

    As the saying goes “Be careful what you ask for, because you will probably get it.”

    Metrics are powerful because they drive behavior.

    • Metrics are also dangerous because they often lead to unintended negative outcomes.
    • Choose your metrics carefully to avoid getting what you asked for instead of what you intended.

    It’s a cautionary tale that also offers a low-risk path through the complexities of metrics use.

    For more information on the use (and abuse) of metrics, see Select and Use SDLC Metrics Effectively.

    Measure delivery and success

    Metrics and measurements are powerful tools to drive behavior change and decision making in your organization. However, metrics are highly prone to creating unexpected outcomes, so use them with great care. Use metrics judiciously to uncover insights but avoid gaming or ambivalent behavior, productivity loss, and unintended consequences.

    Build good practices in your selection and use of metrics:

    • Choose the metrics that are as close to measuring the desired outcome as possible.
    • Select the fewest metrics possible and ensure they are of the highest value to your team, the safest from gaming behaviors and unintended consequences, and the easiest to gather and report.
    • Never use metrics for reward or punishment; use them to develop your team.
    • Automate as much metrics gathering and reporting as possible.
    • Focus on trends rather than precise metrics values.
    • Review and change your metrics periodically.

    Phase 4

    Bridge the Gap Between Product Families and Delivery

    Phase 1Phase 2Phase 3Phase 4Phase 5

    1.1 Understand the organizational factors driving product-centric delivery

    1.2 Establish your organization’s product inventory

    2.1 Determine your approach to scale product families

    2.2 Define your product families

    3.1 Leverage product family roadmaps

    3.2 Use stakeholder management to improve roadmap communication

    3.3 Configure your product family roadmaps

    3.4 Confirm product family to product alignment

    4.1 Assess your organization’s delivery readiness

    4.2 Understand your delivery options

    4.3 Determine your operating model

    4.4 Identify how to fund product family delivery

    5.1 Learn how to introduce your digital product family strategy

    5.2 Communicate changes on updates to your strategy

    5.3 Determine your next steps

    This phase will walk you through the following activities:

    4.1.1 Assess your organization’s readiness to deliver digital product families

    4.2.1 Consider pros and cons for each delivery model relative to how you wish to deliver

    4.3.1 Understand the relationships between product management, delivery teams, and stakeholders

    4.4.1 Discuss traditional vs. product-centric funding methods

    This phase involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Assess the impacts of product-centric delivery on your teams and org design

    Product delivery can exist within any org structure or delivery model. However, when making the shift toward product management, consider optimizing your org design and product team structure to match your capacity and throughput needs.

    A flowchart is shown to see how the impacts of product-centric delivery can impact team and org designs.

    Info-Tech Note

    Realigning your delivery pipeline and org design takes significant effort and time. Although we won’t solve these questions here, it’s important to identify factors in your current or future models that improve value delivery.

    Step 4.1

    Assess your organization’s delivery readiness

    Activities

    4.1.1 Assess your organization’s readiness to deliver digital product families

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Outcomes of this step

    • An understanding of the group’s maturity level when it comes to product delivery

    Maturing product practices enables delivery of product families, not just products or projects

    A flowchart is shown to demonstrate the differences between project lifecycle, hybrid lifecycle, and product lifecycle.

    Just like product owners, product family owners are needed to develop long-term product value, strategy, and delivery. Projects can still be used as the source of funding and change management; however, the product family owner must manage product releases and operational support. The focus of this section will be on aligning product families to one or more releases.

    4.1.1 Assess your organization’s readiness to deliver digital product families

    30-60 minutes

    1. For each question in the Deliver Digital Products at Scale Readiness Assessment, ask yourself which of the five associated maturity statements most closely describes your organization.
    2. As a group, agree on your organization’s current readiness score for each of the six categories.

    A screenshot of the Deliver Digital Products at Scale Readiness Assessment is shown.

    Output

    • Product delivery readiness score

    Participants

    • Product managers
    • Product owners

    Download the Deliver Digital Products at Scale Readiness Assessment.

    Value realization is constrained by your product delivery pipeline

    Value is realized through changes made at the product level. Your pipeline dictates the rate, quality, and prioritization of your backlog delivery. This pipeline connects your roadmap goals to the value the goals are intended to provide.

    An example of a product roadmap is shown with the additional details of the product delivery pipeline being highlighted.

    Product delivery realizes value for your product family

    While planning and analysis are done at the family level, work and delivery are done at the individual product level.

    PRODUCT STRATEGY

    What are the artifacts?

    What are you saying?

    Defined at the family level?

    Defined at the product level?

    Vision

    I want to...

    Strategic focus

    Delivery focus

    Goals

    To get there we need to...

    Roadmap

    To achieve our goals, we’ll deliver...

    Backlog

    The work will be done in this order...

    Release Plan

    We will deliver in the following ways...

    Step 4.2

    Understand your delivery options

    Activities

    4.2.1 Consider pros and cons for each delivery model relative to how you wish to deliver

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Outcomes of this step

    • An understanding of the different team configuration options when it comes to delivery and their relevance to how you currently work

    Define the scope of your product delivery strategy

    The goal of your product delivery strategy is to establish streamlined, enforceable, and standardized product management and delivery capabilities that follow industry best practices. You will need to be strategic in how and where you implement your changes because this will set the stage for future adoption. Strategically select the most appropriate products, roles, and areas of your organization to implement your new or enhanced capabilities and establish a foundation for scaling.

    Successful product delivery requires people who are knowledgeable about the products they manage and have a broad perspective of the entire delivery process, from intake to delivery, and of the product portfolio. The right people also have influence with other teams and stakeholders who are directly or indirectly impacted by product decisions. Involve team members who have expertise in the development, maintenance, and management of your selected products and stakeholders who can facilitate and promote change.

    Learn about different patterns to structure and resource your product delivery teams

    The primary goal of any product delivery team is to improve the delivery of value for customers and the business based on your product definition and each product’s demand. Each organization will have different priorities and constraints, so your team structure may take on a combination of patterns or may take on one pattern and then transform into another.

    Delivery Team Structure Patterns

    How Are Resources and Work Allocated?

    Functional Roles

    Teams are divided by functional responsibilities (e.g. developers, testers, business analysts, operations, help desk) and arranged according to their placement in the software development lifecycle (SDLC).

    Completed work is handed off from team to team sequentially as outlined in the organization’s SDLC.

    Shared Service and Resource Pools

    Teams are created by pulling the necessary resources from pools (e.g. developers, testers, business analysts, operations, help desk).

    Resources are pulled whenever the work requires specific skills or pushed to areas where product demand is high.

    Product or System

    Teams are dedicated to the development, support, and management of specific products or systems.

    Work is directly sent to the teams who are directly managing the product or directly supporting the requester.

    Skills and Competencies

    Teams are grouped based on skills and competencies related to technology (e.g. Java, mobile, web) or familiarity with business capabilities (e.g. HR, finance).

    Work is directly sent to the teams who have the IT and business skills and competencies to complete the work.

    See the flow of work through each delivery team structure pattern

    Four delivery team structures are shown. The four are: functional roles, shared service and resource pools, product or system, and skills and competencies.

    Staffing models for product teams

    Functional Roles Shared Service and Resource Pools Product or System Skills and Competencies
    A screenshot of the functional roles from the flow of work example is shown. A screenshot of the shared service and resource pools from the flow of work example is shown. A screenshot of the product or system from the flow of work example is shown. A screenshot of skills and competencies from the flow of work example is shown.
    Pros
      ✓ Specialized resources are easier to staff

      ✓ Product knowledge is maintained

      ✓ Flexible demand/capacity management

      ✓ Supports full utilization of resources

      ✓ Teams are invested in the full life of the product

      ✓ Standing teams enable continuous improvement

      ✓ Teams are invested in the technology

      ✓ Standing teams enable continuous improvement

    Cons
      x Demand on specialists can create bottlenecks

      x Creates barriers to collaboration

      x Unavailability of resources can lead to delays

      x Product knowledge can be lost as resources move

      x Changes in demand can lead to downtime

      x Cross-functional skills make staffing a challenge

      x Technology bias can lead to the wrong solution

      x Resource contention when team supports multiple solutions

    Considerations
      ! Product owners must break requests down into very small components to support Agile delivery as mini-Waterfalls
      ! Product owners must identify specialist requirements in the roadmap to ensure resources are available
      ! Product owners must ensure that there is a sufficient backlog of valuable work ready to keep the team utilized
      ! Product owners must remain independent of technology to ensure the right solution is built
    Use Case
    • When you lack people with cross-functional skills
    • When you have specialists such as those skilled in security and operations who will not have full-time work on the product
    • When you have people with cross-functional skills who can self-organize around the request
    • When you have a significant investment in a specific technology stack

    4.2.1 Consider pros and cons for each delivery model relative to how you wish to deliver

    1. Document your current staffing model for your product delivery teams.
    2. Evaluate the pros and cons of each model, as specified on the previous slide, relative to how you currently work.
    3. What would be the ideal target state for your team? If one model does not completely fit, is there a hybrid option worth considering? For example: Product-Based combined with Shared Service/Resource Pools for specific roles.

    Functional Roles

    Teams are divided by functional responsibilities (e.g. developers, testers, business analysts, operations, help desk) and arranged according to their placement in the software development lifecycle (SDLC).

    Shared Service and Resource Pools

    Teams are created by pulling the necessary resources from pools (e.g. developers, testers, business analysts, operations, help desk).

    Product or System

    Teams are dedicated to the development, support, and management of specific products or systems.

    Skills and Competencies

    Teams are grouped based on skills and competencies related to technology (e.g. Java, mobile, web) or familiarity with business capabilities (e.g. HR, finance).

    Output

    • An understanding of pros and cons for each delivery model and the ideal target state for your team

    Participants

    • Product managers
    • Product owners

    Record the results in the Digital Product Family Strategy Playbook.

    Step 4.3

    Determine your operating model

    Activities

    4.3.1 Understand the relationships between product management, delivery teams, and stakeholders

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Outcomes of this step

    • An understanding of the potential operating models and what will work best for your organization

    Reminder: Patterns for scaling products

    The alignment of your product families should be considered in your operating model.

    Value Stream Alignment

    Enterprise Applications

    Shared Services

    Technical

    Organizational Alignment

    • Business architecture
      • Value stream
      • Capability
      • Function
    • Market/customer segment
    • Line of business (LoB)
    • Example: Customer group > value stream > products
    • Enabling capabilities
    • Enterprise platforms
    • Supporting apps
    • Example: HR > Workday/Peoplesoft > ModulesSupporting: Job board, healthcare administrator
    • Organization of related services into service family
    • Direct hierarchy does not necessarily exist within the family
    • Examples: End-user support and ticketing, workflow and collaboration tools
    • Domain grouping of IT infrastructure, platforms, apps, skills, or languages
    • Often used in combination with Shared Services grouping or LoB-specific apps
    • Examples: Java, .NET, low-code, database, network
    • Used at higher levels of the organization where products are aligned under divisions
    • Separation of product managers from organizational structure no longer needed because the management team owns product management role

    Ensure consistency in the application of your design principles with a coherent operating model

    What is an operating model?

    An operating model is an abstract visualization, used like an architect’s blueprint, that depicts how structures and resources are aligned and integrated to deliver on the organization’s strategy. It ensures consistency of all elements in the organizational structure through a clear and coherent blueprint before embarking on detailed organizational design

    The visual should highlight which capabilities are critical to attaining strategic goals and clearly show the flow of work so that key stakeholders can understand where inputs flow in and outputs flow out of the IT organization.

    An example of an operating model is shown.

    For more information, see Redesign Your IT Organizational Structure.

    Weigh the pros and cons of IT operating models to find the best fit

    1. LoB/Product Aligned – Decentralized Model: Line of Business, Geographically, Product, or Functionally Aligned
    2. A decentralized IT operating model that embeds specific functions within LoBs/product teams and provides cross-organizational support for their initiatives.

    3. Hybrid Functional: Functional/Product Aligned
    4. A best-of-both-worlds model that balances the benefits of centralized and decentralized approaches to achieve both customer responsiveness and economies of scale.

    5. Hybrid Service Model: Product-Aligned Operating Model
    6. A model that supports what is commonly referred to as a matrix organization, organizing by highly related service categories and introducing the role of the service owner.

    7. Centralized: Plan-Build-Run
    8. A highly typical IT operating model that focuses on centralized strategic control and oversight in delivering cost-optimized and effective solutions.

    9. Centralized: Demand-Develop-Service
    10. A centralized IT operating model that lends well to more mature operating environments. Aimed at leveraging economies of scale in an end-to-end services delivery model.

    There are many different operating models. LoB/Product Aligned and Hybrid Functional align themselves most closely with how products and product families are typically delivered.

    Decentralized Model: Line of Business, Geographically, Product, or Functionally Aligned

    An example of a decentralized model is shown.

    BENEFITS

    DRAWBACKS

    • Organization around functions (FXN) allows for diversity in approach in how areas are run to best serve specific business units needs.
    • Each functional line exists largely independently, with full capacity and control to deliver service at the committed service level agreements.
    • Highly responsive to shifting needs and demands with direct connection to customers and all stages of the solution development lifecycle.
    • Accelerates decision making by delegating authority lower into the FXN.
    • Promotes a flatter organization with less hierarchy and more direct communication with the CIO.
    • Less synergy and integration across what different lines of business are doing can result in redundancies and unnecessary complexity.
    • Higher overall cost to the IT group due to role and technology duplication across different FXN.
    • Inexperience becomes an issue; requires more competent people to be distributed across the FXN.
    • Loss of sight of the big picture – difficult to enforce standards around people/process/technology with solution ownership within the FXN.

    For more information, see Redesign your IT Organizational Structure.

    Hybrid Model: Functional/Product Aligned

    An example of a hybrid model: functional/product aligned is shown.

    BENEFITS

    DRAWBACKS

    • Best of both worlds of centralization and decentralization; attempts to channel benefits from both centralized and decentralized models.
    • Embeds key IT functions that require business knowledge within functional areas, allowing for critical feedback.
    • Balances a holistic IT strategy and architecture with responsiveness to needs of the organization.
    • Achieves economies of scale where necessary through the delivery of shared services that can be requested by the function.
    • May result in excessive cost through role and system redundancies across different functions
    • Business units can have variable levels of IT competence; may result in different levels of effectiveness.
    • No guaranteed synergy and integration across functions; requires strong communication, collaboration, and steering.
    • Cannot meet every business unit’s needs – can cause tension from varying effectiveness of the IT functions placed within the functional areas.

    For more information, see Redesign your IT Organizational Structure.

    Hybrid Model: Product-Aligned Operating Model

    An example of a hybrid model: product-aligned operating model.

    BENEFITS

    DRAWBACKS

    • Focus is on the full lifecycle of a product – takes a strategic view of how technology enables the organization.
    • Promotes centralized backlog around a specific value creator, rather than traditional project focus, which is more transactional.
    • Dedicated teams around the product family ensure that you have all of the resources required to deliver on your product roadmap.
    • Reduces barriers between IT and business stakeholders, focuses on technology as a key strategic enabler.
    • Delivery is largely done through a DevOps methodology.
    • Significant business involvement is required for success within this model, with business stakeholders taking an active role in product governance and potentially product management as well.
    • Strong architecture standards and practices are required to make this successful because you need to ensure that product families are building in a consistent manner and limiting application sprawl.
    • Introduced the need for practice standards to drive consistency in quality of delivered services.
    • May result in increased cost through role redundancies across different squads.

    For more information, see Redesign your IT Organizational Structure.

    Centralized: Plan-Build-Run

    An example of a centralized: Plan-Build-Run is shown.

    BENEFITS

    DRAWBACKS

    • Effective at implementing long-term plans efficiently, separates maintenance and projects to allow each to have the appropriate focus.
    • More oversight over financials; better suited for fixed budgets.
    • Works across centralized technology domains to better align with the business's strategic objectives – allows for a top-down approach to decision making.
    • Allows for economies of scale and expertise pooling to improve IT’s efficiency.
    • Well suited for a project-driven environment that employs Waterfall or a hybrid project management methodology that is less iterative.
    • Not optimized for unpredictable/shifting project demands, as decision making is centralized in the plan function.
    • Less agility to deliver new features or solutions to the customer in comparison to decentralized models.
    • Build (developers) and run (operations staff) are far removed from the business, resulting in lower understanding of business needs (as well as “passing the buck” – from development to operations).
    • Requires strong hand-off processes to be defined and strong knowledge transfer from build to run functions in order to be successful.

    For more information, see Redesign your IT Organizational Structure.

    Centralized: Demand-Develop-Service

    An example of a centralized: Demand-Develop-Service model is shown.

    BENEFITS

    DRAWBACKS

    • Aligns well with an end-to-end services model; constant attention to customer demand and service supply.
    • Centralizes service operations under one functional area to serve shared needs across lines of business.
    • Allows for economies of scale and expertise pooling to improve IT’s efficiency.
    • Elevates sourcing and vendor management as its own strategic function; lends well to managed service and digital initiatives.
    • Development and operations housed together; lends well to DevOps-related initiatives.
    • Can be less responsive to business needs than decentralized models due to the need for portfolio steering to prioritize initiatives and solutions.
    • Requires a higher level of operational maturity to succeed; stable supply functions (service mgmt., operations mgmt., service desk, security, data) are critical to maintaining business satisfaction.
    • Requires highly effective governance around project portfolio, services, and integration capabilities.
    • Effective feedback loop highly dependent on accurate performance measures.

    For more information, see Redesign your IT Organizational Structure.

    Assess how your product scaling pattern impacts your resource delivery model

    Value Stream Alignment

    Enterprise Applications

    Shared Services

    Technical

    Plan-Build-Run:
    Centralized

    Pro: Supports established and stable families.

    Con: Command-and-control nature inhibits Agile DevOps and business agility.

    Pro: Supports established and stable families.

    Con: Command-and-control nature inhibits Agile DevOps and business agility.

    Pro: Can be used to align high-level families.

    Con: Lacks flexibility at the product level to address shifting priorities in product demand.

    Pro: Supports a factory model.

    Con: Lacks flexibility at the product level to address shifting priorities in product demand.

    Centralized Model 2:
    Demand-Develop-
    Service

    Pro: Supports established and stable families.

    Con: Command-and-control nature inhibits Agile DevOps and business agility.

    Pro: Supports established and stable families.

    Con: Command-and-control nature inhibits Agile DevOps and business agility.

    Pro: Recommended for aligning high-level service families based on user needs.

    Con: Reduces product empowerment, prioritizing demand. Slow.

    Pro: Supports factory models.

    Con: Reduces product empowerment, prioritizing demand. Slow.

    Decentralized Model:
    Line of Business, Product, Geographically, or

    Functionally Aligned

    Pro: Aligns product families to value streams, capabilities, and organizational structure.

    Con: Reduces shared solutions and may create duplicate apps and services.

    Pro: Enterprise apps treated as distinct LoB groups.

    Con: Reduces shared solutions and may create duplicate apps and services.

    Pro: Complements value stream alignment by consolidating shared apps and services.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Fits within other groupings where technical expertise is needed.

    Con: Creates redundancy between localized and shared technical teams.

    Hybrid Model:
    Functional/Product

    Aligned

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Creates redundancy between localized and shared technical teams.

    Hybrid Model:

    Product-Aligned Operating Model

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Creates redundancy between localized and shared technical teams.

    4.3.1 Understand the relationships between product management, delivery teams, and stakeholders

    30-60 minutes

    1. Discuss the intake sources of product work.
    2. Trace the flow of requests down to the functional roles of your delivery team (e.g., developer, QA, operations).
    3. Indicate where key deliverables are produced, particularly those that are built in collaboration.
    4. Discuss the five operating models relative to your current operating model choice. How aligned are you?
    5. Review Info-Tech’s recommendation on the best-aligned operating models for product family delivery. Do you agree or disagree?
    6. Evaluate recommendations against how you operate/work.

    Output

    • Understanding of the relationships between key groups
    • A preferred operating model

    Participants

    • Product owners
    • Product managers
    • Delivery managers

    Record the results in the Digital Product Family Strategy Playbook.

    4.3.1 Understand the relationships between product management, delivery teams, and stakeholders

    An example of activity 4.3.1 to understand the relationships between product management, delivery teams, and stakeholders is shown.

    Output

    • Understanding of the relationships between key groups
    • A preferred operating model

    Participants

    • Product owners
    • Product managers
    • Delivery managers

    Step 4.4

    Identify how to fund product family delivery

    Activities

    4.4.1 Discuss traditional vs. product-centric funding methods

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Outcomes of this step

    • An understanding of the differences between product-based and traditional funding methods

    Why is funding so problematic?

    We often still think about funding products like construction projects.

    Three models are shown on the various options to fund projects.

    These models require increasing accuracy throughout the project lifecycle to manage actuals vs. estimates.

    "Most IT funding depends on one-time expenditures or capital-funding mechanisms that are based on building-construction funding models predicated on a life expectancy of 20 years or more. Such models don’t provide the stability or flexibility needed for modern IT investments." – EDUCAUSE

    Reminder: Projects don’t go away. The center of the conversation changes.

    A flowchart is shown to demonstrate the difference between project lifecycle, hybrid lifecycle, and product lifecycle.

    Projects within products

    Regardless of whether you recognize yourself as a product-based or project-based shop, the same basic principles should apply.

    The purpose of projects is to deliver the scope of a product release. The shift to product delivery leverages a product roadmap and backlog as the mechanism for defining and managing the scope of the release.

    Eventually, teams progress to continuous integration/continuous delivery (CI/CD) where they can release on demand or as scheduled, requiring org change management.

    Planning and budgeting for products and families

    Reward for delivering outcomes, not features

    AutonomyFlexibilityAccountability
    Fund what delivers valueAllocate iterativelyMeasure and adjust

    Fund long-lived delivery of value through products (not projects).

    Give autonomy to the team to decide exactly what to build.

    Allocate to a pool based on higher-level business case.

    Provide funds in smaller amounts to different product teams and initiatives based on need.

    Product teams define metrics that contribute to given outcomes.

    Track progress and allocate more (or less) funds as appropriate.

    Info-Tech Insight

    Changes to funding require changes to product and Agile practices to ensure product ownership and accountability.

    The Lean Enterprise Funding Model is an example of a different approach

    An example of the lean enterprise funding model is shown.
    From: Implement Agile Practices That Work

    A flexible funding pool akin to venture capital models is maintained to support innovative ideas and fund proofs of concept for product and process improvements.

    Proofs of concept (POCs) are run by standing innovation teams or a reserve of resources not committed to existing products, projects, or services.

    Every product line has funding for all changes and ongoing operations and support.

    Teams are funded continuously so that they can learn and improve their practices as much as possible.

    Budgeting approaches must evolve as you mature your product operating environment

    TRADITIONAL PROJECTS WITH WATERFALL DELIVERY

    TRADITIONAL PROJECTS WITH AGILE DELIVERY

    PRODUCTS WITH AGILE PROJECT DELIVERY

    PRODUCTS WITH AGILE DELIVERY

    WHEN IS THE BUDGET TRACKED?

    Budget tracked by major phases

    Budget tracked by sprint and project

    Budget tracked by sprint and project

    Budget tracked by sprint and release

    HOW ARE CHANGES HANDLED?

    All change is by exception

    Scope change is routine, budget change is by exception

    Scope change is routine, budget change is by exception

    Budget change is expected on roadmap cadence

    WHEN ARE BENEFITS REALIZED?

    Benefits realization after project completion

    Benefits realization is ongoing throughout the life of the project

    Benefits realization is ongoing throughout the life of the product

    Benefits realization is ongoing throughout life of the product

    WHO “DRIVES”?

    Project Manager

    • Project team delivery role
    • Refines project scope, advocates for changes in the budget
    • Advocates for additional funding in the forecast

    Product Owner

    • Project team delivery role
    • Refines project scope, advocates for changes in the budget
    • Advocates for additional funding in the forecast

    Product Manager

    • Product portfolio team role
    • Forecasting new initiatives during delivery to continue to drive value throughout the life of the product

    Product Manager

  • Product family team role
  • Forecasting new initiatives during delivery to continue to drive value throughout the life of the product
  • Info-Tech Insight

    As you evolve your approach to product delivery, you will be decoupling the expected benefits, forecast, and budget. Managing them independently will improve your ability to adapt to change and drive the right outcomes!

    Your strategy must include the cost to build and operate

    Most investment happens after go-live, not in the initial build!

    An example strategy is displayed that incorporates the concepts of cost to build and operate.

    Adapted from: LookFar

    Info-Tech Insight

    While the exact balance point between development or implementation costs varies from application to application, over 80% of the cost is accrued after go-live.

    Traditional accounting leaves software development CapEx on the table

    Software development costs have traditionally been capitalized, while research and operations are operational expenditures.

    The challenge has always been the myth that operations are only bug fixes, upgrades, and other operational expenditures. Research shows that most post-release work on developed solutions is the development of new features and changes to support material changes in the business. While projects could bundle some of these changes into capital expenditure, much of the business-as-usual work that goes on leaves capital expenses on the table because the work is lumped together as maintenance-related OpEx.

    From “How to Stop Leaving Software CapEx on the Table With Agile and DevOps”

    4.4.1 Discuss traditional vs. product-centric funding methods

    30-60 minutes

    1. Discuss how products and product families are currently funded.
    2. Review how the Agile/product funding models differ from how you currently operate.
    3. What changes do you need to consider in order to support a product delivery model?
    4. For each change, identify the key stakeholders and list at least one action to take.
    5. Record the results in the Digital Product Family Strategy Playbook.

    Output

    • Understanding of funding principles and challenges

    Participants

    • Product owners
    • Product managers
    • Delivery managers

    Record the results in the Digital Product Family Strategy Playbook.

    Phase 5

    Build Your Transformation Roadmap and Communication Plan

    Phase 1Phase 2Phase 3Phase 4Phase 5

    1.1 Understand the organizational factors driving product-centric delivery

    1.2 Establish your organization’s product inventory

    2.1 Determine your approach to scale product families

    2.2 Define your product families

    3.1 Leverage product family roadmaps

    3.2 Use stakeholder management to improve roadmap communication

    3.3 Configure your product family roadmaps

    3.4 Confirm product family to product alignment

    4.1 Assess your organization’s delivery readiness

    4.2 Understand your delivery options

    4.3 Determine your operating model

    4.4 Identify how to fund product family delivery

    5.1 Learn how to introduce your digital product family strategy

    5.2 Communicate changes on updates to your strategy

    5.3 Determine your next steps

    This phase will walk you through the following activities:

    5.1.1 Introduce your digital product family strategy

    5.2.1 Define your communication cadence for your strategy updates

    5.2.2 Define your messaging for each stakeholder

    5.3.1 How do we get started?

    This phase involves the following participants:

    • Product owners
    • Product managers
    • Application leaders
    • Stakeholders

    Step 5.1

    Introduce your digital product family strategy

    Activities

    5.1.1 Introduce your digital product family strategy

    This step involves the following participants:

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Outcomes of this step

    • A completed executive summary presenting your digital product strategy

    Product decisions are traditionally made in silos with little to no cross-functional communication and strategic oversight

    Software delivery teams and stakeholders traditionally make plans, strategies, and releases within their silos and tailor their decisions based on their own priorities. Interactions are typically limited to hand-offs (such as feature requests) and routing of issues and defects back up the delivery pipeline. These silos likely came about through well-intentioned training, mandates, and processes, but they do not sufficiently support today’s need to rapidly release and change platforms.

    Siloed departments often have poor visibility into the activities of other silos, and they may not be aware of the ramifications their decisions have on teams and stakeholders outside of their silo.

    • Silos may make choices that are optimal largely for themselves without thinking of the holistic impact on a platform’s structure, strategy, use cases, and delivery.
    • The business may approve platform improvements without the consideration of the delivery team’s current capacity or the system’s complexity, resulting in unrealistic commitments.
    • Quality standards may be misinterpreted and inconsistently enforced across the entire delivery pipeline.

    In some cases, the only way to achieve greater visibility and communication for all roles across a platform’s lifecycle is implementing an overarching role or team.

    “The majority of our candid conversations with practitioners and project management offices indicate that the platform ownership role is poorly defined and poorly executed.”

    – Barry Cousins

    Practice Lead, Applications – Project & Portfolio Management

    Info-Tech Research Group

    Use stakeholder management and roadmap views to improve communication

    Proactive, clear communication with stakeholders, SMEs, and your product delivery team can significantly improve alignment and agreement with your roadmap, strategy, and vision.

    When building your communication strategy, revisit the work you completed in phase 3 developing your:

    • Roadmap types
    • Stakeholder strategy

    Type

    Quadrant

    Actions

    Players

    High influence, high interest – actively engage

    Keep them updated on the progress of the project. Continuously involve Players in the process and maintain their engagement and interest by demonstrating their value to its success.

    Mediators

    High influence, low interest – keep satisfied

    They can be the game changers in groups of stakeholders. Turn them into supporters by gaining their confidence and trust and including them in important decision-making steps. In turn, they can help you influence other stakeholders.

    Noisemakers

    Low influence, high interest – keep informed

    Try to increase their influence (or decrease it if they are detractors) by providing them with key information, supporting them in meetings, and using Mediators to help them.

    Spectators

    Low influence, low interest – monitor

    They are followers. Keep them in the loop by providing clarity on objectives and status updates.

    5.1.1 Introduce your digital product family strategy

    30-60 minutes

    This exercise is intended to help you lay out the framing of your strategy and the justification for the effort. A lot of these items can be pulled directly from the product canvas you created in phase 2. This is intended to be a single slide to frame your upcoming discussions.

    1. Update your vision, goals, and values on your product canvas. Determine which stakeholders may be impacted and what their concerns are. If you have many stakeholders, limit to Players and Influencers.
    2. Identify what you need from the stakeholders as a result of this communication.
    3. Keeping in mind the information gathered in steps 1 and 2, describe your product family strategy by answering three questions:
    1. Why do we need product families?
    2. What is in our way?
    3. Our first step will be... ?

    Output

    • An executive summary that introduces your product strategy

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Digital Product Family Strategy Playbook.

    Example: Scaling delivery through product families

    Why do we need product families?

    • The growth of our product offerings and our company’s movement into new areas of growth mean we need to do a better job scaling our offerings to meet the needs of the organization.

    What is in our way?

    • Our existing applications and services are so dramatically different we are unsure how to bring them together.

    Our first step will be...

    • Taking a full inventory of our applications and services.

    Step 5.2

    Communicate changes on updates to your strategy

    Activities

    5.2.1 Define your communication cadence for your strategy updates

    5.2.2 Define your messaging for each stakeholder

    This step involves the following participants:

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Outcomes of this step

    • A communication plan for when strategy updates need to be given

    5.2.1 Define your communication cadence for your strategy updates

    30 minutes

    Remember the role of different artifacts when it comes to your strategy. The canvas contributes to the What, and the roadmap addresses the How. Any updates to the strategy are articulated and communicated through your roadmap.

    1. Review your currently defined roadmaps, their communication objectives, update frequency, and updates.
    2. Consider the impacted stakeholders and the strategies required to communicate with them.
    3. Fill in your communication cadence and communication method.

    EXAMPLE:

    Roadmap Name

    Audience/Stakeholders

    Communication Cadence

    External Customer Roadmap

    Customers and External Users

    Quarterly (Website)

    Product Delivery Roadmap

    Development Teams, Infrastructure, Architects

    Monthly (By Email)

    Technology Roadmap

    Development Teams, Infrastructure, Architects

    Biweekly (Website)

    Output

    • Clear communication cadence for your roadmaps

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Digital Product Family Strategy Playbook.

    The “what” behind the communication

    Leaders of successful change spend considerable time developing a powerful change message, i.e. a compelling narrative that articulates the desired end state and makes the change concrete and meaningful to staff.

    The change message should:

    • Explain why the change is needed.
    • Summarize what will stay the same.
    • Highlight what will be left behind.
    • Emphasize what is being changed.
    • Explain how change will be implemented.
    • Address how change will affect various roles in the organization.
    • Discuss the staff’s role in making the change successful.

    Five elements of communicating change

    1. What is the change?
    2. Why are we doing it?
    3. How are we going to go about it?
    4. How long will it take us to do it?
    5. What is the role for each department and individual?

    Source: Cornelius & Associates

    How we engage with the message is just as important as the message itself

    Why are we here?

    Speak to what matters to them

    Sell the improvement

    Show real value

    Discuss potential fears

    Ask for their support

    Be gracious

    5.2.2 (Optional) Define your messaging for each stakeholder

    30 minutes

    It’s one thing to communicate the strategy, it’s another thing to send the right message to your stakeholders. Some of this will depend on the kind of news given, but the majority of this is dependent on the stakeholder and the cadence of communication.

    1. From exercise 5.2.1, take the information on the specific roadmaps, target audience, and communication cadence.
    2. Based on your understanding of the audience’s needs, what would the specific update try to get across?
    3. Pick a specific typical example of a change in strategy that you have gone through. (e.g. Product will be delayed by a quarter; key feature is being substituted for another.)

    EXAMPLE:

    Roadmap Name

    Audience/ Stakeholder

    Communication Cadence

    Messaging

    External Customer Roadmap

    Customers and External Users

    Quarterly (Website)

    Output

    • Messaging plan for each roadmap type

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Digital Product Family Strategy Playbook.

    Step 5.3

    Determine your next steps

    Activities

    5.3.1 How do we get started?

    This step involves the following participants:

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Outcomes of this step

    • Understanding the steps to get started in your transformation

    Make a plan in order to make a plan!

    Consider some of the techniques you can use to validate your strategy.

    Learning Milestones

    Sprint Zero (AKA Project-before-the-project)

    The completion of a set of artifacts dedicated to validating business opportunities and hypotheses.

    Possible areas of focus:

    Align teams on product strategy prior to build

    Market research and analysis

    Dedicated feedback sessions

    Provide information on feature requirements

    The completion of a set of key planning activities, typically the first sprint.

    Possible areas of focus:

    Focus on technical verification to enable product development alignment

    Sign off on architectural questions or concerns

    An image showing the flowchart of continuous delivery of value is shown.

    Go to your backlog and prioritize the elements that need to be answered sooner rather than later.

    Possible areas of focus:

    Regulatory requirements or questions to answer around accessibility, security, privacy.

    Stress testing any new processes against situations that may occur.

    The “Now, Next, Later” roadmap

    Use this when deadlines and delivery dates are not strict. This is best suited for brainstorming a product plan when dependency mapping is not required.

    Now: What are you going to do now?

    Next: What are you going to do very soon?

    Later: What are you going to do in the future?

    An example of a now, next, later roadmap is shown.

    Source: “Tips for Agile product roadmaps & product roadmap examples,” Scrum.org, 2017

    5.3.1 How do we get started?

    30-60 minutes

    1. Identify what the critical steps are for the organization to embrace product-centric delivery.
    2. Group each critical step by how soon you need to address it:
    • Now: Let’s do this ASAP.
    • Next: Sometime very soon, let’s do these things.
    • Later: Much further off in the distance, let’s consider these things.
  • Record the group results in the Deliver Digital Products at Scale Workbook.
  • Record changes for your product and product family in the Digital Product Family Strategy Playbook.
  • An example of a now, next, later roadmap is shown.

    Source: “Tips for Agile product roadmaps & product roadmap examples,” Scrum.org, 2017

    Output

    • Product family transformation critical steps and basic roadmap

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Digital Product Family Strategy Playbook.

    Record the results in the Deliver Digital Products at Scale Workbook.

    Summary of Accomplishment

    Problem Solved

    The journey to become a product-centric organization is not short or easy. Like with any improvement or innovation, teams need to continue to evolve and mature with changes in their operations, teams, tools, and user needs.You’ve taken a big step completing your product family alignment. This provides a backbone for aligning all aspects of your organization to your enterprise goals and strategy while empowering product teams to find solutions closer to the problem. Continue to refine your model and operations to improve value realization and your product delivery pipelines to embrace business agility. Organizations that are most responsive to change will continue to outperform command-and-control leadership.

    If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

    Contact your account representative for more information.

    workshops@infotech.com

    1-888-670-8889

    Research Contributors and Experts

    Photo of Emily Archer.

    Emily Archer

    Lead Business Analyst,

    Enterprise Consulting, authentic digital agency

    Emily Archer is a consultant currently working with Fortune 500 clients to ensure the delivery of successful projects, products, and processes. She helps increase the business value returned for organizations’ investments in designing and implementing enterprise content hubs and content operations, custom web applications, digital marketing, and e-commerce platforms.

    Photo of David Berg

    Founder & CTO

    Strainprint Technologies Inc.

    David Berg is a product commercialization expert that has spent the last 20 years of his career delivering product management and business development services across a broad range of industries. Early in his career, David worked with product management and engineering teams to build core network infrastructure products that secure and power the internet we benefit from today. David’s experience also includes working with clean technologies in the area of clean power generation, agritech, and Internet of Things infrastructure. Over the last five years, David has been focused on his latest venture, Strainprint Technologies, a data and analytics company focused on the medical cannabis industry. Strainprint has built the largest longitudinal medical cannabis dataset in the world with the goal to develop an understanding of treatment behavior, interactions, and chemical drivers to guide future product development.

    Kathy Borneman

    Digital Product Owner, SunTrust Bank

    Kathy Borneman is a senior product owner who helps people enjoy their jobs again by engaging others in end-to-end decision making to deliver software and operational solutions that enhance the client experience and allow people to think and act strategically.

    Photro of Charlie Campbell

    Charlie Campbell

    Product Owner, Merchant e-Solutions

    Charlie Campbell is an experienced problem solver with the ability to quickly dissect situations and recommend immediate actions to achieve resolution, liaise between technical and functional personnel to bridge the technology and communication gap, and work with diverse teams and resources to reach a common goal.

    Photo of Yarrow Diamond

    Yarrow Diamond

    Sr. Director, Business Architecture

    Financial Services

    Yarrow Diamond is an experienced professional with expertise in enterprise strategy development, project portfolio management, and business process reengineering across financial services, healthcare and insurance, hospitality, and real estate environments. She has a master’s in Enterprise Architecture from Penn State University, LSSMBB, PMP, CSM, ITILv3.

    Photo of Cari J. Faanes-Blakey

    Cari J. Faanes-Blakey, CBAP, PMI-PBA

    Enterprise Business Systems Analyst,

    Vertex, Inc.

    Cari J. Faanes-Blakey has a history in software development and implementation as a Business Analyst and Project Manager for financial and taxation software vendors. Active in the International Institute of Business Analysis (IIBA), Cari participated on the writing team for the BA Body of Knowledge 3.0 and the certification exam.

    Photo of Kieran Gobey

    Kieran Gobey

    Senior Consultant Professional Services

    Blueprint Software Systems

    Kieran Gobey is an IT professional with 24 years of experience, focused on business, technology, and systems analysis. He has split his career between external and internal customer-facing roles, and this has resulted in a true understanding of what is required to be a Professional Services Consultant. His problem-solving skills and ability to mentor others have resulted in successful software implementations. Kieran’s specialties include deep system troubleshooting and analysis skills, facilitating communications to bring together participants effectively, mentoring, leadership, and organizational skills.

    Photo of Rupert Kainzbauer

    Rupert Kainzbauer

    VP Product, Digital Wallets

    Paysafe Group

    Rupert Kainzbauer is an experienced senior leader with a passion for defining and delivering products that deliver real customer and commercial benefit. Together with a team of highly experienced and motivated product managers, he has successfully led highly complex, multi-stakeholder payments initiatives, from proposition development and solution design through to market delivery. Their domain experience is in building online payment products in high-risk and emerging markets, remittance, prepaid cards, and mobile applications.

    Photo of Saeed Khan

    Saeed Khan

    Founder,

    Transformation Labs

    Saeed Khan has been working in high tech for 30 years in both Canada and the US and has held a number of leadership roles in Product Management over that time. He speaks regularly at conferences and has been writing publicly about technology product management since 2005. Through Transformation Labs, Saeed helps companies accelerate product success by working with product teams to improve their skills, practices, and processes. He is a cofounder of ProductCamp Toronto and currently runs a Meetup group and global Slack community called Product Leaders; the only global community of senior level product executives.

    Photo of Hoi Kun Lo

    Hoi Kun Lo

    Product Owner

    Nielsen

    Hoi Kun Lo is an experienced change agent who can be found actively participating within the IIBA and WITI groups in Tampa, FL and a champion for Agile, architecture, diversity, and inclusion programs at Nielsen. She is currently a Product Owner in the Digital Strategy team within Nielsen Global Watch Technology.

    Photo of Abhishek Mathur

    Abhishek Mathur

    Sr Director, Product Management

    Kasisto, Inc.

    Abhishek Mathur is a product management leader, an artificial intelligence practitioner, and an educator. He has led product management and engineering teams at Clarifai, IBM, and Kasisto to build a variety of artificial intelligence applications within the space of computer vision, natural language processing, and recommendation systems. Abhishek enjoys having deep conversations about the future of technology and helping aspiring product managers enter and accelerate their careers.

    Photo of Jeff Meister

    Jeff Meister

    Technology Advisor and Product Leader

    Jeff Meister is a technology advisor and product leader. He has more than 20 years of experience building and operating software products and the teams that build them. He has built products across a wide range of industries and has built and led large engineering, design, and product organizations. Jeff most recently served as Senior Director of Product Management at Avanade, where he built and led the product management practice. This involved hiring and leading product managers, defining product management processes, solution shaping and engagement execution, and evangelizing the discipline through pitches, presentations, and speaking engagements. Jeff holds a Bachelor’s of Applied Science (Electrical Engineering) and a Bachelor’s of Arts from the University of Waterloo, an MBA from INSEAD (Strategy), and certifications in product management, project management, and design thinking.

    Photo of Vincent Mirabelli

    Vincent Mirabelli

    Principal,

    Global Project Synergy Group

    With over 10 years of experience in both the private and public sectors, Vincent Mirabelli possesses an impressive track record of improving, informing, and transforming business strategy and operations through process improvement, design and re-engineering, and the application of quality to business analysis, project management, and process improvement standards.

    Photo of Oz Nazili

    Oz Nazili

    VP, Product & Growth

    TWG

    Oz Nazili is a product leader with a decade of experience in both building products and product teams. Having spent time at funded startups and large enterprises, he thinks often about the most effective way to deliver value to users. His core areas of interest include Lean MVP development and data-driven product growth.

    Photo of Mark Pearson

    Mark Pearson

    Principal IT Architect, First Data Corporation

    Mark Pearson is an executive business leader grounded in the process, data, technology, and operations of software-driven business. He knows the enterprise software landscape and is skilled in product, technology, and operations design and delivery within information technology organizations, outsourcing firms, and software product companies.

    Photo of Brenda Peshak

    Brenda Peshak

    Product Owner,

    Widget Industries, LLC

    Brenda Peshak is skilled in business process, analytical skills, Microsoft Office Suite, communication, and customer relationship management (CRM). She is a strong product management professional with a Master’s focused in Business Leadership (MBL) from William Penn University.

    Photo of Mike Starkey

    Mike Starkey

    Director of Engineering

    W.W. Grainger

    Mike Starkey is a Director of Engineering at W.W. Grainger, currently focusing on operating model development, digital architecture, and building enterprise software. Prior to joining W.W. Grainger, Mike held a variety of technology consulting roles throughout the system delivery lifecycle spanning multiple industries such as healthcare, retail, manufacturing, and utilities with Fortune 500 companies.

    Photo of Anant Tailor

    Anant Tailor

    Cofounder & Head of Product

    Dream Payments Corp.

    Anant Tailor is a cofounder at Dream Payments where he currently serves as the COO and Head of Product, having responsibility for Product Strategy & Development, Client Delivery, Compliance, and Operations. He has 20+ years of experience building and operating organizations that deliver software products and solutions for consumers and businesses of varying sizes. Prior to founding Dream Payments, Anant was the COO and Director of Client Services at DonRiver Inc, a technology strategy and software consultancy that he helped to build and scale into a global company with 100+ employees operating in seven countries. Anant is a Professional Engineer with a Bachelor’s degree in Electrical Engineering from McMaster University and a certificate in Product Strategy & Management from the Kellogg School of Management at Northwestern University.

    Photo of Angela Weller

    Angela Weller

    Scrum Master, Businessolver

    Angela Weller is an experienced Agile business analyst who collaborates with key stakeholders to attain their goals and contributes to the achievement of the company’s strategic objectives to ensure a competitive advantage. She excels when mediating or facilitating teams.

    Related Info-Tech Research

    Product Delivery

    Deliver on Your Digital Product Vision

    • Build a product vision your organization can take from strategy through execution.

    Build a Better Product Owner

    • Strengthen the product owner role in your organization by focusing on core capabilities and proper alignment.

    Build Your Agile Acceleration Roadmap

    • Quickly assess the state of your Agile readiness and plan your path forward to higher value realization.

    Implement Agile Practices That Work

    • Improve collaboration and transparency with the business to minimize project failure.

    Implement DevOps Practices That Work

    • Streamline business value delivery through the strategic adoption of DevOps practices.

    Extend Agile Practices Beyond IT

    • Further the benefits of Agile by extending a scaled Agile framework to the business.

    Build Your BizDevOps Playbook

    • Embrace a team sport culture built around continuous business-IT collaboration to deliver great products.

    Embed Security Into the DevOps Pipeline

    • Shift security left to get into DevSecOps.

    Spread Best Practices With an Agile Center of Excellence

    • Facilitate ongoing alignment between Agile teams and the business with a set of targeted service offerings.

    Enable Organization-Wide Collaboration by Scaling Agile

    • Execute a disciplined approach to rolling out Agile methods in the organization.

    Application Portfolio Management

    APM Research Center

    • See an overview of the APM journey and how we can support the pieces in this journey.

    Application Portfolio Management for Small Enterprises

    • There is no one-size-fits-all rationalization. Tailor your framework to meet your goals.

    Streamline Application Maintenance

    • Effective maintenance ensures the long-term value of your applications.

    Build an Application Rationalization Framework

    • Manage your application portfolio to minimize risk and maximize value.

    Modernize Your Applications

    • Justify modernizing your application portfolio from both business and technical perspectives.

    Review Your Application Strategy

    • Ensure your applications enable your business strategy.

    Discover Your Applications

    • Most application strategies fail. Arm yourself with the necessary information and team structure for a successful application portfolio strategy.

    Streamline Application Management

    • Move beyond maintenance to ensuring exceptional value from your apps.

    Optimize Applications Release Management

    • Facilitate ongoing alignment between Agile teams and the business with a set of targeted service offerings.

    Embrace Business-Managed Applications

    • Empower the business to implement their own applications with a trusted business-IT relationship.

    Value, Delivery Metrics, Estimation

    Build a Value Measurement Framework

    • Focus product delivery on business value–driven outcomes.

    Select and Use SDLC Metrics Effectively

    • Be careful what you ask for, because you will probably get it.

    Application Portfolio Assessment: End User Feedback

    • Develop data-driven insights to help you decide which applications to retire, upgrade, re-train on, or maintain to meet the demands of the business.

    Create a Holistic IT Dashboard

    • Mature your IT department by measuring what matters.

    Refine Your Estimation Practices With Top-Down Allocations

    • Don’t let bad estimates ruin good work.

    Estimate Software Delivery With Confidence

    • Commit to achievable software releases by grounding realistic expectations.

    Reduce Time to Consensus With an Accelerated Business Case

    • Expand on the financial model to give your initiative momentum.

    Optimize Project Intake, Approval, and Prioritization

    • Deliver more projects by giving yourself the voice to say “no” or “not yet” to new projects.

    Enhance PPM Dashboards and Reports

    • Facilitate ongoing alignment between Agile teams and the business with a set of targeted service offerings.

    Org Design and Performance

    Redesign Your IT Organizational Structure

    • Focus product delivery on business value–driven outcomes.

    Build a Strategic Workforce Plan

    • Have the right people, in the right place, at the right time.

    Implement a New Organizational Structure

    • Reorganizations are inherently disruptive. Implement your new structure with minimal pain for staff while maintaining IT performance throughout the change.

    Improve Employee Engagement to Drive IT Performance

    • Don’t just measure engagement, act on it.

    Set Meaningful Employee Performance Measures

    • Set holistic measures to inspire employee performance.

    Master Organizational Change Management Practices

    • PMOs, if you don't know who is responsible for org change, it's you.

    Bibliography (Product Management)

    “12th Annual State of Agile Report.” VersionOne, 9 April 2018. Web.

    A, Karen. “20 Mental Models for Product Managers.” Product Management Insider, Medium, 2 Aug. 2018. Web.

    Adams, Paul. “Product Teams: How to Build & Structure Product Teams for Growth.” Inside Intercom, 30 Oct. 2019. Web.

    Agile Alliance. “Product Owner.” Agile Alliance. n.d. Web.

    Ambysoft. “2018 IT Project Success Rates Survey Results.” Ambysoft. 2018. Web.

    Banfield, Richard, et al. “On-Demand Webinar: Strategies for Scaling Your (Growing) Enterprise Product Team.” Pluralsight, 31 Jan. 2018. Web.

    Berez, Steve, et al. “How to Plan and budget for Agile at Scale.” Bain & Company, 08 Oct 2019. Web

    Blueprint. “10 Ways Requirements Can Sabotage Your Projects Right From the Start.” Blueprint. 2012. Web.

    Breddels, Dajo, and Paul Kuijten. “Product Owner Value Game.” Agile2015 Conference, Agile Alliance 2015. Web.

    Cagan, Martin. “Behind Every Great Product.” Silicon Valley Product Group. 2005. Web.

    Cohn, Mike. “What Is a Product?” Mountain Goat Software. 6 Sept. 2016. Web.

    Connellan, Thomas K. Inside the Magic Kingdom, Bard Press, 1997.

    Curphey, Mark. “Product Definition.” SlideShare, 25 Feb. 2007. Web.

    “Delegation Poker Product Image.” Management 3.0, n.d. Web.

    Distel, Dominic, et al. “Finding the sweet spot in product-portfolio management.’ McKinsey, 4 Dec. 2020. Web

    Eringa, Ron. “Evolution of the Product Owner.” RonEringa.com, 12 June 2016. Web.

    Fernandes, Thaisa. “Spotify Squad Framework - Part I.” PM101, Medium, 6 Mar. 2017. Web.

    Galen, Robert. “Measuring Product Ownership – What Does ‘Good’ Look Like?” RGalen Consulting, 5 Aug. 2015. Web.

    Halisky, Merland, and Luke Lackrone. “The Product Owner’s Universe.” Agile2016 Conference, Agile Alliance, 2016. Web.

    Kamer, Jurriaan. “How to Build Your Own ‘Spotify Model’.” The Ready, Medium, 9 Feb. 2018. Web.

    Kendis Team. “Exploring Key Elements of Spotify’s Agile Scaling Model.” Scaled Agile Framework, Medium, 23 Jul. 2018. Web.

    Lindstrom, Lowell. “7 Skills You Need to Be a Great Product Owner.” Scrum Alliance, n.d. Web.

    Lukassen, Chris. “The Five Belts Of The Product Owner.” Xebia.com, 20 Sept. 2016. Web.

    McCloskey, Heather. “Scaling Product Management: Secrets to Defeating Common Challenges.” ProductPlan, 12 July 2019. Web.

    McCloskey, Heather. “When and How to Scale Your Product Team.” UserVoice, 21 Feb. 2017. Web.

    Mironov, Rich. “Scaling Up Product Manager/Owner Teams.” Rich Mironov's Product Bytes, Mironov Consulting, 12 Apr. 2014 . Web.

    Overeem, Barry. “A Product Owner Self-Assessment.” Barry Overeem, 6 Mar. 2017. Web.

    Overeem, Barry. “Retrospective: Using the Team Radar.” Barry Overeem, 27 Feb. 2017. Web.

    Pichler, Roman. “How to Scale the Scrum Product Owner.” Roman Pichler, 28 June 2016 . Web.

    Pichler, Roman. “Product Management Framework.” Pichler Consulting Limited, 2014. Web.

    Pichler, Roman. “Sprint Planning Tips for Product Owners.” LinkedIn, 4 Sept. 2018. Web.

    Pichler, Roman. “What Is Product Management?” Pichler Consulting Limited, 26 Nov. 2014. Web.

    Radigan, Dan. “Putting the ‘Flow' Back in Workflow With WIP Limits.” Atlassian, n.d. Web.

    Rouse, Margaret. “Definition: product.” TechTarget, Sept. 2005. Web.

    Schuurman, Robbin. “10 Tips for Product Owners on (Business) Value.” Scrum.org, 30 Nov. 2017. Web.

    Schuurman, Robbin. “10 Tips for Product Owners on Agile Product Management.” Scrum.org, 28 Nov. 2017. Web.

    Schuurman, Robbin. “10 Tips for Product Owners on Product Backlog Management.” Scrum.org, 5 Dec. 2017. Web.

    Schuurman, Robbin. “10 Tips for Product Owners on the Product Vision.” Scrum.org, 29 Nov. 2017. Web.

    Schuurman, Robbin. “Tips for Starting Product Owners.” Scrum.org, 27 Nov. 2017. Web.

    Sharma, Rohit. “Scaling Product Teams the Structured Way.” Monetary Musings, 28 Nov. 2016. Web.

    Shirazi, Reza. “Betsy Stockdale of Seilevel: Product Managers Are Not Afraid To Be Wrong.” Austin Voice of Product, 2 Oct. 2018. Web.

    Steiner, Anne. “Start to Scale Your Product Management: Multiple Teams Working on Single Product.” Cprime, 6 Aug. 2019. Web.

    “The Qualities of Leadership: Leading Change.” Cornelius & Associates, 2016. Web.

    “The Standish Group 2015 Chaos Report.” The Standish Group. 2015. Web.

    Theus, Andre. “When Should You Scale the Product Management Team?” ProductPlan, 7 May 2019. Web.

    Tolonen, Arto. “Scaling Product Management in a Single Product Company.” Smartly.io, 26 Apr. 2018. Web.

    Ulrich, Catherine. “The 6 Types of Product Managers. Which One Do You Need?” Medium, 19 Dec. 2017. Web.

    Verwijs, Christiaan. “Retrospective: Do The Team Radar.” The Liberators, Medium, 10 Feb. 2017. Web.

    Vlaanderen, Kevin. “Towards Agile Product and Portfolio Management”. Academia.edu. 2010. Web.

    Bibliography (Roadmap)

    Bastow, Janna. “Creating Agile Product roadmaps Everyone Understands.” ProdPad, 22 Mar. 2017. Accessed Sept. 2018.

    Bastow, Janna. “The Product Tree Game: Our Favorite Way To Prioritize Features.” ProdPad, 21 Feb. 2016. Accessed Sept. 2018.

    Chernak, Yuri. “Requirements Reuse: The State of the Practice.” 2012 IEEE International Conference, 12 June 2012, Herzliya, Israel. Web.

    Fowler, Martin. “Application Boundary.” MartinFowler.com, 11 Sept. 2003. Accessed 20 Nov. 2017.

    Harrin, Elizabeth. “Learn What a Project Milestone Is.” The Balance Careers, 10 May 2018. Accessed Sept. 2018.

    “How to create a product roadmap.” Roadmunk, n.d. Accessed Sept. 2018.

    Johnson, Steve. “How to Master the 3 Horizons of Product Strategy.” Aha!, 24 Sept. 2015. Accessed Sept. 2018.

    Johnson, Steve. “The Product Roadmap vs. the Technology Roadmap.” Aha!, 23 June 2016. Accessed Sept. 2018

    Juncal, Shaun. “How Should You Set Your Product Roadmap Timeframes?” ProductPlan, Web. Sept. 2018.

    Leffingwell, Dean. “SAFe 4.0.” Scaled Agile, 2017. Web.

    Maurya, Ash. “What is a Minimum Viable Product (MVP).” Leanstack, 12 June 2017. Accessed Sept. 2018.

    Pichler, Roman. “10 Tips for Creating an Agile Product Roadmap.” Roman Pichler, 20 July 2016. Accessed Sept. 2018.

    Pichler, Roman. Strategize: Product Strategy and Product Roadmap Practices for the Digital Age. Pichler Consulting, 2016.

    “Product Roadmap Contents: What Should You Include?” ProductPlan, n.d. Accessed 20 Nov. 2017.

    Saez, Andrea. “Why Your Roadmap Is Not a Release Plan.” ProdPad, 23 October 2015. Accessed Sept. 2018.

    Schuurman, Robbin. “Tips for Agile product roadmaps & product roadmap examples.” Scrum.org, 7 Dec. 2017. Accessed Sept. 2018.

    Bibliography (Vision and Canvas)

    Adams, Paul. “The Future Product Canvas.” Inside Intercom, 10 Jan. 2014. Web.

    “Aligning IT Funding Models to the Pace of Technology Change.” EDUCAUSE, 14 Dec. 2015. Web.

    Altman, Igor. “Metrics: Gone Bad.” OpenView, 10 Nov. 2009. Web.

    Barry, Richard. “The Product Vision Canvas – a Strategic Tool in Developing a Successful Business.” Polymorph, 2019. Web.

    “Business Canvas – Business Models & Value Propositions.” Strategyzer, 2019. Web.

    “Business Model Canvas.” Wikipedia: The Free Encyclopedia, 4 Aug. 2019. Web.

    Charak, Dinker. “Idea to Product: The Working Model.” ThoughtWorks, 13 July 2017. Web.

    Charak, Dinker. “Product Management Canvas - Product in a Snapshot.” Dinker Charak, 29 May 2017. Web.

    Chudley, James. “Practical Steps in Determining Your Product Vision (Product Tank Bristol, Oct. 2018).” LinkedIn SlideShare. Uploaded by cxpartners, 2 Nov. 2018. Web.

    Cowan, Alex. “The 20 Minute Business Plan: Business Model Canvas Made Easy.” COWAN+, 2019. Web.

    Craig, Desiree. “So You've Decided To Become A Product Manager.” Start it up, Medium, 2 June 2019. Web.

    Create an Aha! Business Model Canvas Strategic Model.” Aha! Support, 2019. Web.

    Eick, Stephen. “Does Code Decay? Assessing the Evidence from Change Management Data.” IEEE Transactions on Software Engineering, vol. 27, no. 1, Jan. 2001, pp. 1-12. Web.

    Eriksson, Martin. “The next Product Canvas.” Mind the Product, 22 Nov. 2013. Web.

    “Experience Canvas: a Lean Approach: Atlassian Team Playbook.” Atlassian, 2019. Web.

    Freeman, James. “How to Make a Product Canvas – Visualize Your Product Plan.” Edraw, 23 Dec. 2019. Web.

    Fuchs, Danny. “Measure What Matters: 5 Best Practices from Performance Management Leaders.” OpenGov, 8 Aug. 2018. Web.

    Gorisse, Willem. “A Practical Guide to the Product Canvas.” Mendix, 28 Mar. 2017. Web.

    Gothelf, Jeff. “The Lean UX Canvas.” Jeff Gothelf, 15 Dec. 2016. Web.

    Gottesdiener, Ellen. “Using the Product Canvas to Define Your Product: Getting Started.” EBG Consulting, 15 Jan. 2019. Web.

    Gottesdiener, Ellen. “Using the Product Canvas to Define Your Product's Core Requirements.” EBG Consulting, 4 Feb. 2019. Web.

    Gray, Mark Krishan. “Should I Use the Business Model Canvas or the Lean Canvas?” Emergn, 2019. Web.

    Hanby, Jeff. "Software Maintenance: Understanding and Estimating Costs." LookFar, 21 Oct. 2016. Web.

    “How do you define a product?” Scrum.org, 4 Apr 2017, Web

    Juncal, Shaun. “How to Build a Product Roadmap Based on a Business Model Canvas.” ProductPlan, 19 June 2019. Web.

    “Lean Canvas Intro - Uber Example.” YouTube, uploaded by Railsware Product Academy, 12 Oct. 2018. Web.

    “Lesson 6: Product Canvas.” ProdPad Help Center, 2019. Web.

    Lucero, Mario. “The Product Canvas.” Agilelucero.com, 22 June 2015. Web.

    Maurya, Ash. “Create a New Lean Canvas.” Canvanizer, 2019. Web.

    Maurya, Ash. “Don't Write a Business Plan. Create a Lean Canvas Instead.” LEANSTACK, 2019. Web.

    Maurya, Ash. “Why Lean Canvas vs Business Model Canvas?” Medium, 27 Feb. 2012. Web.

    Mirabelli, Vincent. “The Project Value Canvas.” Vincent Mirabelli, 2019. Web.

    Mishra, LN. “Business Analysis Canvas – The Ultimate Enterprise Architecture.” BA Times, 19 June 2019. Web.

    Muller. Jerry Z. “Why performance metrics isn’t always the best way to judge performance.” Fast Company, 3 April 2019. Web.

    Perri, Melissa. “What Is Good Product Strategy?” Melissa Perri, 14 July 2016. Web.

    Pichler, Roman. “A Product Canvas for Agile Product Management, Lean UX, Lean Startup.” Roman Pichler, 16 July 2012. Web.

    Pichler, Roman. “Introducing the Product Canvas.” JAXenter, 15 Jan. 2013. Web.

    Pichler, Roman. “Roman's Product Canvas: Introduction.” YouTube, uploaded by Roman Pichler, 3 Mar. 2017. Web.

    Pichler, Roman. “The Agile Vision Board: Vision and Product Strategy.” Roman Pichler, 10 May 2011. Web.

    Pichler, Roman. “The Product Canvas – Template.” Roman Pichler, 11 Oct. 2016. Web.

    Pichler, Roman. “The Product Canvas Tutorial V1.0.” LinkedIn SlideShare. Uploaded by Roman Pichler, 14 Feb. 2013. Web.

    Pichler, Roman. “The Product Vision Board: Introduction.” YouTube uploaded by Roman Pichler, 3 Mar. 2017. Web.

    “Product Canvas PowerPoint Template.” SlideModel, 2019. Web.

    Product Canvas.” SketchBubble, 2019, Web.

    “Product Canvas.” YouTube, uploaded by Wojciech Szramowski, 18 May 2016. Web.

    “Product Roadmap Software to Help You Plan, Visualize, and Share Your Product Roadmap.” Productboard, 2019. Web.

    Roggero, Giulio. “Product Canvas Step-by-Step.” LinkedIn SlideShare, uploaded by Giulio Roggero, 18 May 2013. Web.

    Royce, Dr. Winston W. “Managing the Development of Large Software Systems.” Scf.usc.edu, 1970. Web.

    Ryan, Dustin. “The Product Canvas.” Qdivision, Medium, 20 June 2017. Web.

    Snow, Darryl. “Product Vision Board.” Medium, 6 May 2017. Web.

    Stanislav, Shymansky. “Lean Canvas – a Tool Your Startup Needs Instead of a Business Plan.” Railsware, 12 Oct. 2018. Web.

    Stanislav, Shymansky. “Lean Canvas Examples of Multi-Billion Startups.” Railsware, 20 Feb. 2019. Web.

    “The Product Vision Canvas.” YouTube, Uploaded by Tom Miskin, 20 May 2019. Web.

    Tranter, Leon. “Agile Metrics: the Ultimate Guide.” Extreme Uncertainty, n.d. Web.

    “Using Business Model Canvas to Launch a Technology Startup or Improve Established Operating Model.” AltexSoft, 27 July 2018. Web.

    Veyrat, Pierre. “Lean Business Model Canvas: Examples + 3 Pillars + MVP + Agile.” HEFLO BPM, 10 Mar. 2017. Web.

    “What Are Software Metrics and How Can You Track Them?” Stackify, 16 Sept. 2017. Web

    “What Is a Product Vision?” Aha!, 2019. Web.

    Cybersecurity Priorities in Times of Pandemic

    • Buy Link or Shortcode: {j2store}381|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Security Processes & Operations
    • Parent Category Link: /security-processes-and-operations
    • Novel coronavirus 2019 (COVID-19) has thrown organizations around the globe into chaos as they attempt to continue operations while keeping employees safe.
    • IT needs to support business continuity – juggling available capacity and ensuring that services are available to end users – without clarity of duration, amid conditions that change daily, on a scale never seen before.
    • Security has never been more important than now. But…where to start? What are the top priorities? How do we support remote work while remaining secure?

    Our Advice

    Critical Insight

    • There is intense pressure to enable employees to work remotely, as soon as possible. IT is scrambling to enable access, source equipment to stage, and deploy products to employees, many of whom are unfamiliar with working from home.
    • There is either too much security to allow people to be productive or too little security to ensure that the organization remains protected and secure.
    • These events are unprecedented, and no plan currently exists to sufficiently maintain a viable security posture during this interim new normal.

    Impact and Result

    • Don’t start from scratch. Leverage your current security framework, processes, and mechanisms but tailor them to accommodate the new way of remote working.
    • Address priority security items related to remote work capability and its implications in a logical sequence. Some security components may not be as time sensitive as others.
    • Remain diligent! Circumstances may have changed, but the importance of security has not. In fact, IT security is likely more important now than ever before.

    Cybersecurity Priorities in Times of Pandemic Research & Tools

    Start here – read our Cybersecurity Priorities research.

    Our recommendations and the accompanying checklist tool will help you quickly get a handle on supporting a remote workforce while maintaining security in your organization.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Cybersecurity Priorities in Times of Pandemic Storyboard
    • Cybersecurity Priorities Checklist Tool
    [infographic]

    Run Better Meetings

    • Buy Link or Shortcode: {j2store}287|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Voice & Video Management
    • Parent Category Link: /voice-video-management

    Your newly hybrid workplace will include virtual, hybrid, and physical meetings, presenting several challenges:

    • The experience for onsite and remote attendees is not equal.
    • Employees are experiencing meeting and video fatigue.
    • Meeting rooms are not optimized for hybrid meetings.
    • The fact is that many people have not successfully run hybrid meetings before.

    Our Advice

    Critical Insight

    • Successful hybrid workplace plans must include planning around hybrid meetings. Seamless hybrid meetings are the result of thoughtful planning and documented best practices.

    Impact and Result

    • Identify your current state and the root cause of unsatisfactory meetings.
    • Review and identify meetings best practices around meeting roles, delivery models, and training.
    • Improve the technology that supports meetings.
    • Use Info-Tech’s quick checklists and decision flowchart to accelerate meeting planning and cover your bases.

    Run Better Meetings Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should run better meetings, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Identify the current state of meetings

    Understand the problem before you try to fix it. Before you can improve meetings, you need to understand what your norms and challenges currently are.

    • Checklist: Run a Virtual or Hybrid Meeting

    2. Publish best practices for how meetings should run

    Document meeting roles, expectations, and how meetings should run. Decide what kind of meeting delivery model to use and develop a training program.

    • Meeting Challenges and Best Practices
    • Meeting Type Decision Flowchart (Visio)
    • Meeting Type Decision Flowchart (PDF)

    3. Improve meeting technology

    Always be consulting with users: early in the process to set a benchmark, during and after every meeting to address immediate concerns, and quarterly to identify trends and deeper issues.

    • Team Charter
    • Communications Guide Poster Template
    [infographic]

    Workshop: Run Better Meetings

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Identify Current State of Meetings

    The Purpose

    Understand the current state of meetings in your organization.

    Key Benefits Achieved

    What you need to keep doing and what you need to change

    Activities

    1.1 Brainstorm meeting types.

    1.2 Document meeting norms.

    1.3 Document and categorize meeting challenges.

    Outputs

    Documented challenges with meetings

    Meeting norms

    Desired changes to meeting norms

    2 Review and Identify Best Practices

    The Purpose

    Review and implement meeting best practices.

    Key Benefits Achieved

    Defined meeting best practices for your organization

    Activities

    2.1 Document meeting roles and expectations.

    2.2 Review common meeting challenges and identify best practices.

    2.3 Document when to use a hybrid meeting, virtual meeting, or an in-person meeting.

    2.4 Develop a training program.

    Outputs

    Meeting roles and expectations

    List of meeting best practices

    Guidelines to help workers choose between a hybrid, virtual, or in-person meeting

    Training plan for meetings

    3 Improve Meeting Technology

    The Purpose

    Identify opportunities to improve meeting technology.

    Key Benefits Achieved

    A strategy for improving the underlying technologies and meeting spaces

    Activities

    3.1 Empower virtual meeting attendees.

    3.2 Optimize spaces for hybrid meetings.

    3.3 Build a team of meeting champions.

    3.4 Iterate to build and improve meeting technology.

    3.5 Guide users toward each technology.

    Outputs

    Desired improvements to meeting rooms and meeting technology

    Charter for the team of meeting champions

    Communications Guide Poster

    Strengthen the SSDLC for Enterprise Mobile Applications

    • Buy Link or Shortcode: {j2store}283|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Mobile Development
    • Parent Category Link: /mobile-development
    • CEOs see mobile for employees as their top mandate for upcoming technology innovation initiatives, making security a key competency for development.
    • Unsecure mobile applications can cause your employees to question the mobile applications’ integrity for handling sensitive data, limiting uptake.
    • Secure mobile development tends to be an afterthought, where vulnerabilities are tested for post-production rather than during the build process.
    • Developers lack the expertise, processes, and proper tools to effectively enhance applications for mobile security.

    Our Advice

    Critical Insight

    • Organizations currently react to security issues. Info-Tech recommends a proactive approach to ensure a secure software development life cycle (SSDLC) end-to-end.
    • Organizations currently lack the secure development practices to provide highly secure mobile applications that end users can trust.
    • Enable your developers with five key secure development techniques from Info-Tech’s development toolkit.

    Impact and Result

    • Embed secure development techniques into your SDLC.
    • Create a repeatable process for your developers to continually evaluate and optimize mobile application security for new threats and corresponding mitigation steps.
    • Build capabilities within your team based on Info-Tech’s framework by supporting ongoing security improvements through monitoring and metric analysis.

    Strengthen the SSDLC for Enterprise Mobile Applications Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should adopt secure development techniques for mobile application development, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Assess secure mobile development processes

    Determine the current security landscape of mobile application development.

    • Strengthen the SSDLC for Enterprise Mobile Applications – Phase 1: Assess Secure Mobile Development Practices
    • Systems Architecture Template
    • Mobile Application High-Level Design Requirements Template

    2. Implement and test secure mobile techniques

    Incorporate the various secure development techniques into current development practices.

    • Strengthen the SSDLC for Enterprise Mobile Applications – Phase 2: Implement and Test Secure Mobile Techniques

    3. Monitor and support secure mobile applications

    Create a roadmap for mobile optimization initiatives.

    • Strengthen the SSDLC for Enterprise Mobile Applications – Phase 3: Monitor and Support Secure Mobile Applications
    • Mobile Optimization Roadmap
    [infographic]

    Workshop: Strengthen the SSDLC for Enterprise Mobile Applications

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Assess Your Secure Mobile Development Practices

    The Purpose

    Identification of the triggers of your secure mobile development initiatives.

    Assessment of the security vulnerabilities in your mobile applications from an end-user perspective.

    Identification of the execution of your mobile environment.

    Assessment of the mobile threats and vulnerabilities to your systems architecture.

    Prioritization of your mobile threats.

    Creation of your risk register.

    Key Benefits Achieved

    Key opportunity areas where a secure development optimization initiative can provide tangible benefits.

    Identification of security requirements.

    Prioritized list of security threats.

    Initial mobile security risk register created. 

    Activities

    1.1 Establish the triggers of your secure mobile development initiatives.

    1.2 Assess the security vulnerabilities in your mobile applications from an end-user perspective.

    1.3 Understand the execution of your mobile environment with a systems architecture.

    1.4 Assess the mobile threats and vulnerabilities to your systems architecture.

    1.5 Prioritize your mobile threats.

    1.6 Begin building your risk register.

    Outputs

    Mobile Application High-Level Design Requirements Document

    Systems Architecture Diagram

    2 Implement and Test Your Secure Mobile Techniques

    The Purpose

    Discovery of secure development techniques to apply to current development practices.

    Discovery of new user stories from applying secure development techniques.

    Discovery of new test cases from applying secure development techniques.

    Key Benefits Achieved

    Areas within your code that can be optimized for improving mobile application security.

    New user stories created in relation to mitigation steps.

    New test cases created in relation to mitigation steps.

    Activities

    2.1 Gauge the state of your secure mobile development practices.

    2.2 Identify the appropriate techniques to fill gaps.

    2.3 Develop user stories from security development gaps identified.

    2.4 Develop test cases from user story gaps identified.

    Outputs

    Mobile Application High-Level Design Requirements Document

    3 Monitor and Support Your Secure Mobile Applications

    The Purpose

    Identification of key metrics used to measure mobile application security issues.

    Identification of secure mobile application and development process optimization initiatives.

    Identification of enablers and blockers of your mobile security optimization.

    Key Benefits Achieved

    Metrics for measuring application security.

    Modified triaging process for addressing security issues.

    Initiatives for development optimization.

    Enablers and blockers identified for mobile security optimization initiatives.

    Process for developing your mobile optimization roadmap.

    Activities

    3.1 List the metrics that would be gathered to assess the success of your mobile security optimization.

    3.2 Adjust and modify your triaging process to enhance handling of security issues.

    3.3 Brainstorm secure mobile application and development process optimization initiatives.

    3.4 Identify the enablers and blockers of your mobile security optimization.

    3.5 Define your mobile security optimization roadmap.

    Outputs

    Mobile Optimization Roadmap

    Evolve Your Business Through Innovation

    • Buy Link or Shortcode: {j2store}330|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Innovation
    • Parent Category Link: /innovation
    • Innovation teams are tasked with the responsibility of ensuring that their organizations are in the best position to succeed while the world is in a period of turmoil, chaos, and uncertainty.
    • CIOs have been expected to help the organization transition to remote work and collaboration instantaneously.
    • CEOs are under pressure to redesign, and in some cases reinvent, their business model to cope with and compete in a new normal.

    Our Advice

    Critical Insight

    It is easy to get swept up during a crisis and cling to past notions of normal. Unfortunately, there is no controlling the fact that things have changed fundamentally, and it is now incumbent upon you to help your organization adapt and evolve. Treat this as an opportunity because that is precisely what this is.

    Impact and Result

    There are some lessons we can learn from innovators who have succeeded through past crises and from those who are succeeding now.

    There are a number of tactics an innovation team can employ to help their business evolve during this time:

    1. Double down on digital transformation (DX)
    2. Establish a foresight capability
    3. Become a platform for good

    Evolve Your Business Through Innovation Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Evolve your business through innovation

    Download our guide to learn what you can do to evolve your business and innovate your way through uncertainty.

    • Evolve Your Business Through Innovation Storyboard
    [infographic]

    Create a Post-Implementation Plan for Microsoft 365

    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: End-User Computing Applications
    • Parent Category Link: /end-user-computing-applications

    M365 projects are fraught with obstacles. Common mistakes organizations make include:

    • Not having a post-migration plan in place.
    • Treating user training as an afterthought.
    • Inadequate communication to end users.

    Our Advice

    Critical Insight

    There are three primary areas where organizations fail in a successful implementation of M365: training, adoption, and information governance. While it is not up to IT to ensure every user is well trained, it is their initial responsibility to find champions, SMEs, and business-based trainers and manage information governance from the backup, retention, and security aspects of data management.

    Impact and Result

    Migrating to M365 is a disruptive move for most organizations. It poses risk to untrained IT staff, including admins, help desk, and security teams. The aim for organizations, especially in this new hybrid workspace, is to maintain efficiencies through collaboration, share information in a secure environment, and work from anywhere, any time.

    Create a Post-Implementation Plan for Microsoft 365 Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Create a Post-Implementation Plan for Microsoft 365 Storyboard – A deck that guides you through the important considerations that will help you avoid common pitfalls and make the most of your investment.

    There are three primary goals when deploying Microsoft 365: productivity, security and compliance, and collaborative functionality. On top of these you need to meet the business KPIs and IT’s drive for adoption and usage. This research will guide you through the important considerations that are often overlooked as this powerful suite of tools is rolled out to the organization.

    [infographic]

    Further reading

    Create a Post-Implementation Plan for Microsoft 365

    You’ve deployed M365. Now what? Look at your business goals and match your M365 KPIs to meet those objectives.

    Analyst perspective

    You’ve deployed M365. Now what?

    John Donovan

    There are three primary objectives when deploying Microsoft 365: from a business perspective, the expectations are based on productivity; from an IT perspective, the expectations are based on IT efficiencies, security, and compliance; and from an organizational perspective, they are based on a digital employee experience and collaborative functionality.

    Of course, all these expectations are based on one primary objective, and that is user adoption of Teams, OneDrive, and SharePoint Online. A mass adoption, along with a high usage rate and a change in the way users work, is required for your investment in M365 to be considered successful.

    So, adoption is your first step, and that can be tracked and analyzed through analytics in M365 or other tools. But what else needs to be considered once you have released M365 on your organization? What about backup? What about security? What about sharing data outside your business? What about self-service? What about ongoing training? M365 is a powerful suite of tools, and taking advantage of all that it entails should be IT’s primary goal. How to accomplish that, efficiently and securely, is up to you!

    John Donovan
    Principal Research Director, I&O
    Info-Tech Research Group

    Insight summary

    Collaboration, efficiencies, and cost savings need to be earned

    Migrating to M365 is a disruptive move for most organizations. Additionally, it poses risk to untrained IT staff, including admins, help desk, and security teams. The aim for organizations, especially in this new hybrid workspace, is to maintain efficiencies through collaboration, share information in a secure environment, and work from anywhere, any time. However, organizations need to manage their licensing and storage costs and build this new way of working through post-deployment planning. By reducing their hardware and software footprint they can ensure they have earned these savings and efficiencies.

    Understand any shortcomings in M365 or pay the price

    Failing to understand any shortcomings M365 poses for your organization can ruin your chances at a successful implementation. Commonly overlooked expenses include backup and archiving, especially for regulated organizations; spending on risk mitigation through third-party tools for security; and paying a premium to Microsoft to use its Azure offerings with Microsoft Sentinel, Microsoft Defender, or any security add-on that comes at a price above your E5 license, which is expensive in itself.

    Spend time with users to understand how they will use M365

    Understanding business processes is key to anticipating how your end users will adopt M365. By spending time with the staff and understanding their day-to-day activities and interactions, you can build better training scenarios to suit their needs and help them understand how the apps in M365 can help them do their job. On top of this you need to meet the business KPIs and IT’s drive for adoption and usage. Encourage early adopters to become trainers and champions. Success will soon follow.

    Executive summary

    Your Challenge

    Common Obstacles

    Info-Tech’s Approach

    M365 is a full suite of tools for collaboration, communication, and productivity, but organizations find the platform is not used to its full advantage and fail to get full value from their license subscription.

    Many users are unsure which tool to use when: Do you use Teams or Viva Engage, MS Project or Planner? When do you use SharePoint versus OneDrive?

    From an IT perspective, finding time to help users at the outset is difficult – it’s quite the task to set up governance, security, and backup. Yet training staff must be a priority if the implementation is to succeed.

    M365 projects are fraught with obstacles. Common mistakes organizations make include:

    • No post-migration plan in place.
    • User training is an afterthought.
    • Lack of communication to end users.
    • No C-suite promotion and sponsorship.
    • Absence of a vision and KPIs to meet that vision.

    To define your post-migration tasks and projects:

    • List all projects in a spreadsheet and rank them according to difficulty and impact.
    • Look for quick wins with easy tasks that have high impact and low difficulty.
    • Build a timeline to execute your plans and communicate clearly how these plans will impact the business and meet that vision.

    Failure to take meaningful action will not bode well for your M365 journey.

    Info-Tech Insight

    There are three primary areas where organizations fail in a successful implementation of M365: training, adoption, and information governance. While it is not up to IT to ensure every user is well trained, it is their initial responsibility to find champions, SMEs, and business-based trainers and to manage information governance from backup, retention, and security aspects of data management.

    Business priorities

    What priorities is IT focusing on with M365 adoption?

    What IT teams are saying

    • In a 2019 SoftwareONE survey, the biggest reason IT decision makers gave for adopting M365 was to achieve a “more collaborative working style.”
    • Organizations must plan and execute a strategy for mass adoption and training to ensure processes match business goals.
    • Cost savings can only be achieved through rightsizing license subscriptions, retiring legacy apps, and building efficiencies within the IT organization.
    • With increased mobility comes with increased cybersecurity risk. Make sure you take care of your security before prioritizing mobility. Multifactor authentication (MFA), conditional access (CA), and additional identity management will maintain a safe work-from-anywhere environment.

    Top IT reasons for adopting M365

    61% More collaborative working style

    54% Cost savings

    51% Improved cybersecurity

    49% Greater mobility

    Source: SoftwareONE, 2019; N=200 IT decision makers across multiple industries and organization sizes

    Define & organize post-implementation projects

    Key areas to success

    • Using Microsoft’s M365 adoption guide, we can prioritize and focus on solutions that will bring about better use of the M365 suite.
    • Most of your planning and prioritizing should be done before implementation. Many organizations, however, adopted M365 – and especially Teams, SharePoint Online, and OneDrive – in an ad hoc manner in response to the pandemic measures that forced users to work from home.
    • Use a Power BI Pro license to set up dashboards for M365 usage analytics. Install GitHub from AppSource and use the templates that will give you good insight and the ability to create business reports to show adoption and usage rates on the platform.
    • Reimagine your working behavior. Remember, you want to bring about a more collective and open framework for work. Take advantage of a champion SME to show the way. Every organization is different, so make sure your training is aligned to your business processes.
    The image contains a screenshot of the M365 post-implementation tasks.

    Process steps

    Define Vision

    Build Team

    Plan Projects

    Execute

    Define your vision and what your priorities are for M365. Understand how to reach your vision.

    Ensure you have an executive sponsor, develop champions, and build a team of SMEs.

    List all projects in a to-be scenario. Rank and prioritize projects to understand impact and difficulty.

    Build your roadmap, create timelines, and ensure you have enough resources and time to execute and deliver to the business.

    Info-Tech’s approach

    Use the out-of-the-box tools and take advantage of your subscription.

    The image contains a screenshot of the various tools and services Microsoft provides.

    Info-Tech Insight

    A clear understanding of the business purpose and processes, along with insight into the organizational culture, will help you align the right apps with the right tasks. This approach will bring about better adoption and collaboration and cancel out the shadow IT products we see in every business silo.

    Leverage built-in usage analytics

    Adoption of services in M365

    To give organizations insight into the adoption of services in M365, Microsoft provides built-in usage analytics in Power BI, with templates for visualization and custom reports. There are third-party tools out there, but why pay more? However, the template app is not free; you do need a Power BI Pro license.

    Usage Analytics pulls data from ActiveDirectory, including location, department, and organization, giving you deeper insight into how users are behaving. It can collect up to 12 months of data to analyze.

    Reports that can be created include Adoption, Usage, Communication, Collaboration (how OneDrive and SharePoint are being used), Storage (cloud storage for mailboxes, OneDrive, and SharePoint), and Mobility (which clients and devices are used to connect to Teams, email, Yammer, etc.).

    Source: Microsoft 365 usage analytics

    Understand admin roles

    Prevent intentional or unintentional internal breaches

    Admin Roles

    Best Practices

    • Global admin: Assign this role only to users who need the most access to management features and data across your tenant. Only global admins can modify an admin role.
    • Exchange admin: Assign this role to users who need to view and manage user mailboxes, M365 groups, and Exchange Online and handle Microsoft support requests.
    • Groups admin: These users can create, edit, delete, and restore M365 groups as well as create expiration and naming policies.
    • Helpdesk admin: These users can resets passwords, force user sign-out, manage Microsoft support requests, and monitor service health.
    • Teams/SharePoint Online admin: Assign these roles for users who manage the Teams and SharePoint Admin Center.
    • User admin: These users can assign licenses, add users and groups, manage user properties, and create and manage user views.

    Only assign two to four global admins, depending on the size of the organization. Too many admins increases security risk. In larger organizations, segment admin roles using role-based access control.

    Because admins have access to sensitive data, you’ll want to assign the least permissive role so they can access only the tools and data they need to do their job.

    Enable MFA for all admins except one break-glass account that is stored in the cloud and not synced. Ensure a complex password, stored securely, and use only in the event of an MFA outage.

    Due to the large number of admin roles available and the challenges that brings with it, Microsoft has a built-in tool to compare roles in the admin portal. This can help you determine which role should be used for specific tasks.

    Secure your M365 tenant

    A checklist to ensure basic security coverage post M365

    • Multifactor Authentication: MFA is part of your M365 tenant, so using it should be a practical identity security. If you want additional conditional access (CA), you will require an Azure AD (AAD) Premium P1+ license. This will ensure adequate identity security protecting the business.
    • Password Protection: Use the AAD portal to set this up under Security > Authentication Methods. Microsoft provides a list of over 2,000 known bad passwords and variants to block.
    • Legacy Authentication: Disable legacy protocols; check to see if your legacy apps/workflows/scripts use them in the AAD portal. Once identified, update them and turn the protocols off. Use CA policies.
    • Self-Service Password Reset: Enable self-service to lower the helpdesk load for password resets. Users will have to initially register and set security questions. Hybrid AD businesses must write back to AD from AAD once changes are made.
    • Security Defaults: For small businesses, turn on default settings. To enable additional security settings, such as break- glass accounts, go into Manage Security Defaults in your AAD properties.
    • Conditional Access (CA) Policies: Use CA policies if strong identity security and zero trust are required. To create policies in AAD go to Security > Conditional Access > New Policies.

    Identity Checklist

    • Enable MFA for Admins
    • Enable MFA for Users
    • Disable App Passwords
    • Configure Trusted IPs
    • Disable Text/Phone MFA
    • Remember MFA on Trusted Devices for 90 Days
    • Train Staff in Using MFA Correctly
    • Integrate Apps Into Azure AD

    Training guidelines

    Identify business scenarios and training adoption KPIs

    • Customize your training to meet your organizational goals, align with your business culture, and define how users will work inside the world of M365.
    • Create scenario templates that align to your current day-to-day operations in each department. These can be created by individual business unit champions.
    • Make sure you have covered must-have capabilities and services within M365 that need to be rolled out post-pilot.
    • Phase in large transitions rather than multiple small ones to ensure collaboration between departments meets business scenarios.
    • Ensure your success metrics are being measured and continue to communicate and train after deployment using tools available in M365. See Microsoft’s adoption guidelines and template for training.

    Determine your training needs and align with your business processes. Choose training modalities that will give users the best chance of success. Consider one or many training methods, such as:

    • Online training
    • In-person classroom
    • Business scenario use cases
    • Mentoring
    • Department champion/Early adopter
    • Weekly bulletin fun facts

    Don’t forget backup!

    Providing 99% uptime and availability is not enough

    Why is M365 backup so important?

    Accidental Data Deletion.

    If a user is deleted, that deletion gets replicated across the network. Backup can save you here by restoring that user.

    Internal and External Security Threats.

    Malicious internal deletion of data and external threats including viruses, ransomware, and malware can severely damage a business and its reputation. A clean backup can easily restore the business’ uninfected data.

    Legal and Compliance Requirements.

    While e-discovery and legal hold are available to retain sensitive data, a third-party backup solution can easily search and restore all data to meet regulatory requirements – without depending on someone to ensure a policy was set.

    Retention Policy Gaps.

    Retention policies are not a substitute for backup. While they can be used to retain or delete content, they are difficult to keep track of and manage. Backups offer greater latitude in retention and better security for that data.

    Retire your legacy apps to gain adoption

    Identify like for like and retire your legacy apps

    Legacy

    Microsoft 365

    SharePoint 2016/19

    SharePoint Online

    Microsoft Exchange Server

    Microsoft Exchange in Azure

    Skype for Business Server

    Teams

    Trello

    Planner 2022

    System Center Configuration Manager (SCCM)

    Endpoint Manager, Intune, Autopilot

    File servers

    OneDrive

    Access

    Power Apps

    To meet the objectives of cost reduction and rationalization, look at synergies that M365 brings to the table. Determine what you are currently using to meet collaboration, storage, and security needs and plan to use the equivalent in your Microsoft entitlement.

    Managing M365’s hidden costs

    Licenses and storage limits TCO

    • Email security. Ninety-one percent of all cyberattacks come from phishing on email. Microsoft Defender for M365 is a bolt-on, so it is an additional cost.
    • Backup. This will bring additional cost to M365. Plan to spend more to ensure data is backed up and stored.
    • Email archiving. Archiving is different than backup. See our research on the subject. Archiving is needed for compliance purposes. Email archiving solutions are available through third-party software, which is an added cost.
    • Email end-to-end encryption. This is a requirement for all organizations that are serious about security. The enterprise products from Microsoft come at an additional cost.
    • Cybersecurity training. IT needs to ramp up on training, another expense.
    • Microsoft 365 Power Platform Licencing. From low-code and no-code developer tools (Power Apps), workflow tools (Power Automate), and business intelligence (Power BI) – while the E5 license gives you Power BI Pro, there are limitations and costs. Power BI Pro has limitations for data volume, data refresh, and query response time, so your premium license comes at a considerably marked up cost.

    M365 is not standalone

    • While Microsoft 365 is a platform that is ”just good enough,” it is actually not good enough in today’s cyberthreat environment. Microsoft provides add-ons with Defender for 365, Purview, and Sentinel, which pose additional costs, just like a third-party solution would. See the Threat Intelligence & Incident Response research in our Security practice.
    • The lack of data archiving, backup, and encryption means additional costs that may not have been budgeted for at the outset. Microsoft provides 30-60-90-day recovery, but anything else is additional cost. For more information see Understand the Difference between Backups and Archiving.

    Compliance and regulations

    Security and compliance features out of the box

    There are plenty of preconfigured security features contained in M365, but what’s available to you depends on your license. For example, Microsoft Defender, which has many preset policies, is built-in for E5 licenses, but if you have E3 licenses Defender is an add-on.

    Three elements in security policies are profiles, policies, and policy settings.

    • Preset Profiles come in the shape of:
      • Standard – baseline protection for most users
      • Strict – aggressive protection for profiles that may be high-value targets
      • Built-in Protection – turned on by default; it is not recommended to make exceptions based on users, groups, or domains
    • Preset Security Policies
      • Exchange Online Protection Policies – anti-spam, -malware, and -phishing policies
      • Microsoft Defender Policies – safe links and safe attachments policies
    • Policy Settings
      • User impersonation protection for internal and external domains
      • Select priorities from strict, standard, custom, and built-in

    Info-Tech Insight

    Check your license entitlement before you start purchasing add-ons or third-party solutions. Security and compliance are not optional in today’s cybersecurity risk world. With many organizations offering hybrid and remote work arrangements and bring-your-own-device (BYOD) policies, it is necessary to protect your data at the tenant level. Defender for Microsoft 365 is a tool that can protect both your exchange and collaboration environments.

    More information: Microsoft 365 Defender

    Use Intune and Autopilot

    Meet the needs of your hybrid workforce

    • Using the tools available in M365 can help you develop your hybrid or remote work strategy.
    • This strategy will help you maintain security controls for mobile and BYOD.
    • Migrating to Intune and Autopilot will give rise to the opportunity to migrate off SCCM and further reduce your on-premises infrastructure.

    NOTE: You must have Azure AD Premium and Windows 10 V1703 or later as well as Intune or other MDM service to use Autopilot. There is a monthly usage fee based on volume of data transmitted. These fees can add up over time.

    For more details visit the following Microsoft Learn pages:

    Intune /Autopilot Overview

    The image contains a screenshot of the Intune/Autopilot Overview.

    Info-Tech’s research on zero-touch provisioning goes into more detail on Intune and Autopilot:
    Simplify Remote Deployment With Zero-Touch Provisioning

    M365 long-term strategies

    Manage your costs in an inflationary world

    • Recent inflation globally, whether caused by supply chain woes or political uncertainty, will impact IT and cloud services along with everything else. Be prepared to pay more for your existing services and budget accordingly.
    • Your long-term strategies must include ongoing cost management, data management, security risks, and license and storage costs.
    • Continually investigate efficiencies, overlaps, and new tools in M365 that can get the job done for the business. Use as many of the applications as you can to ensure you are getting the best bang for your buck.
    • Watch for upgrades in the M365 suite of tools. As Microsoft continues to improve and deliver on most business applications well after their first release, you may find that something that was previously inefficient could work in your environment today and replace a tool you currently use.

    Ongoing Activities You Need to Maintain

    • Be aware of increased license costs and higher storage costs.
    • Keep an eye on Teams sprawl.
    • Understand your total cost of ownership.
    • Continue to look at legacy apps and get rid of your infrastructure debt.

    Activity

    Build your own M365 post-migration plan

    1. Using slide 6 as your guideline, create your own project list using impact and difficulty as your weighting factors.
    2. Do this exercise as a whiteboard sticky note exercise to agree on impact and difficulty as a team.
    3. Identify easy wins that have high impact.
    4. Place the projects into a project plan with time lines.
    5. Agree on start and completion dates.
    6. Ensure you have the right resources to execute.

    The image contains a screenshot of the activity described in the above text.

    Related Info-Tech Research

    Govern Office 365

    • Office 365 is as difficult to wrangle as it is valuable. Leverage best practices to produce governance outcomes aligned with your goals.

    Drive Ongoing Adoption With an M365 Center of Excellence

    • Accelerate business processes change and get more value from your subscription by building and sharing, thanks to an effective center of excellence.

    Simplify Remote Deployment With Zero-Touch Provisioning

    • Adopt zero-touch provisioning to provide better services to your end users.
    • Save time and resources during device deployment while providing a high-quality experience to remote end users.

    Bibliography

    “5 Reasons Why Microsoft Office 365 Backup Is Important.” Apps 4Rent, Dec 2021, Accessed Oct 2022 .
    Chandrasekhar, Aishwarya. “Office 365 Migration Best Practices & Challenges 2022.” Saketa, 31 Mar 2022. Accessed Oct. 2022.
    Chronlund, Daniel. “The Fundamental Checklist – Secure your Microsoft 365 Tenant”. Daniel Chronlund Cloud Tech Blog,1 Feb 2019. Accessed 1 Oct 2022.
    Davies, Joe. “The Microsoft 365 Enterprise Deployment Guide.” Tech Community, Microsoft, 19 Sept 2018. Accessed 2 Oct 2022.
    Dillaway, Kevin. “I Upgraded to Microsoft 365 E5, Now What?!.” SpyGlassMTG, 10 Jan 2022. Accessed 4 Oct. 2022.
    Hartsel, Joe. “How to Make Your Office 365 Implementation Project a Success.” Centric, 20 Dec 2021. Accessed 2 Oct. 2022.
    Jha, Mohit. “The Ultimate Microsoft Office 365 Migration Checklist for Pre & Post Migration.” Office365 Tips.Org, 24 June 2022. Accessed Sept. 2022.
    Lang, John. “Why organizations don't realize the full value of Microsoft 365.“Business IT, 29 Nov 202I. Accessed 10 Oct 2022.
    Mason, Quinn. “How to increase Office 365 / Microsoft 365 user adoption.” Sharegate, 19 Sept 2019. Accessed 3 Oct 2022.
    McDermott, Matt. “6-Point Office 365 Post-Migration Checklist.” Spanning , 12 July 2019 . Accessed 4 Oct 2022.
    “Microsoft 365 usage analytics.” Microsoft 365, Microsoft, 25 Oct 2022. Web.
    Sharma, Megha. “Office 365 Pre & Post Migration Checklist.’” Kernel Data Recovery, 26 July 2022. Accessed 30 Sept. 2022.
    Sivertsen, Per. “How to avoid a failed M365 implementation? Infotechtion, 19 Dec 2021. Accessed 2 Oct. 2022.
    St. Hilaire, Dan. “Most Common Mistakes with Office 365 Deployment (and How to Avoid Them).“ KnowledgeWave, 4Mar 2019. Accessed Oct. 2022.
    “Under the Hood of Microsoft 365 and Office 365 Adoption.” SoftwareONE, 2019. Web.

    There should never be only one.

    • Large vertical image:
    • member rating overall impact: High Impact
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A

    Today, we're talking about a concept that’s both incredibly simple and dangerously overlooked: the single point of failure, or SPOF for short.

    Imagine you’ve built an impenetrable fortress. It has high walls, a deep moat, and strong gates. But the entire fortress can only be accessed through a single wooden bridge. That bridge is your single point of failure. If it collapses or is destroyed, your magnificent fortress is completely cut off. It doesn't matter how strong the rest of it is; that one weak link renders the entire system useless.

    In your work, your team, and your processes and technology, these single bridges are everywhere. A SPOF is any part of a system that, if it stops working, will cause the entire system to shut down. It’s the one critical component, the one indispensable person, or the one vital process that everything else depends on.

    When you identify and fix these weak points you aren't being pessimistic; you're fixing the very foundation of something that can withstand shocks and surprises. It’s about creating truly resilient systems and teams, not just seemingly strong ones. So, let’s explore where these risks hide and what you can do about them.

    When People Become the Problem

    For those of you who know me, saying something like this feels at odds with who I am. And yet, it's one of the most common and riskiest areas in any organization. Human single points of failure don't happen because of malicious intent. They typically grow out of good intentions, hard work, and necessity. But the result is the same: a fragile system completely dependent on an individual.

    The Rise of the Hero

    We all know a colleague like this. The “hero” is the one person who has all the answers. When a critical system goes down at 3 AM, they're the only one who can fix it. They understand the labyrinthine codebase nobody else dares to touch. They have the historical context for every major decision made in the last decade. On the surface, this person is invaluable. Management loves them because they solve problems. The team relies on them because they’re a walking encyclopedia.

    But here’s the inconvenient truth: your hero is your biggest liability.

    This isn’t their fault. They likely became the hero by stepping up when no one else would or could. The hero may actually feel like they are the only ones qualified to handle the issue because “management” does not take the necessary actions to train other people. Or “management” places other priorities. Be aware, this is a perception thing. The manager is very likely to be very concerned about the well-being of their employee. (I'm taking "black companies", akin to black sites, out of the equation for a moment and concentrating on generally healthy workplaces.) The hero will likely feel a strong bond to their environment. Also, every hero is different. There is a single point of failure, but not a single type of person. Every person has a different driver.

    I watched a YouTube video by a famous entrepreneur the other day. And she said something that triggered a response in me, because it sows the seeds of the hero. She said, Would you rather have an employee who just fixes it, handles it, and deals with it? Or an employee that talks about it? Obviously, the large majority will take the person behind door number 1. I would too. But then you need to step up as a manager, as an owner, as an executive, and enforce knowledge sharing.

    If you channel all critical knowledge and capabilities through one person, if you let this person become your go-to specialist for everything, you've created a massive SPOF. What happens when your hero gets sick, takes a well deserved two week vacation to a place with no internet, or leaves the company for a new opportunity? The system grinds to a halt. A minor issue becomes a major crisis because the only person who can fix it is unavailable.

    This overreliance doesn't just create a risk; it stifles growth. Other team members don't get the opportunity to learn and develop new skills because the hero is always there to swoop in and save the day. The answer? I guess that depends on your situation and what your ability is to keep this person happy without alienating the rest of the team. The answer may lie in the options discussed later in the article around KPIs.

    The Knowledge Hoarders

    A step beyond the individual hero is the team that acts as a collective SPOF. This is the team that “protects” its know how. They might use complex, undocumented tools, speak in a language of acronyms only they understand, or resist any attempts to standardize their processes. They've built a silo around their work, making themselves indispensable as a unit.

    Unlike the hero, this often comes from a place of perceived self preservation. If they are the only ones who understand how something works, their jobs are secure, right? But this behavior is incredibly damaging to the organization's resilience. Not to mention that it is just plain wrong. The team becomes inundated with requests for new features, but also for help in solving incidents. The result in numerous instances is that the team succeeds in neither. Next the manager is called to the senior management because the business is complaining that things don't progress as expected. 

    This team thus has become a bottleneck. Any other team that needs to interact with their system is completely at their mercy. Progress slows to a crawl, dependent on their availability and willingness to cooperate. Preservation has turned into survival.  

    The real root cause at the heart of both the hero and the knowledge hoarding team is a failure of knowledge management. When information isn't shared, documented, and made accessible, you are actively choosing to create single points of failure. We'll dive deeper into building a robust knowledge sharing culture in a future article, but for now, recognize that knowledge kept in one person's or team's head is a disaster waiting to happen.

    When Your Technology is a House of Cards

    People aren't the only source of fragility. The way you build and manage your technology stacks can easily create critical SPOFs that leave you vulnerable. These are often less obvious at first, but they can cause dangerous failures when they finally break.

    The Danger of the Single Node

    Let's start with the most straightforward technical SPOF: the single node setup. Imagine you have a critical application like maybe your company's main website or an internal database. If you run that entire application on one single server (a single “node”), you've created a classic SPOF.

    It’s like a restaurant with only one chef. If that chef goes home, the kitchen closes. It doesn't matter how many waiters or tables you have. If that single server experiences a hardware failure, a software crash, or even just needs to be rebooted for an update, your entire service goes offline. There is no failover. The service is simply down until that one machine is fixed, patched or rebooted.

    You need to set up your systems so that when one node goes down, the other takes over. This is not just something for large enterprises. SMEs must do the same. I've had numerous calls from business owners who did something to their web server or system and now “it doesn't work!” Not only are they down, now they have to call me and I then must arrange for subject matter experts to fix it immediately. Typically at a cost much larger than if they had set up their system with active, warm or even cold standbys. 

    The Mystery of Closed Technologies

    Another major risk comes from an overreliance on closed, proprietary technologies. This happens when you build a core part of your business on a piece of software or hardware that you don't control and can't inspect. It’s a “black box.” You know what it’s supposed to do, but you have no idea how it does it, and you can’t fix it if it breaks. When something goes wrong, you are completely at the mercy of the company that created it. You have to submit a support ticket and wait.

    This is actually relatable to the next chapter, please follow along and take the advice there.

    The Trap of Vendor Lock In

    Closely related to closed technology is the concept of vendor lock-in. This is a subtle but powerful SPOF. It happens when you become so deeply integrated with a single vendor's ecosystem that the cost and effort of switching to a competitor are impossibly high. Your vendor effectively becomes a strategic single point of failure. Your ability to innovate, control costs, and pivot your strategy is now tied to the decisions of another company.

    This may even run afoul of legal standards. In Europe, we have the DORA and NIS2 regulations. DORA specifically mandates that companies have exit plans for their systems, starting with their critical and important functions. Functions refers to business services, to be clear. 

    But we get there so easily. The native functions of AWS, Azure and Google Cloud, just to name a few, are very enticing to use. They offer convenience, low code, and performance on tap. It's just that, once you integrate deeply with them, you are taken, hook, line, and sinker. And then you have people like me, or worse, your regulator, who demands “What is your exit plan?”

    Your Resilience Playbook: Practical Steps to Eliminate SPOFs

    Identifying your single points of failure is the first step. The real work is in systematically eliminating them. This isn't about a single, massive project; it's about building new habits and principles into your daily work. Here's a playbook I think you can start using today.

    Mitigate People-Based Risks

    The cure for depending on one person is to create a culture where knowledge is fluid and shared by default. Your goal is to move from individual heroics to collective resilience.

    • Mandate real vacations. This might sound strange, but one of the best ways to reveal and fix a “hero” problem is to make sure your hero takes a real, disconnected vacation. This isn't a punishment; it's a benefit to them and a necessary stress test for the team. It forces others to step up and document their processes in preparation. The first time will be painful, but it gets easier each time as the team builds its own knowledge.

    • Adopt the “teach, don't just do” rule. Coach your senior experts to see their role as multipliers. When someone asks them a question, their first instinct should be to show, not just to do. This can be a five minute screen sharing session, grabbing a colleague to pair program on a fix, or taking ten minutes to write down the answer in a shared knowledge base so it never has to be asked again.

      Many companies have knowledge sharing solutions in place. Take a moment to actually use them. Prepare for when new people come into the company. Have a place where they can get into the groove and learn the heart beat of the company. There is a reason why the Madonna song is so captivating to so many people. Getting into the groove elevates you. And the same thing happens in your company. 

    • Rotate responsibilities and run "game days". Actively move people around. Let a developer handle support tickets for a week to understand common customer issues. Have your infrastructure expert sit with the product team. Also, create “game days” where you simulate a crisis. For example: "Okay team, our lead developer is 'on vacation' today. Let's practice a full deployment without them.” This makes learning safe and proactive.

    • Celebrate team success, not individual firefighting. Shift your praise and recognition. Instead of publicly thanking a single person for working all night to resolve a problem, celebrate the team that built a system so resilient it didn't break in the first place. Reward the team that wrote excellent documentation that allowed a junior member to solve a complex issue. Culture follows what you celebrate. At the same time, if the team does not pony up, definitely praise the person and follow up with the team to fix this.

    • Host internal demos and tech talks. Create a regular, informal forum where people can share what they're working on. This could be a “brown bag lunch” session or a Friday afternoon demo. It demystifies what other teams are doing, breaks down silos, and encourages people to ask questions in a low pressure environment.

    • Remunerate sharing. Make sharing knowledge a bonus-eligible key performance indicator. The more sharing an expert does, with their peers acknowledging this, the more the expert earns. You can easily incorporate this into your peer feedback system. 

    • Run DRP exercises without your top engineers: This is taking a leap of faith, and I would never recommend this until all of the above are in place and proven. 

    Building Resilient Technical Systems

    The core principle here is to assume failure will happen and to design for it. A resilient system isn't one where parts never fail, but one where the system as a whole keeps working even when they do.

    • Embrace the rule of three. This is a simple but powerful guideline. For critical data, aim to have three copies on two different types of media, with one copy stored off-site (or in a different cloud region). For critical services, aim for at least three instances running in different availability zones. This simple rule protects you from a wide range of common failures.

    • Automate everything you can. Every manual process is a potential SPOF. It relies on a person remembering a series of steps perfectly, often under pressure. Automate your testing, your deployments, your server setup, and your backup procedures. Scripts are consistent and repeatable; tired humans at 3 AM are not.

    • Use health checks and smart monitoring. It's not enough to have a backup server; you need to know that it's healthy and ready to take over. Implement automated health checks that constantly monitor your primary and redundant systems. Your monitoring should alert you the moment a backup component fails, not just when the primary one does.

    • Practice chaos engineering. Don't wait for a real failure to test your resilience. Intentionally introduce failures in a controlled environment. This is known as chaos engineering. Start small. What happens if you turn off a non-critical service during work hours? Does the system handle it gracefully? Does the team know how to respond? This turns a potential crisis into a planned, educational drill.

    Avoiding Technology and Vendor Traps

    Your resilience also depends on the choices you make about the technology and partners you rely on. The goal is to maintain control over your destiny.

    • Build abstraction layers. Instead of having your application code talk directly to a specific vendor's service, create an intermediary layer that you control. This “abstraction layer” acts as a buffer. If you ever need to switch vendors, you only have to update your abstraction layer, not your entire application. It’s more work up front but gives you immense flexibility later.

    • Make “ease of exit” a key requirement. When you evaluate a new technology or vendor, make portability a primary concern. Ask tough questions: How do we get our data out? What is the process for migrating to a competitor? Is the technology based on open standards? Run a small proof of concept to test how hard it would be to leave before you commit fully.

    • Consider a multi-vendor strategy. For your most critical dependencies, like cloud hosting, avoid going all in on a single provider if you can. Using services from two or more vendors is an advanced strategy, but it provides the ultimate protection against a massive, platform wide outage or unfavorable changes in pricing or terms.

    It's a journey, not a destination

    You will never be “ready.” Building resilience by eliminating single points of failure isn't a one time project you can check off a list. It’s a continuous process. New SPOFs will emerge as your systems evolve, people change roles, and your business grows.

    The key is to make this thinking a part of your culture. Make “What's the bus factor for this project?” a regular question in your planning meetings. Make redundancy and documentation a non negotiable requirement for new systems. By constantly looking for the one thing that can bring everything down, you can build teams and technology that don't just survive shocks—they eat them for breakfast.

    Architect Your Big Data Environment

    • Buy Link or Shortcode: {j2store}202|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Big Data
    • Parent Category Link: /big-data
    • Organizations may understand the transformative potential of a big data initiative, but they struggle to make the transition from the awareness of its importance to identifying a concrete use case for a pilot project.
    • The big data ecosystem is crowded and confusing, and a lack of understanding of it may cause paralysis for organizations.

    Our Advice

    Critical Insight

    • Don’t panic, and make use of the resources you already have. The skills, tools, and infrastructure for big data can break any budget quickly, but before making rash decisions, start with the resources you have in-house.
    • Big data as a service (BDaaS) is making big waves. BDaaS removes many of the hurdles associated with implementing a big data strategy and vastly lowers the barrier of entry.

    Impact and Result

    • Follow Info-Tech’s methodology for understanding the types of modern approaches to big data tools, and then determining which approach style makes the most sense for your organization.
    • Based on your big data use case, create a plan for getting started with big data tools that takes into account the backing of the use case, the organization’s priorities, and resourcing available.
    • Put a repeatable framework in place for creating a comprehensive big data tool environment that will help you decide on the necessary tools to help you realize the value from your big data use case and scale for the future.

    Architect Your Big Data Environment Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should find your optimal approach to big data tools, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Plant the foundations of your big data tool architecture

    Identify your big data use case and your current data-related capabilities.

    • Architect Your Big Data Environment – Phase 1: Plant the Foundations of Your Big Data Tool Architecture
    • Big Data Execution Plan Presentation
    • Big Data Architecture Planning Tool

    2. Weigh your big data architecture decision criteria

    Determine your capacity for big data tools, as well as the level of customizability and security needed for your solution to help justify your implementation style decision.

    • Architect Your Big Data Environment – Phase 2: Weigh Your Big Data Architecture Decision Criteria

    3. Determine your approach to implementing big data tools

    Analyze the three big data implementation styles, select your approach, and complete the execution plan for your big data initiative.

    • Architect Your Big Data Environment – Phase 3: Determine Your Approach To Implementing Big Data Tools
    [infographic]

    Develop a COVID-19 Pandemic Response Plan

    • Buy Link or Shortcode: {j2store}420|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: DR and Business Continuity
    • Parent Category Link: /business-continuity
    • IT departments are being asked to rapidly ramp up work-from-home capabilities and other business process workarounds.
    • Crisis managers are experiencing a pandemic more severe than what they’ve managed in the past.
    • Organizations are scrambling to determine how they can keep their businesses running through this pandemic.

    Our Advice

    Critical Insight

    • Obstacles to working from home go beyond internet speed and needing a laptop. Business input is critical to uncover unexpected obstacles.
    • IT needs to address a range of issues from security risk to increased service desk demand from users who don’t normally work from home.
    • Resist the temptation to bypass IT processes – your future-self will thank you for tracking all those assets about to go out the door.

    Impact and Result

    • Start with crisis management fundamentals – identify crisis management roles and exercise appropriate crisis communication.
    • Prioritize business processes and work-from-home requirements. Not everyone can be set up on day one.
    • Don’t over-complicate your work-from-home deployment plan. A simple spreadsheet (see the Work-from-Home Requirements Tool) to track requirements can be very effective.

    Develop a COVID-19 Pandemic Response Plan Research & Tools

    Start here

    Stay up to date on COVID-19 and the resources available to you.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Develop a COVID-19 Pandemic Response Plan Storyboard

    1. Manage the pandemic crisis

    Identify key roles and immediate steps to manage this crisis.

    • Pandemic Response Plan Example

    2. Create IT’s plan to support the pandemic response plan

    Plan the deployment of a work-from-home initiative.

    • Work-From-Home Requirements Tool
    [infographic]

    What is resilience?

    • Large vertical image:
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A

    Aside from the fact that operational resilience is mandated by law as of January 2025 (yes, next year), having your systems and applications available to your customers whenever they need your services is always a good idea. Customers, both existing and new ones, typically prefer smooth operations over new functionality. If you have any roadblocks in your current customer journey, then solving those is also part of operational resilience (and excellence).

    Does this mean you should not market new products or services? Of course not! Solving a customer journey roadblock is ensuring that your company is resilient. The Happy Meal is a prime example: it solved a product roadblock for small children and a profits roadblock for the company. For more info, just google it. But before you bring a new service online, be sure that it can withstand the punches that will be thrown at it. 

    What is resilience? 

    Resilience is the art of making sure your services are available to your customers whenever they can use them. Note I did not say 24/7/365. Your business may require that, but perhaps your systems need "only" to be available during "normal" business hours.

    Resilient systems can withstand adverse events that impair their ability to perform normal functions, and, like in the case the Happy Meals, increased peak demands. Events can include simple breakdowns (like a storage device, an internet connection that fails, or a file that fails to load) or something worse, like a cyber attack or a larger failure in your data center.

    Your client does not care what the cause is; what counts for the client is, "Can I access your service? (or buy that meal for my kid.)"

    Resilience entails several aspects:

    • availability
    • performance
    • right-sizing
    • hardening
    • restore-ability
    • testing
    • monitoring
    • management and governance

    It is now tempting to apply these aspects only to your organization's IT or technical parts. That is insufficient. Your operations, management, and even e.g. sales must ensure that services rendered result in happy clients and happy shareholders/owners. The reason is that resilient operations are a symphony. Not one single department or set of actions will achieve this. When you have product development working with the technical teams to develop a resilient flow at the right level for its earning potential, then you maximize profits.

    This synergy ensures that you invest exactly the right level of resources. There are no exaggerated technical or operational elements for ancillary services. That frees resources to ensure your main services receive the full attention they deserve.

    Resilience, in other words, is the result of a mindset and a way of operating that helps your business remain at the top of its game and provides a top service to clients while keeping the bottom line in the black. 

    Why do we need to spend on this?

    I mean, if it ain't broke, don't fix it. That old adage is true, and yet not. Services can remain up and running for a long time with single points of failure. But can you afford to have them break at any time? If yes, and your customers don't mind waiting for you to patch things up, then you can "risk-accept" that situation. But how realistic is that these days? If I cannot buy it at your shop today, I'll more than likely get it from another. If I'm in a contract with you, yet you cannot deliver, we will have a conversation, or at the very least, a moment of disappointment. If you have enough "disappointments," you will lose the customer. Lose enough customers, and you will have a reputational problem or worse.

    We don't like to spend resources on something that "may"go wrong. We do risk assessments to determine the true cost of non-delivery and the likelihood of that happening. And there are different ways to deal with that assessment's outcome. Not everything needs to have double the number of people working on it, just in case one resignes. Not every system needs an availability of 99,999%.

    But sometimes, we do not have a choice. When lives are at stake, like in medical or aviation services, being sorry is not a good starting point. The same goes for financial services. the DORA and NIS2 legislation in the EU, the CEA, FISMA, and GLBA in the US, and ESPA in Japan, to name a few, are legislations that require your company, if active in the relevant regulated sectors, to comply and ensure that your services continue to perform.

    Most of these elements have one thing in common: we need to know what is important for our service delivery and what is not.

    Business service

    That brings us to the core subject of what needs to be resilient. The answer is very short and very complex at the same time. It is the service that you offer to your customers which must meet reliance levels.

    Take the example of a hospital. When there is a power outage, the most critical systems must continue operating for a given period. That also means that sufficient capable staff must be present to operate said equipment; it even means that the paths leading to said hospital should remain available; if not by road, then, e.g., by helicopter. If these inroads are unavailable, an alternate hospital should be able to take on the workload. 

    Not everything here in this example is the responsibility of the hospital administrators! This is why the management and governance parts of the resilience ecosystem are so important in the bigger picture. 

    If we look at the financial sector, the EU DORA (Digital Operational Resilience Act) specifically states that you must start with your business services. Like many others, the financial sector can no longer function without its digital landscape. If a bank is unexpectedly disconnected from its payment network, especially SWIFT, it will not be long before there are existential issues. A trading department stands to lose millions if the trading system fails. 

    Look in your own environment; you will see many such points. What if your internet connection goes down, and you rely on it for most of your business? How long can you afford to be out? How long before your clients notice and take action? Do you supply a small but critical service to an institution? Then, you may fall under the aforementioned laws (it's called third-party requirements, and your client may be liable to follow them.)

    But also, outside of the technology, we see points in the supply chain that require resilience. Do you still rely on a single person or provider for a critical function? Do you have backup procedures if the tech stops working, yet your clients require you to continue to service them? 

    In all these and other cases, you must know what your critical services are so that you can analyze the requirements and put the right measures in place.

    Once you have defined your critical business services and have analyzed their operational requirements, you can start to look at what you need to implement the aforementioned areas of availability, monitoring, hardening, and others. Remember we're still at the level of business service. The tech comes later and will require a deeper analysis. 

    In conclusion.

    Resilient operations ensure that you continue to function, at the right price, in the face of adverse events. If you can, resilience starts at the business level from the moment of product conception. If the products have long been developed, look at how they are delivered to the client and upgrade operations, resources, and tech where needed.

    In some cases, you are legally required to undertake this exercise. But in all cases, it is important that you understand your business services and the needs of your clients and put sufficient resources in the right places of your delivery chain. 

    If you want to discuss this further, please contact me for a free talk.

     

    IT Operations

    Tech Trend Update: If Biosecurity Then Autonomous Edge

    • Buy Link or Shortcode: {j2store}99|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Innovation
    • Parent Category Link: /innovation

    COVID-19 has created new risks to physical encounters among workers and customers. New biosecurity processes and ways to effectively enforce them – in the least intrusive way possible – are required to resume these activities.

    Our Advice

    Critical Insight

    New biosecurity standards will be imposed on many industries, and the autonomous edge will be part of the solution to manage that new reality.

    Impact and Result

    There are some key considerations for businesses considering new biosecurity measures:

    1. If prevention, then ID-based access control
    2. If intervention, then alerts based on data
    3. If investigation, then contact tracing

    Tech Trend Update: If Biosecurity Then Autonomous Edge Research & Tools

    Tech Trend Update: If Biosecurity Then Autonomous Edge

    Understand how new biosecurity requirements could affect your business and why AI at the edge could be part of the solution.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Tech Trend Update: If Biosecurity Then Autonomous Edge Storyboard
    [infographic]

    Optimize Software Pricing in a Volatile Competitive Market

    • Buy Link or Shortcode: {j2store}566|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Marketing Solutions
    • Parent Category Link: /marketing-solutions

    Your challenge:

    • Rising supplier costs and inflation are eroding margins and impacting customers' budgets.
    • There is pressure from management to make a gut-feeling decision because of time, lack of skills, and process limitations.
    • You must navigate competing pricing-related priorities among product, sales, and finance teams.
    • Product price increases fail because discovery lacks understanding of costs, price/value equation, and competitive price points.
    • Customers can react negatively, and results are seen much later (more than 12 months) after the price decision.

    Our Advice

    Critical Insight

    Product leaders will price products based on a deep understanding of the buyer price/value equation and alignment with financial and competitive pricing strategies, and make ongoing adjustments based on an ability to monitor buyer, competitor, and product cost changes.

    Impact and Result

    • Success for many SaaS product managers requires a reorganization and modernization of pricing tools, techniques, and assumptions. Leaders will develop the science of tailored price changes versus across-the-board price actions and account for inflation exposure and the customers’ willingness to pay.
    • This will build skills on how to price new products or adjust pricing for existing products. The disciplines using our pricing strategy methodology will strengthen efforts to develop repeatable pricing models and processes and build credibility with senior management.

    Optimize Software Pricing in a Volatile Competitive Market Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Optimize Software Pricing in a Volatile Competitive Market Executive Brief - A deck to build your skills on how to price new products or adjust pricing for existing products.

    This Executive Brief will build your skills on how to price new products or adjust pricing for existing products.

    • Optimize Software Pricing in a Volatile Competitive Market Executive Brief

    2. Optimize Software Pricing in a Volatile Competitive Market Storyboard – A deck that provides key steps to complete the project.

    This blueprint will build your skills on how to price new products or adjust pricing for existing products with documented key steps to complete the pricing project and use the Excel workbook and customer presentation.

    • Optimize Software Pricing in a Volatile Competitive Market – Phases 1-3

    3. Optimize Software Pricing in a Volatile Competitive Market Workbook – A tool that enables product managers to simplify the organization and collection of customer and competitor information for pricing decisions.

    These five organizational workbooks for product pricing priorities, interview tracking, sample questions, and critical competitive information will enable the price team to validate price change data through researching the three pricing schemes (competitor, customer, and cost-based).

    • Optimize Software Pricing in a Volatile Competitive Market Workbook

    4. Optimize Software Pricing in a Volatile Competitive Market Presentation Template – A template that serves as a guide to communicating the Optimize Pricing Strategy team's results for a product or product line.

    This template includes the business case to justify product repricing, contract modifications, and packaging rebuild or removal for launch. This template calls for the critical summarized results from the Optimize Software Pricing in a Volatile Competitive Market blueprint and the Optimize Software Pricing in a Volatile Competitive Market Workbook to complete.

    • Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Infographic

    Further reading

    SoftwareReviews — A Division of INFO~TECH RESEARCH GROUP

    Optimize Software Pricing in a Volatile Competitive Market

    Leading SaaS product managers align pricing strategy to company financial goals and refresh the customer price/value equation to avoid leaving revenues uncaptured.

    Table of Contents

    Section Title Section Title
    1 Executive Brief 2 Key Steps
    3 Concluding Slides

    Optimize Software Pricing in a Volatile Competitive Market

    Leading SaaS product managers align pricing strategy to company financial goals and refresh the customer price/value equation to avoid leaving revenues uncaptured.

    EXECUTIVE BRIEF

    Analyst Perspective

    Optimized Pricing Strategy

    Product managers without well-documented and repeatable pricing management processes often experience pressure from “Agile” management to make gut-feel pricing decisions, resulting in poor product revenue results. When combined with a lack of customer, competitor, and internal cost understanding, these process and timing limitations drive most product managers into suboptimal software pricing decisions. And, adding insult to injury, the poor financial results from bad pricing decisions aren’t fully measured for months, which further compounds the negative effects of poor decision making.

    A successful product pricing strategy aligns finance, marketing, product management, and sales to optimize pricing using a solid understanding of the customer perception of price/value, competitive pricing, and software production costs.

    Success for many SaaS product managers requires a reorganization and modernization of pricing tools, techniques, and data. Leaders will develop the science of tailored price changes versus across-the-board price actions and account for inflation exposure and the customers’ willingness to pay.

    This blueprint will build your skills on how to price new products or adjust pricing for existing products. The discipline you build using our pricing strategy methodology will strengthen your team’s ability to develop repeatable pricing and will build credibility with senior management and colleagues in marketing and sales.

    Photo of Joanne Morin Correia, Principal Research Director, SoftwareReviews.

    Joanne Morin Correia
    Principal Research Director
    SoftwareReviews

    Executive Summary

    Organizations struggle to build repeatable pricing processes:
    • A lack of alignment and collaboration among finance, marketing, product development, and sales.
    • A lack of understanding of customers, competitors, and market pricing.
    • Inability to stay ahead of complex and shifting software pricing models.
    • Time is wasted without a deep understanding of pricing issues and opportunities, and revenue opportunities go unrealized.
    Obstacles add friction to the pricing management process:
    • Pressure from management to make quick decisions results in a gut-driven approach to pricing.
    • A lack of pricing skills and management processes limits sound decision making.
    • Price changes fail because discovery often lacks competitive intelligence and buyer value to price point understanding. Customers’ reactions are often observed much later, after the decision is made.
    • Economic disruptions, supplier price hikes, and higher employee salaries/benefits are driving costs higher.
    Use SoftwareReviews’ approach for more successful pricing:
    • Organize for a more effective pricing project including roles & responsibilities as well as an aligned pricing approach.
    • Work with CFO/finance partner to establish target price based on margins and key factors affecting costs.
    • Perform a competitive price assessment and understand the buyer price/value equation.
    • Arrive at a target price based on the above and seek buy-in and approvals.

    SoftwareReviews Insight

    Product leaders will price products based on a deep understanding of the buyer price/value equation and alignment with financial and competitive pricing strategies, and they will make ongoing adjustments based on an ability to monitor buyers, competitors, and product cost changes.

    What is an optimized price strategy?

    “Customer discovery interviews help reduce the chance of failure by testing your hypotheses. Quality customer interviews go beyond answering product development and pricing questions.” (Pricing Strategies, Growth Ramp, March 2022)

    Most product managers just research their direct competitors when launching a new SaaS product. While this is essential, competitive pricing intel is insufficient to create a long-term optimized pricing strategy. Leaders will also understand buyer TCO.

    Your customers are constantly comparing prices and weighing the total cost of ownership as they consider your competition. Why?

    Implementing a SaaS solution creates a significant time burden as buyers spend days learning new software, making sure tools communicate with each other, configuring settings, contacting support, etc. It is not just the cost of the product or service.

    Optimized Price Strategy Is…
    • An integral part of any product plan and business strategy.
    • Essential to improving and maintaining high levels of margins and customer satisfaction.
    • Focused on delivering the product price to your customer’s business value.
    • Understanding customer price-value for your software segment.
    • Monitoring your product pricing with real-time data to ensure support for competitive strategy.
    Price Strategy Is Not…
    • Increasing or decreasing price on a gut feeling.
    • Changing price for short-term gain.
    • Being wary of asking customers pricing-related questions.
    • Haphazardly focusing entirely on profit.
    • Just covering product costs.
    • Only researching direct competitors.
    • Focusing on yourself or company satisfaction but your target customers.
    • Picking the first strategy you see.

    SoftwareReviews Insight

    An optimized pricing strategy establishes the “best” price for a product or service that maximizes profits and shareholder value while considering customer business value vs. the cost to purchase and implement – the total cost of ownership (TCO).

    Challenging environment

    Product managers are currently experiencing the following:
    • Supplier costs and inflation are rising, eroding product margins and impacting customers’ budgets.
    • Pressure from management to make a gut-feeling decision because of time, lack of skills, and process limitations.
    • Navigating competing pricing-related priorities among product, sales, and finance.
    • Product price increases that fail because discovery lacks understanding of costs, price/value equation, and competitive price points.
    • Slowing customer demand due to poorly priced offerings may not be fully measured for many months following the price decision.
    Doing nothing is NOT an option!
    Offense Double Down

    Benefit: Leverage long-term financial and market assets

    Risk: Market may not value those assets in the future
    Fight Back

    Benefit: Move quickly

    Risk: Hard to execute and easy to get pricing wrong
    Defense Retrench

    Benefit: Reduce threats from new entrants through scale and marketing

    Risk: Causes managed decline and is hard to sell to leadership
    Move Away

    Benefit: Seize opportunities for new revenue sources

    Risk: Diversification is challenging to pull off
    Existing Markets and Customers New Markets and Customers

    Pricing skills are declining

    Among product managers, limited pricing skills are big obstacles that make pricing difficult and under-optimized.

    Visual of a bar chart with descending values, each bar has written on it: 'Limited - Limits in understanding of engineering, marketing, and sales expectations or few processes for pricing and/or cost', 'Inexperienced - Inexperience in pricing project skills and corporate training', 'Lagging - Financial lag indicators (marketing ROI, revenue, profitability, COGs)', 'Lacking - Lack of relevant competitive pricing/packaging information', 'Shifting - Shift to cloud subscription-based revenue models is challenging'.

    The top three weakest product management skills have remained constant over the past five years:
    • Competitive analysis
    • Pricing
    • End of life
    Pricing is the weakest skill and has been declining the most among surveyed product professionals every year. (Adapted from 280 Group, 2022)

    Key considerations for more effective pricing decisions

    Pricing teams can improve software product profitability by:
    • Optimizing software profit with four critical elements: properly pricing your product, giving complete and accurate quotations, choosing the terms of the sale, and selecting the payment method.
    • Implementing tailored price changes (versus across-the-board price actions) to help account for inflation exposure, customer willingness to pay, and product attribute changes.
    • Accelerating ongoing pricing decision-making with a dedicated cross-functional team ready to act quickly.
    • Resetting discounting and promotion, and revisiting service-level agreements.
    Software pricing leaders will regularly assess:

    Has it been over a year since prices were updated?

    Have customers told you to raise your prices?

    Do you have the right mix of customers in each pricing plan?

    Do 40% of your customers say they would be very disappointed if your product disappeared? (Adapted from Growth Ramp, 2021)

    Case Study

    Middleware Vendor

    INDUSTRY
    Technology Middleware
    SOURCE
    SoftwareReviews Custom Pricing Strategy Project
    A large middleware vendor, who is running on Microsoft Azure, known for quality development and website tools, needed to react strategically to the March 2022 Microsoft price increase.

    Key Initiative: Optimize New Pricing Strategy

    The program’s core objective was to determine if the vendor should implement a price increase and how the product should be packaged within the new pricing model.

    For this initiative, the company interviewed buyers using three key questions: What are the core capabilities to focus on building/selling? What are the optimal features and capabilities valued by customers that should be sold together? And should they be charging more for their products?

    Results
    This middleware vendor saw buyer support for a 10% price increase to their product line and restructuring of vertical contract terms. This enabled them to retain customers over multi-year subscription contracts, and the price increase enabled them to protect margins after the Microsoft price increase.

    The Optimize New Pricing Strategy included the following components:

    Components: 'Product Feature Importance & Satisfaction', 'Correlation of Features and Value Drivers', 'Fair Cost to Value Average for Category', 'Average Discounting for Category', 'Customer Value Is an Acceptable Multiple of Price'. First four: 'Component fails into the scope of optimizing price strategy to value'; last one: 'They are optimizing their price strategy decisions'.

    New product price approach

    As a collaborative team across product management, marketing, and finance, we see leaders taking a simple yet well-researched approach when setting product pricing.

    Iterating to a final price point is best done with research into how product pricing:

    • Delivers target margins.
    • Is positioned vs. key competitors.
    • Delivers customer value at a fair price/value ratio.
    To arrive at our new product price, we suggest iterating among 3 different views:

    New Target Price:

    • Buyer Price vs. Value
    • Cost - Plus
    • Vs. Key Competitors
    We analyzed:
    • Customer price/value equation interviews
    • Impacts of Supplier cost increases
    • Competitive pricing research
    • How product pricing delivers target margins

    Who should care about optimized pricing?

    Product managers and marketers who:

    • Support the mandate for optimizing pricing and revenue generation.
    • Need a more scientific way to plan and implement new pricing processes and methods to optimize revenues and profits.
    • Want a way to better apply customer and competitive insights to product pricing.
    • Are evaluating current pricing and cost control to support a refreshed pricing strategy.

    Finance, sales, and marketing professionals who are pricing stakeholders in:

    • Finding alternatives to current pricing and packaging approaches.
    • Looking for ways to optimize price within the shifting market momentum.

    How will they benefit from this research?

    • Refine the ability to effectively target pricing to specific market demands and customer segments.
    • Strengthen product team’s reputation for reliable and repeatable price-management capabilities among senior leadership.
    • Recognize and plan for new revenue opportunities or cost increases.
    • Allow for faster, more accurate intake of customer and competitive data. 
    • Improve pricing skills for professional development and business outcomes.
    • Create new product price, packaging, or market opportunities. 
    • Reduce financial costs and mistakes associated with manual efforts and uneducated guessing.
    • Price software products that better achieve financial goals optimizing revenue, margins, or market share.
    • Enhance the product development and sales processes with real competitive and customer expectations.

    Is Your Pricing Strategy Optimized?

    With the right pricing strategy, you can invest more money into your product, service, or growth. A 1% price increase will improv revenues by:

    Three bars: 'Customer acquisition, 3.32%', 'Customer retention, 6.71%', 'Price monetization, 12.7%'.

    Price monetization will almost double the revenue increases over customer acquisition and retention. (Pricing Strategies, Growth Ramp, March 2022)

    DIAGNOSE PRICE CHALLENGES

    Prices of today's cloud-based services/products are often misaligned against competition and customers' perceived value, leaving more revenues on the table.
    • Do you struggle to price new products with confidence?
    • Do you really know your SaaS product's costs?
    • Have you lost pricing power to stronger competitors?
    • Has cost focus eclipsed customer value focus?
    If so, you are likely skipping steps and missing key outputs in your pricing strategy.

    OPTIMIZE THESE STEPS

    ALIGNMENT
    1. Assign Team Responsibilities
    2. Set Timing for Project Deliverables
    3. Clarify Financial Expectations
    4. Collect Customer Contacts
    5. Determine Competitors
    6. BEFORE RESEARCH, HAVE YOU
      Documented your executive's financial expectations? If "No," return.

    RESEARCH & VALIDATE
    1. Research Competitors
    2. Interview Customers
    3. Test Pricing vs. Financials
    4. Create Pricing Presentation
    5. BEFORE PRESENTING, HAVE YOU:
      Clarified your customer and competitive positioning to validate pricing? If "No," return.

    BUY-IN
    1. Executive Pricing Presentation
    2. Post-Mortem of Presentation
    3. Document New Processes
    4. Monitor the Pricing Changes
    5. BEFORE RESEARCH, HAVE YOU:
      Documented your executive's financial expectations? If "No," return.

    DELIVER KEY OUTPUTS

    Sponsoring executive(s) signs-offs require a well-articulated pricing plan and business case for investment that includes:
    • Competitive features and pricing financial templates
    • Customer validation of price value
    • Optimized price presentation
    • Repeatable pricing processes to monitor changes

    REAP THE REWARDS

    • Product pricing is better aligned to achieve financial goals
    • Improved pricing skills or professional development
    • Stronger team reputation for reliable price management

    Key Insights

    1. Gain a competitive edge by using market and customer information to optimize product financials, refine pricing, and speed up decisions.
    2. Product leaders will best set software product price based on a deep understanding of buyer/price value equation, alignment with financial strategy, and an ongoing ability to monitor buyer, competitor, and product costs.

    SoftwareReviews’ methodology for optimizing your pricing strategy

    Steps

    1.1 Establish the Team and Responsibilities
    1.2 Educate/Align Team on Pricing Strategy
    1.2 Document Portfolio & Target Product(s) for Pricing Updates
    1.3 Clarify Product Target Margins
    1.4 Establish Customer Price/Value
    1.5 Identify Competitive Pricing
    1.6 Establish New Price and Gain Buy-In

    Outcomes

    1. Well-organized project
    2. Clarified product pricing strategy
    3. Customer value vs. price equation
    4. Competitive price points
    5. Approvals

    Insight summary

    Modernize your price planning

    Product leaders will price products based on a deep understanding of the buyer price/value equation and alignment with financial and competitive pricing strategies, and make ongoing adjustments based on an ability to monitor buyer, competitor, and product cost changes.

    Ground pricing against financials

    Meet and align with financial stakeholders.
    • Give finance a heads-up that you want to work with them.
    • Find out the CFO’s expectations for pricing and margins.
    • Ask for a dedicated finance team member.

    Align on pricing strategy

    Lead stakeholders in SaaS product pricing decisions to optimize pricing based on four drivers:
    • Customer’s price/value
    • Competitive strategy
    • Reflective of costs
    • Alignment with financial goals

    Decrease time for approval

    Drive price decisions, with the support of the CFO, to the business value of the suggested change:
    • Reference current product pricing guidelines
    • Compare to the competition and our strategy and weigh results against our customer’s price/value
    • Compare against the equation to business value for the suggested change
    Develop the skill of pricing products

    Increase product revenues and margins by enhancing modern processes and data monetization. Shift from intuitive to information-based pricing decisions.

    Look at other options for revenue

    Adjust product design, features, packaging, and contract terms while maintaining the functionality customers find valuable to their business.

    Blueprint deliverables

    Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:
    Key deliverable:

    New Pricing Strategy Presentation Template

    Capture key findings for your price strategy with the Optimize Your Pricing in a Volatile Competitive Market Strategy Presentation Template

    Sample of the 'Acme Corp New Product Pricing' blueprint.

    Optimize Software Pricing in a Volatile Competitive Market Executive Brief

    This executive brief will build your knowledge on how to price new products or adjust pricing for existing products.

    Sample of the 'Optimize Software Pricing in a Volatile Competitive Market' blueprint.

    Optimize Software Pricing in a Volatile Competitive Market Workbook

    This workbook will help you prioritize which products require repricing, hold customer interviews, and capture competitive insights.

    Sample of the 'Optimize Software Pricing in a Volatile Competitive Market' workbook.

    Guided Implementation

    A Guided Implementation (GI) is a series of calls with a SoftwareReviews analyst to help implement our best practices in your organization.

    A typical GI is 4 to 8 calls over the course of 2 to 4 months.

    What does a typical GI on optimizing software pricing look like?

    Alignment

    Research & Reprice

    Buy-in

    Call #1: Share the pricing team vision and outline activities for the pricing strategy process. Plan next call – 1 week.

    Call #2: Outline products that require a new pricing approach and steps with finance. Plan next call – 1 week.

    Call #3: Discuss the customer interview process. Plan next call – 1 week.

    Call #4 Outline competitive analysis. Plan next call – 1 week.

    Call #5: Review customer and competitive results for initial new pricing business case with finance for alignment. Plan next call – 3 weeks.

    Call #6: Review the initial business case against financial plans across marketing, sales, and product development. Plan next call – 1 week.

    Call #7 Review the draft executive pricing presentation. Plan next call – 1 week.

    Call #8: Discuss gaps in executive presentation. Plan next call – 3 days.

    SoftwareReviews Offers Various Levels of Support to Meet Your Needs

    Included in Advisory Membership Optional add-ons

    DIY Toolkit

    Guided Implementation

    Workshop

    Consulting

    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Desire a Guided Implementation?

    • A GI is where your SoftwareReviews engagement manager and executive advisor/counselor will work with SoftwareReviews research team members to craft with you a Custom Key Initiative Plan (CKIP).
    • A CKIP guides your team through each of the major steps, outlines responsibilities between members of your team and SoftwareReviews, describes expected outcomes, and captures actual value delivered.
    • A CKIP also provides you and your team with analyst/advisor/counselor feedback on project outputs, helps you communicate key principles and concepts to your team, and helps you stay on project timelines.
    • If Guided Implementation assistance is desired, contact your engagement manager.

    Workshop overview

    Contact your account representative for more information.
    workshops@infotech.com1-888-670-8889
    Day 1 Day 2 Day 3 Day 4 Day 5
    Align Team, Identify Customers, and Document Current Knowledge
    Validate Initial Insights and Identify Competitors and Market View
    Schedule and Hold Buyer Interviews
    Summarize Findings and Provide Actionable Guidance to Stakeholders
    Present, Go Forward, and Measure Impact and Results
    Activities

    1.1 Identify Team Members, roles, and responsibilities

    1.2 Establish timelines and project workflow

    1.3 Gather current product and future financial margin expectations

    1.4 Review the Optimize Software Executive Brief and Workbook Templates

    1.4 Build prioritized pricing candidates hypothesis

    2.1 Identify customer interviewee types by segment, region, etc.

    2.2 Hear from industry analysts their perspectives on the competitors, buyer expectations, and price trends

    2.3 Research competitors for pricing, contract type, and product attributes

    3.2 Review pricing and attributes survey and interview questionnaires

    3.2 Hold interviews and use interview guides (over four weeks)

    A gap of up to 4 weeks for scheduling of interviews.

    3.3 Hold review session after initial 3-4 interviews to make adjustments

    4.1 Review all draft price findings against the market view

    4.2 Review Draft Executive Presentation

    5.1 Review finalized pricing strategy plan with analyst for market view

    5.2 Review for comments on the final implementation plan

    Deliverables
    1. Documented steering committee and working team
    2. Current and initial new pricing targets for strategy
    3. Documented team knowledge
    1. Understanding of market and potential target interviewee types
    2. Objective competitive research
    1. Initial review – “Are we going in the right direction with surveys?”
    2. Validate or adjust the pricing surveys to what you hear in the market
    1. Complete findings and compare to the market
    2. Review and finish drafting the Optimize Software Pricing Strategy presentation
    1. Final impute on strategy
    2. Review of suggested next steps and implementation plan

    Our process

    Align team, perform research, and gain executive buy-in on updated price points

    1. Establish the team and responsibilities
    2. Educate/align team on pricing strategy
    3. Document portfolio & target product(s) for pricing updates
    4. Clarify product target margins
    5. Establish customer price/value
    6. Identify competitive pricing
    7. Establish new price and gain buy-in

    Optimize Software Pricing in a Volatile Competitive Market

    Our process will help you deliver the following outcomes:

    • Well-organized project
    • Clarified product pricing strategy
    • Customer value vs. price equation
    • Competitive price points
    • Approvals

    This project involves the following participants:

    • Product management
    • Program leadership
    • Product marketing
    • CFO or finance representative/partner
    • Others
    • Representative(s) from Sales

    1.0 Assign team responsibilities

    Input: Steering committee roles and responsibilities, Steering committee interest and role

    Output: List of new pricing strategy steering committee and workstream members, roles, and timelines, Updated Software Pricing Strategy presentation

    Materials: Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: CFO, sponsoring executive, Functional leads – development, product marketing, product management, marketing, sales, customer success/support

    1-2 hours
    1. The product manager/member running this pricing/repricing program should review the entire Optimize Software Pricing in a Volatile Competitive Market blueprint and each blueprint attachment.
    2. The product manager should also refer to slide 19 of the Optimize Software Pricing in a Volatile Competitive Market blueprint and decide if help via a Guided Implementation (GI) is of value. If desired, alert your SoftwareReviews engagement manager.
    1-2 hours
    1. The product manager should meet with the chief product officer/CPO and functional leaders, and set the meeting agenda to:
      1. Nominate steering committee members.
      2. Nominate work-stream leads.
      3. Establish key pricing project milestones.
      4. Schedule both the steering committee (suggest monthly) and workstream lead meetings (suggest weekly) through the duration of the project.
      5. Ask the CPO to craft, outside this meeting, his/her version of the "Message from the chief product officer.”
      6. If a Guided Implementation is selected, inform the meeting attendees that a SoftwareReviews analyst will join the next meeting to share his/her Executive Brief on Pricing Strategy.
    2. Record all above findings in the Optimize Software Pricing in a Volatile Competitive Market Presentation Template.

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    SoftwareReviews Advisory Insight:

    Pricing steering committees are needed to steer overall product, pricing, and packaging decisions. Some companies include the CEO and CFO on this committee and designate it as a permanent body that meets monthly to give go/no-go decisions to “all things product and pricing related” across all products and business units.

    2.0 Educate the team

    1 hour

    Input: Typically, a joint recognition that pricing strategies need upgrading and have not been fully documented, Steering committee and working team members

    Output: Communication of team members involved and the makeup of the steering committee and working team, Alignment of team members on a shared vision of “why a new price strategy is critical” and what key attributes define both the need and impact on business

    Materials: Optimize Your Software Strategy Executive Brief PowerPoint presentation

    Participants: Initiative manager – individual leading the new pricing strategy, CFO/sponsoring executive, Working team – typically representatives in product marketing, product management, and sales, SoftwareReviews marketing analyst (optional)

    1. Walk the team through the Optimize Software Pricing in a Volatile Competitive Market Executive Brief PowerPoint presentation.
    2. Optional – Have the SoftwareReviews Advisory (SRA) analyst walk the team through the Optimize Software Pricing in a Volatile Competitive Market Executive Brief PowerPoint presentation as part of your session. Contact your engagement manager to schedule.
    3. Walk the team through the current version of the Optimize Software Pricing in a Volatile Competitive Market Presentation Template outlining project goals, steering committee and workstream make-up and responsibilities, project timeline and key milestones, and approach to arriving at new product pricing.
    4. Set expectations among team members of their specific roles and responsibilities for this project, review the frequency of steering committee and workstream meetings to set expectations of key milestones and deliverable due dates.

    Download the Optimize Software Pricing in a Volatile Competitive Market Executive Brief

    3.0 Document portfolio and target products for pricing update

    1-3 Hours

    Input: List of entire product portfolio

    Output: Prioritized list of product candidates that should be repriced

    Materials: Optimize Software Pricing in a Volatile Competitive Market Executive Brief presentation, Optimize Software Pricing in a Volatile Competitive Market Workbook

    Participants: Initiative manager – individual leading the new pricing strategy, CFO/sponsoring executive, Working team – typically representatives in product marketing, product management, and sales

    1. Walk the team through the current version of Optimize Software Pricing in a Volatile Competitive Market workbook, tab 2: “Product Portfolio Organizer.” Modify sample attributes to match your product line where necessary.
    2. As a group, record the product attributes for your entire portfolio.
    3. Prioritize the product price optimization candidates for repricing with the understanding that it might change after meeting with finance.

    Download the Optimize Software Pricing in a Volatile Competitive Market Workbook

    4.0 Clarify product target margins

    2-3 sessions of 1 Hour each

    Input: Finance partner/CFO knowledge of target product current and future margins, Finance partner/CFO who has information on underlying costs with details that illustrate supplier contributions

    Output: Product finance markup target percentage margins and revenues

    Materials: Finance data on the product family, Optimize Software Pricing in a Volatile Competitive Market Workbook, Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: Initiative manager, Finance partner/CFO

    1. Schedule a meeting with your finance partner/CFO to validate expectations for product margins. The goal is to understand the detail of underlying costs/margins and if the impacts of supplier costs affect the product family. The information will be placed into the Optimize Software Pricing in a Volatile Competitive Market Workbook on tab 2, Product Portfolio Organizer under the “Unit Margins” heading.
    2. Arrive at a final “Cost-Plus New Price” based on underlying costs and target margins for each of the products. Record results in the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 2, under the “Cost-Plus New Price” heading.
    3. Record product target finance markup price under “Cost-Plus” in Optimize Software Pricing in a Volatile Competitive Market Presentation Template, slide 9, and details in Appendix, “Cost-Plus Analysis,” slide 11.
    4. Repeat this process for any other products to be repriced.

    Download the Optimize Software Pricing in a Volatile Competitive Market Workbook

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    5.0 Establish customer price to value

    1-4 weeks

    Input: Identify segments within which you require price-to-value information, Understand your persona insight gaps, Review Sample Interview Guide using the Optimize Software Pricing in a Volatile, Competitive Market Workbook, Tab 4. Interview Guide.

    Output: List of interviewees, Updated Interview Guide

    Materials: Optimize Software Pricing in a Volatile Competitive Market Workbook, Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: Initiative manager, Customer success to help identify interviewees, Customers, prospects

    1. Identify a list of customers and prospects that best represent your target persona when interviewed. Choose interviewees who will inform key differences among key segments (geographies, company size, a mix of customers and prospects, etc.) and who are decision makers and can best inform insights on price/value and competitors.
    2. Recruit interviewees and schedule 30-minute interviews.
    3. Keep track of interviewees using the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 3: “Interviewee Tracking.”
    4. Review the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 4: “Interview Guide,” and modify/update it where appropriate.
    5. Record interviewee perspectives on the “price they are willing to pay for the value received” (price/value equation) using the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 4: “Interview Guide.”
    6. Summarize findings to result in an average “customer’s value price.” Record product target ”customer’s value price” in Optimize Software Pricing in a Volatile Competitive Market Presentation Template, slide 9 and supporting details in Appendix, “Customer Pricing Analysis,” slide 12.

    Download the Optimize Software Pricing in a Volatile Competitive Market Workbook

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    6.0 Identify competitive pricing

    1-2 weeks

    Input: Identify price candidate competitors, Your product pricing, contract type, and product attribute information to compare against, Knowledge of existing competitor information, websites, and technology research sites to guide questions

    Output: Competitive product average pricing

    Materials: Optimize Software Pricing in a Volatile Competitive Market Workbook, Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: Initiative manager, Customers, prospects

    1. Identify the top 3-5 competitors’ products that you most frequently compete against with your selected product.
    2. Perform competitive intelligence research on deals won or lost that contain competitive pricing insights by speaking with your sales force.
    3. Use the interviews with key customers to also inform competitive pricing insights. Include companies which you may have lost to a competitor in your customer interviewee list.
    4. Modify and add key competitive pricing, contract, or product attributes in the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 5: “Competitive Information.”
    5. Place your product’s information into the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 5: “Competitive Information.”
    6. Research your competitors’ summarized pricing and product attribute insights into the workbook.
    7. Record research in the Summarize research on competitors to arrive at an average “Competitors Avg. Price”. Record in ”Customer’s Value Price” in Optimize Software Pricing in a Volatile Competitive Market Presentation Template, slide 9, and details in Appendix, “Competitor Pricing Analysis,” slide 13.

    Download the Optimize Software Pricing in a Volatile Competitive Market Workbook

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    7.0 Establish new price and gain buy-in

    2-3 hours

    Input: Findings from competitive, cost-plus, and customer price/value analysis

    Output: Approvals for price change

    Materials: Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: Initiative manager, Steering committee, Working team – typically representatives in product marketing, product management, sales

    1. Using prior recorded findings of Customer’s Value Price, Competitors’ Avg. Price, and Finance Markup Price, arrive at a recommended “New Price” and record in Optimize Software Pricing in a Volatile Competitive Market Presentation Template, slide 9 and the Appendix for Project Analysis Details.
    2. Present findings to steering committee. Be prepared to show customer interviews and competitive analysis results to support your recommendation.
    3. Plan internal and external communications and discuss the timing of when to “go live” with new pricing. Discuss issues related to migration to a new price, how to handle currently low-priced customers, and how to migrate them over time to the new pricing.
    4. Identify if it makes sense to target a date to launch the new pricing in the future, so customers can be alerted in advance and therefore take advantage of “current pricing” to drive added revenues.
    5. Confer with IT to assess times required to implement within CPQ systems and with product marketing for time to change sales proposals, slide decks, and any other affected assets and systems.

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Summary of Accomplishment

    Problem Solved

    With the help of this blueprint, you have deepened your and your company’s understanding of how to look at new pricing opportunities and what the market and the buyer will pay for your product. You are among the minority of product and marketing leaders that have thoroughly documented their new pricing strategy and processes – congratulations!

    The benefits of having led your team through the process are significant and include the following:

    • Allow for faster, more accurate intake of customer and competitive data 
    • Refine the ability to effectively target pricing to specific market demands and customer segments 
    • Understand the association between the value proposition of products and services
    • Reduce financial costs and mistakes associated with manual efforts & uneducated guessing
    • Recognize and plan for new revenue opportunities or cost increases
    • Create new market or product packaging opportunities
    And finally, by bringing your team along with you in this process, you have also led your team to become more customer-focused while pricing your products – a strategic shift that all organizations should pursue.

    If you would like additional support, contact us and we’ll make sure you get the professional expertise you need.

    Contact your account representative for more information.

    info@softwarereviews.com
    1-888-670-8889

    Bibliography

    “Chapter 4 Reasons for Project Failure.” Kissflow's Guide to Project Management. Kissflow, n.d. Web.

    Edie, Naomi. “Microsoft Is Raising SaaS Prices, and Other Vendors Will, Too.” CIO Dive, 8 December 2021. Web.

    Gruman, Galen, Alan S. Morrison, and Terril A. Retter. “Software Pricing Trends.” PricewaterhouseCoopers, 2018. Web.

    Hargrave, Marshall. “Example of Economic Exposure.” Investopedia, 12 April 2022. Web.

    Heaslip, Emily. “7 Smart Pricing Strategies to Attract Customers.” CO—, 17 November 2021. Web.

    Higgins, Sean. “How to Price a Product That Your Sales Team Can Sell.” HubSpot, 4 April 2022. Web.

    “Pricing Strategies.” Growth Ramp, March 2022. Web.

    “Product Management Skills Benchmark Report 2021.” 280 Group, 9 November 2021. Web.

    Quey, Jason. “Price Increase: How to Do a SaaS Pricing Change in 8 Steps.” Growth Ramp, 22 March 2021. Web.

    Steenburg, Thomas, and Jill Avery. “Marketing Analysis Toolkit: Pricing and Profitability Analysis.” Harvard Business School, 16 July 2010. Web.

    “2021 State of Competitive Intelligence.” Crayon and SCIO, n.d. Web.

    Valchev, Konstantin. “Cost of Goods Sold (COGS) for Software-as-a-Service (SaaS) Business.” OpenView Venture Partners, OV Blog, 20 April 2020. Web.

    “What Is Price Elasticity?” Market Business News, n.d. Web.

    Develop a Cloud Testing Strategy for Today's Apps

    • Buy Link or Shortcode: {j2store}470|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Cloud Strategy
    • Parent Category Link: /cloud-strategy
    • The growth of the Cloud and the evolution of business operations have shown that traditional testing strategies do not work well with modern applications.
    • Organizations require a new framework around testing cloud applications that account for on-demand scalability and self-provisioning.
    • Expectations of application consumers are continually increasing with speed-to-market and quality being the norm.

    Our Advice

    Critical Insight

    • Cloud technology does not change the traditional testing processes that many organizations have accepted and adopted. It does, however, enhance traditional practices with increased replication capacity, execution speed, and compatibility through its virtual infrastructure and automated processes. Consider these factors when developing the cloud testing strategy.
    • Involving the business in strategy development will keep them engaged and align business drivers with technical initiatives.
    • Implement cloud testing solutions in a well-defined rollout process to ensure business objectives are realized and cloud testing initiatives are optimized.
    • Cloud testing is green and dynamic. Realize the limitations of cloud testing and play on its strengths.

    Impact and Result

    • Engaging in a formal and standardized cloud testing strategy and consistently meeting business needs throughout the organization maintains business buy-in.
    • The Cloud compounds the benefits from virtualization and automation because of the Cloud’s scalability, speed, and off-premise and virtual infrastructure and data storage attributes.
    • Cloud testing presents a new testing avenue. Realize that only certain tests are optimized in the Cloud, i.e., load, stress, and functional testing.

    Develop a Cloud Testing Strategy for Today's Apps Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Develop a cloud testing strategy.

    Obtain organizational buy-ins and build a standardized and formal cloud testing strategy.

    • Storyboard: Develop a Cloud Testing Strategy for Today's Apps
    • None

    2. Assess the organization's readiness for cloud testing.

    Assess your people, process, and technology for cloud testing readiness and realize areas for improvement.

    • Cloud Testing Readiness Assessment Tool

    3. Plan and manage the resources allocated to each project task.

    Organize and monitor cloud project planning tasks throughout the project's duration.

    • Cloud Testing Project Planning and Monitoring Tool
    [infographic]

    Organizational Change Management

    • Buy Link or Shortcode: {j2store}35|cart{/j2store}
    • Related Products: {j2store}35|crosssells{/j2store}
    • member rating overall impact: 9.6/10
    • member rating average dollars saved: $19,055
    • member rating average days saved: 24
    • Parent Category Name: Project Portfolio Management and Projects
    • Parent Category Link: /ppm-and-projects
    If you don't know who is responsible for organizational change, it's you.

    Prepare Your Organization to Successfully Embrace the “New Normal”

    • Buy Link or Shortcode: {j2store}422|cart{/j2store}
    • member rating overall impact: 9.3/10 Overall Impact
    • member rating average dollars saved: $61,749 Average $ Saved
    • member rating average days saved: 2 Average Days Saved
    • Parent Category Name: DR and Business Continuity
    • Parent Category Link: /business-continuity
    • The COVID-19 pandemic is creating significant challenges across every sector, but even the deepest crisis will eventually pass. However, many of the changes it has brought to how organizations function are here to stay.
    • As an IT leader, it can be challenging to envision what this future state will look like and how to position IT as a trusted partner to the business to help steer the ship as the crisis abates.

    Our Advice

    Critical Insight

    • Organizations need to cast their gaze into the “New Normal” and determine an appropriate strategy to stabilize their operations, mitigate ongoing challenges, and seize new opportunities that will be presented in a post-COVID-19 world.
    • IT needs to understand the key trends and permanent changes that will exist following the crisis and develop a proactive roadmap for rapidly adapting their technology stack, processes, and resourcing to adjust to the new normal.

    Impact and Result

    • Info-Tech recommends a three-step approach for adapting to the new normal: begin by surveying crucial changes that will occur as a result of the COVID-19 pandemic, assess their relevance to your organization’s unique situation, and create an initiatives roadmap to support the new normal.
    • This mini-blueprint will examine five key themes: changing paradigms for remote work, new product delivery models, more self-service options for customers, greater decentralization and agility for organizational decision making, and a renewed emphasis on security architecture.

    Prepare Your Organization to Successfully Embrace the “New Normal” Research & Tools

    Read the Research

    Understand the five key trends that will persist after the pandemic has passed and create a roadmap of initiatives to help your organization adapt to the "New Normal."

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Prepare Your Organization to Successfully Embrace the “New Normal” Storyboard
    [infographic]

    Position IT to Support and Be a Leader in Open Data Initiatives

    • Buy Link or Shortcode: {j2store}326|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
    • member rating average days saved: Read what our members are saying
    • Parent Category Name: Innovation
    • Parent Category Link: /innovation
    • Open data programs are often seen as unimportant or not worth taking up space in the budget in local government.
    • Open data programs are typically owned by a single open data evangelist who works on it as a side-of-desk project.
    • Having a single resource spend a portion of their time on open data doesn’t allow the open data program to mature to the point that local governments are realizing benefits from it.
    • It is difficult to gain buy-in for open data as it is hard to track the benefits of an open data program.

    Our Advice

    Critical Insight

    • Local government can help push the world towards being more open, unlocking economic benefits for the wider economy.
    • Cities don’t know the solutions to all of their problems often they don’t know all of the problems they have. Release data as a platform to crowdsource solutions and engage your community.
    • Build your open data policies in collaboration with the community. It’s their data, let them shape the way it’s used!

    Impact and Result

    • Level-set expectations for your open data program. Every local government is different in terms of the benefits they can achieve with open data; ensure the business understands what is realistic to achieve.
    • Create a team of open data champions from departments outside of IT. Identify potential champions for the team and use this group to help gain greater business buy-in and gather feedback on the program’s direction.
    • Follow the open data maturity model in order to assess your current state, identify a target state, and assess capability gaps that need to be improved upon.
    • Use industry best practices to develop an open data policy and processes to help improve maturity of the open data program and reach your desired target state.
    • Identify metrics that you can use to track, and communicate the success of, the open data program.

    Position IT to Support and Be a Leader in Open Data Initiatives Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should develop your open data program, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Set the foundation for the success of your open data program

    Identify your open data program's current state maturity, and gain buy-in from the business for the program.

    • Position IT to Support and Be a Leader in Open Data Initiatives – Phase 1: Set the Foundation for the Success of Your Open Data Program
    • Open Data Maturity Assessment
    • Open Data Program – IT Stakeholder Powermap Template
    • Open Data in Our City Stakeholder Presentation Template

    2. Grow the maturity of your open data program

    Identify a target state maturity and reach it through building a policy and processes and the use of metrics.

    • Position IT to Support and Be a Leader in Open Data Initiatives – Phase 2: Grow the Maturity of Your Open Data Program
    • Open Data Policy Template
    • Open Data Process Template
    • Open Data Process Descriptions Template
    • Open Data Process Visio Templates (Visio)
    • Open Data Process Visio Templates (PDF)
    • Open Data Metrics Template
    [infographic]

    Workshop: Position IT to Support and Be a Leader in Open Data Initiatives

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Define Business Drivers for Open Data Program

    The Purpose

    Ensure that the open data program is being driven out from the business in order to gain business support.

    Key Benefits Achieved

    Identify drivers for the open data program that are coming directly from the business.

    Activities

    1.1 Understand constraints for the open data program.

    1.2 Conduct interviews with the business to gain input on business drivers and level-set expectations.

    1.3 Develop list of business drivers for open data.

    Outputs

    Defined list of business drivers for the open data program

    2 Assess Current State and Define Target State of the Open Data Program

    The Purpose

    Understand the gaps between where your program currently is and where you want it to be.

    Key Benefits Achieved

    Identify top processes for improvement in order to bring the open data program to the desired target state maturity.

    Activities

    2.1 Perform current state maturity assessment.

    2.2 Define desired target state with business input.

    2.3 Highlight gaps between current and target state.

    Outputs

    Defined current state maturity

    Identified target state maturity

    List of top processes to improve in order to reach target state maturity

    3 Develop an Open Data Policy

    The Purpose

    Develop a draft open data policy that will give you a starting point when building your policy with the community.

    Key Benefits Achieved

    A draft open data policy will be developed that is based on best-practice standards.

    Activities

    3.1 Define the purpose of the open data policy.

    3.2 Establish principles for the open data program.

    3.3 Develop a rough governance outline.

    3.4 Create a draft open data policy document based on industry best-practice examples.

    Outputs

    Initial draft of open data policy

    4 Develop Open Processes and Identify Metrics

    The Purpose

    Build open data processes and identify metrics for the program in order to track benefits realization.

    Key Benefits Achieved

    Formalize processes to set in place to improve the maturity of the open data program.

    Identify metrics that can track the success of the open data program.

    Activities

    4.1 Develop the roles that will make up the open data program.

    4.2 Create processes for new dataset requests, updates of existing datasets, and the retiring of datasets.

    4.3 Identify metrics that will be used for measuring the success of the open data program.

    Outputs

    Initial draft of open data processes

    Established metrics for the open data program

    Build a Platform-Based Organization

    • Buy Link or Shortcode: {j2store}98|cart{/j2store}
    • member rating overall impact: 8.0/10 Overall Impact
    • member rating average dollars saved: $3,420 Average $ Saved
    • member rating average days saved: 2 Average Days Saved
    • Parent Category Name: Innovation
    • Parent Category Link: /innovation
    • The organization is riddled with bureaucracy. Some even believe that bureaucracy is inevitable and is an outcome of a complex business operating in a complex market and regulatory environment.
    • Time to market for new products and services is excruciatingly long.
    • Digital natives like Facebook, Netflix, and Spotify do not compare well with the organization and cannot be looked to for inspiration.

    Our Advice

    Critical Insight

    • Large corporations often consist of a few operating units, each with its own idiosyncracies about strategies, culture, and capabilities. These tightly integrated operating units make a company prone to bureaucracy.
    • The antidote to this bureaucracy is a platform structure: small, autonomous teams operating as startups within the organization.

    Impact and Result

    • Platforms consist of related activities and associated technologies that deliver on a specific organizational goal. A platform can therefore be run as a business or as a service. This structure of small autonomous teams that are loosely joined will make your employees directly accountable to the customers. In a way, they become entrepreneurs and do not remain just employees.

    Build a Platform-Based Organization Research & Tools

    Build a platform-based organization

    Download our guide to learn how you can get started with a platform structure.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Build a Platform-Based Organization Storyboard
    [infographic]

    Further reading

    Build a Platform-Based Organization

    Use a platform structure to overcome bureaucracy.

    Analyst Perspective

    Build a platform-based organization.

    Bureaucracy saps innovation out of large corporations. Some even believe that bureaucracy is inevitable and is an outcome of a complex business operating in a complex market and regulatory environment.

    So, what is the antidote to bureaucracy? Some look to startups like Uber, Airbnb, Netflix, and Spotify, but they are digital native and don’t compare well to a large monolithic corporation.

    However, all is not lost for large corporations. Inspiration can be drawn from a company in China – Haier, which is not a typical poster child of the digital age like Spotify. In fact, three decades ago, it was a state-owned company with a shoddy product quality.

    Haier uses an intriguing organization structure based on microenterprises and platforms that has proven to be an antidote to bureaucracy.

    Vivek Mehta
    Research Director, Digital & Innovation
    Info-Tech Research Group

    Executive Summary

    The Challenge

    Large corporations are prone to bureaucracies, which sap their organizations of creativity and make them blind to new opportunities. Though many executives express the desire to get rid of it, bureaucracy is thriving in their organizations.

    Why It Happens

    As organizations grow and become more complex over time, they yearn for efficiency and control. Some believe bureaucracy is the natural outcome of running a complex organization in a complex business and regulatory environment.

    Info-Tech’s Approach

    A new organizational form – the platform structure – is challenging the bureaucratic model. The platform structure makes employees directly accountable to customers and organizes them in an ecosystem of autonomous units.

    As a starting point, sketch out a platform structure that works for your organization. Then, establish a governance model and identify and nurture key capabilities for the platform structure.

    Info-Tech Insight

    The antidote to bureaucracy is a platform structure: small, autonomous teams operating as startups within the organization.

    Executive Brief Case Study

    Small pieces, loosely joined

    Haier

    Industry: Manufacturing
    Source: Harvard Business Review November-December 2018

    Haier, based in China, is currently the world’s largest appliance maker. Zhang Ruimin, Haier’s CEO, has built an intriguing organizing structure where every employee is directly accountable to customers – internal and/or external. A large corporation often consists of a few operating units, each with its own idiosyncrasies, which makes it slow to innovate. To avoid that, Haier has divided itself into 4,000 microenterprises (MEs), most of which have ten to 15 employees. There are three types of microenterprises in Haier:

    1. Approximately 200 “transforming” MEs: market-facing units like Zhisheng, which manufactures refrigerators, a legacy Haier product, for today’s young urbanites.
    2. Approximately 50 “incubating” MEs: entirely new businesses like Xinchu that wrap existing products into entirely new business models.
    3. Approximately 3,800 “node” MEs: units that sell component products and services such as design, manufacturing, and human resources support to Haier’s market-facing MEs.

    Each ME operates as an autonomous unit with its own targets – an organizing structure that enables innovation at Haier.

    (Harvard Business Review, 2018)

    The image is a rectangular graphic with the words Refrigeration Platform in the centre. There are six text boxes around the centre, reading (clockwise from top left): Zhisheng Young urbanites; Langdu Premium; Jinchu Mid-priced; Xinchu Internet-connected; Overseas Export markets; Leader Value-priced. There are a series of white boxes bordering the graphic, with the following labels: at top--Sales nodes; at right--Support nodes (R&D, HR, supply chain, etc.); at bottom left---Design nodes; at bottom right--Production nodes.

    Markets disproportionately reward platform structure

    Tech companies like Facebook, Netflix, and Spotify are organized around a set of modular platforms run by accountable platform teams. This modular org structure enables them to experiment, learn, and scale quickly – a key attribute of innovative organizations.

    Facebook ~2,603 million monthly active users

    India ~1,353 million population

    Netflix ~183 million monthly paid subscribers

    Spotify ~130 million premium subscribers

    Canada ~37 million population

    (“Facebook Users Worldwide 2020,” “Number of Netflix Subscribers 2019,” “Spotify Users - Subscribers in 2020,” Statista.)

    1. Sketch Out the Platform Structure

    What is a platform anyway?

    A modular component of an org structure

    Platforms consist of a logical cluster of activities and associated technology that delivers on a specific business goal and can therefore be run as a business, or ‘as a service’ … Platforms focus on business solutions to serve clients (internal or external) and to supply other platforms.” – McKinsey, 2019

    Platforms operate as independent units with their own business, technology, governance, processes, and people management. As an instance, a bank could have payments platform under a joint business and IT leadership. This payments-as-a-service platform could provide know-how, processes, and technology to the bank’s internal customers such as retail and commercial business units.

    Many leading IT organizations are set up in a platform-based structure that allows them to rapidly innovate. It’s an imperative for organizations in other industries that they must pilot and then scale with a platform play.

    What a platform-based org looks like

    It looks like a multicellular organism, where each cell is akin to a platform

    An organism consists of multiple cells of different types, sizes, and shapes. Each cell is independent in its working. Regardless of the type, a cell would have three features –the nucleus, the cell membrane, and, between the two, the cytoplasm.

    Similarly, an organization could be imagined as one consisting of several platforms of different types and sizes. Each platform must be autonomous, but they all share a few common features – have a platform leader, set up and monitor targets, and enable interoperability amongst platforms. Platforms could be of three types (McKinsey, 2019):

    1. Customer-journey platforms enable customer proposition and experience built on reusable code. They provide “journey as a service”; for example, Account Opening in a bank.
    2. Business-solution platforms are modular and run as a business or as a service. They provide “company as a service”; for example, Payments or Fraud Detection in a bank.
    3. Core IT provisioning platforms provide core IT services for the organization, for example, cloud, data, automation.

    There are two images: in the lower part of the graphic shows a multicellular organism, and has text pointing to a single cell. At the top, there is a zoomed in image of that single cell, with its component parts labelled: Cell Membrane, Nucleus, and Cytoplasm.

    Case study: Payments platform in a bank

    Payments as a service to internal business units

    The payments platform is led by an SVP – the platform leader. Business and IT teams are colocated and have joint leadership. The platform team works with a mindset of a startup, serving internal customers of the bank – retail and commercial lines of business.

    A diagram showing Advisory Council in a large grey box on the left. To the right are smaller dark blue boxes labeled 'Real-time peer-to-peer payments,' Wire transfers,' 'Batch payments,' 'Mobile wallets,' and 'International payments (VISA, WU, etc.),' and one light blue box labeled 'Payments innovation.'


    Advisory Council: An Advisory Council is responsible for strategy, business, and IT architecture and for overseeing the work within the team. The Advisory Council prioritizes the work, earmarks project budgets, sets standards such as for APIs and ISO 20022, and leads vendor evaluation.

    International payments (VISA, WU, etc.): Project execution teams are structured around payment modes. Teams collaborate with each other whenever a common functionality is to be developed, like fraud check on a payment or account posting for debits and credits.

    Payments innovation: A think tank keeping track of trends in payments and conducting proof of concepts (POCs) with prospective fintech partners and with new technologies.

    Use a capability map to sketch out a platform-based structure

    Corral your organization’s activities and associated tech into a set of 20 to 40 platforms that cover customer journeys, business capabilities, and core IT. Business and IT teams must jointly work on this activity and could use a capability map as an aid to facilitate the discussion.

    The image is an example of a capability map, shown in more detail in the following section.

    An example of sketching a platform-based org structure for an insurance provider (partial)

    Design Policy Create Policy Issue Policy Service Customers Process Claims Manage Investments
    Defining Market Research & Analysis Underwriting Criteria Selection Customer Targeting Interaction Management First Notice of Loss (FNOL) Investment Strategy
    Actuarial Analysis Product Reserving Needs Assessment & Quotes Payments Claims Investigation Portfolio Management
    Catastrophe Risk Modeling Reinsurance Strategy Contract Issuance Adjustments Claims Adjudication Deposits & Disbursements
    Product Portfolio Strategy Product Prototyping Application Management Renewals Claims Recovery (Subrogation) Cash & Liquidity Management
    Rate Making Product Testing Sales Execution Offboarding Dispute Resolution Capital Allocation
    Policy Definition Product Marketing Contract Change Management

    Customer Retention

    [Servicing a customer request is a customer-journey platform.]

    Claims Inquiry

    [Filing a claim is a customer-journey platform.]

    Credit Bureau Reporting
    Shared Customer Management

    Account Management

    [Customer and account management is a business-capability platform to enable journeys.]

    Channel Management Risk Management Regulatory & Compliance Knowledge Management
    Partner Management

    Access and Identity Management

    [Access and identity management is a core IT platform.]

    Change Management Enterprise Data Management Fraud Detection [Fraud detection is a business-capability platform to enable journeys.] Product Innovation
    Enabling Corporate Governance Strategic Planning Reporting Accounting Enterprise Architecture Human Resources
    Legal Corporate Finance IT Facilities Management

    2. Establish Governance and Nurture Key Capabilities

    Two ingredients of the platform structure

    Establish a governance

    Advisory Council (AC) operates like a conductor at an orchestra, looking across all the activities to understand and manage the individual components.

    Nurture key capabilities

    Team structure, processes and technologies must be thoughtfully orchestrated and nurtured.

    Establish strong governance

    Empowerment does not mean anarchy

    While platforms are distinct units, they must be in sync with each other, like individual musicians in an orchestra. The Advisory Council (AC) must act like a conductor of the orchestra and lead and manage across platforms in three ways.

    1. Prioritize spend and effort. The AC team makes allocation decisions and prioritizes spend and effort on those platforms that can best support organizational goals and/or are in most urgent technical need. The best AC teams have enterprise architects who can understand business and dive deep enough into IT to manage critical interdependencies.
    2. Set and enforce standards. The AC team establishes both business and technology standards for interoperability. For example, the AC team can set the platform and application interfaces standards and the industry standards like ISO 20022 for payments. The AC team can also provide guidance on common apps and tools to use, for example, a reconciliation system for payments.
    3. Facilitate cross-platform work. The AC team has a unique vantage point where it can view and manage interdependencies among programs. As these complexities emerge, the AC team can step in and facilitate the interaction among the involved platform teams. In cases when a common capability is required by multiple platforms, the AC team can facilitate the dialogue to have it built out.

    Nurture the following capabilities:

    Design thinking

    “Zero distance from the customer” is the focus of platform structure. Each platform must operate with a mindset of a startup serving internal and/or external users.

    Agile delivery model

    Platform teams iteratively develop their offerings. With guidance from Advisory Council, they can avoid bottlenecks of formal alignment and approvals.

    Enterprise architecture

    The raison d'être of enterprise architecture discipline is to enable modularity in the architecture, encourage reusability of assets, and simplify design.

    Microservices

    Microservices allow systems to grow with strong cohesion and weak coupling and enable teams to scale components independently.

    APIs

    With their ability to link systems and data, APIs play a crucial role in making IT systems more responsive and adaptable.

    Machine learning

    With the drop in its cost, predictability is becoming the new electricity for business. Platforms use machine learning capability for better predictions.

    Related Info-Tech Research

    Drive Digital Transformation With Platform Strategies
    Innovate and transform your business models with digital platforms.

    Implement Agile Practices That Work
    Guide your organization through its Agile transformation journey.

    Design a Customer-Centric Digital Operating Model
    Putting the customer at the center of digital transformation.

    Bibliography

    Bossert, Oliver, and Jürgen Laartz. “Perpetual Evolution—the Management Approach Required for Digital Transformation.” McKinsey, 5 June 2017. Accessed 21 May 2020.

    Bossert, Oliver, and Driek Desmet. “The Platform Play: How to Operate like a Tech Company.” McKinsey, 28 Feb. 2019. Accessed 21 May 2020.

    “Facebook Users Worldwide 2020.” Statista. Accessed 21 May 2020.

    Hamel, Gary, and Michele Zanini. “The End of Bureaucracy.” Harvard Business Review. Nov.-Dec. 2018. Accessed 21 May 2020.

    “Number of Netflix Subscribers 2019.” Statista. Accessed 21 May 2020.

    “Spotify Users - Subscribers in 2020.” Statista. Accessed 21 May 2020.

    Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management

    • Buy Link or Shortcode: {j2store}209|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Vendor Management
    • Parent Category Link: /vendor-management

    • Moreso than at any other time, our world is changing. As a result, organizations – and their vendors – need to be able to adapt their plans to accommodate risk on an unprecedented level.
    • It is increasingly likely that one of an organization's vendors, or their n-party support vendors, will cause an incident. Organizations must protect themselves by creating better mechanisms to hold their n-party vendors accountable and validate that they comply.

    Our Advice

    Critical Insight

    • Identifying and managing a vendor’s potential risk impact on your organization requires multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how these changes may affect your organization.
    • Organizational leadership is often taken unaware by changes, and their plans lack the flexibility to adjust to significant regulatory upheavals.

    Impact and Result

    • Vendor management practices educate organizations on the different potential risks from vendors in your market and suggest creative and alternative ways to avoid and help manage them.
    • Prioritize and classify your vendors with quantifiable, standardized rankings.
    • Prioritize focus on your high-risk vendors.
    • Standardize your processes for identifying and monitoring vendor risks with our Comprehensive Risk Impact Tool to manage potential impacts.

    Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management – Use the research to better understand the negative impacts of vendor actions to your organization

    Use this research to identify and quantify the potential risk impacts caused by vendors. Utilize Info-Tech's approach to look at the impact from various perspectives to better prepare for issues that may arise.

    • Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management Storyboard

    2. Comprehensive Risk Impact Tool – Use this tool to help identify and quantify the impacts of negative vendor actions.

    By playing the “what if” game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

    • Comprehensive Risk Impact Tool
    [infographic]

    Further reading

    Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management

    Approach vendor risk impact assessments from all perspectives.

    Analyst Perspective

    Organizations must comprehensively understand the impacts vendors may cause through different potential actions.

    Frank Sewell

    The risks from the vendor market have become more prevalent as the technologies and organizational strategies shift to a global direction. With this shift in risk comes a necessary perspective change to align with the greater likelihood of an incident occurring from vendors' (or one of their downstream support vendor's) negative actions.

    Organizational leadership must become more aware of the increasing risks that engaging vendors impose. To do so, they need to make informed decisions, which can only be provided by engaging expert resources in their organizations to compile a comprehensive look at potential risk impacts.

    Frank Sewell

    Research Director, Vendor Management
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    More so than at any other time, our world is changing. As a result organizations – and their vendors – need to be able to adapt their plans to accommodate risk on an unprecedented level.

    It is increasingly likely that one of your vendors, or their n-party support vendors, will cause an incident. Organizations must protect themselves by creating better mechanisms to hold their n-party vendors accountable and validate that they comply.

    Common Obstacles

    Identifying and managing a vendor’s potential risk impact on your organization requires multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how these changes may affect your organization.

    Organizational leadership is often taken unaware by changes, and their plans lack the flexibility to adjust to significant regulatory upheavals.

    Info-Tech's Approach

    Vendor management practices educate organizations on the different potential risks from vendors in your market and suggest creative and alternative ways to avoid and help manage them.

    Prioritize and classify your vendors with quantifiable, standardized rankings.

    Prioritize focus on your high-risk vendors.

    Standardize your processes for identifying and monitoring vendor risks with our Comprehensive Risk Impact Tool to manage potential impacts.

    Info-Tech Insight

    Organizations must evolve their risk assessments to be more adaptive to respond to changes in the global market. Ongoing monitoring and continual assessment of vendors’ risks is crucial to avoiding negative impacts.

    Info-Tech’s multi-blueprint series on vendor risk assessment

    There are many individual components of vendor risk beyond cybersecurity.`

    6 components of vendor risk beyond cybersecurity.  Financial, Reputational, Operational, Strategic, Security, Regulatory & Compliance.

    This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.

    Out of Scope:
    This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.

    The world is constantly changing

    The IT market is constantly reacting to global influences. By anticipating changes, leaders can set expectations and work with their vendors to accommodate them.

    When the unexpected happens, being able to adapt quickly to new priorities ensures continued long-term business success.

    Below are some things no one expected to happen in the last few years:

    62%

    of IT professionals are more concerned about being a victim of ransomware than they were a year ago.

    Info-Tech Tech Trends Survey 2022

    82%

    of Microsoft non-essential employees shifted to working from home in 2020, joining the 18% already remote.

    Info-Tech Tech Trends Survey 2022

    89%

    of organizations invested in web conferencing technology to facilitate collaboration.

    Info-Tech Tech Trends Survey 2022

    Looking at Risk in a New Light:

    the 6 Pillars of Vendor Risk Management

    Vendor Risk

    • Financial

    • Strategic

    • Operational

    • Security

    • Reputational

    • Regulatory

    • Organizations must review their risk appetite and tolerance levels, considering their complete landscape.
    • Changing regulations, acquisitions, and events that affect global supply chains are current realities, not unlikely scenarios.
    • Prepare your vendor risk management for success using due diligence and scenario- based “What If” discussions to bring all the relevant parties to the table and educate your whole organization on risk factors.
    Assessing Financial Risk Impacts

    Strategic risks on a global scale

    Odds are at least one of these is currently affecting your strategic plans

    • Vendor Acquisitions
    • Global Pandemic
    • Global Shortages
    • Gas Prices
    • Poor Vendor Performance
    • Travel Bans
    • War
    • Natural Disasters
    • Supply Chain Disruptions
    • Security Incidents

    Make sure you have the right people at the table to identify and plan to manage impacts.

    Assess internal and external operational risk impacts

    Two sides of the same coin

    Internal

    • Poorly vetted supplemental staff
    • Bad system configurations
    • Lack of relevant skills
    • Poor vendor performance
    • Failure to follow established processes
    • Weak contractual accountability
    • Unsupportable or end-of-life system components

    External

    • Cyberattacks
    • Supply Chain Issues
    • Geo-Political Disruptions
    • Vendor Acquisitions
    • N-Party Non-Compliance
    • Vendor Fraud

    Operational risk is the risk of losses caused by flawed or failed processes, policies, systems, or events that disrupt business operations.

    Identify and manage security risk impacts on your organization

    Due diligence will enable successful outcomes

    • Poor vendor performance
    • Vendor acquisition
    • Supply chain disruptions and shortages
    • N-party risk
    • Third-party risk

    What your vendor associations say about you

    Reputations that affect your brand: Bad customer reviews, breach of data, poor security posture, negative news articles, public lawsuits, poor performance.

    Regulatory compliance

    Consider implementing vendor management initiatives and practices in your organization to help gain compliance with your expanding vendor landscape.

    Your organizational risks may be monitored but are your n-party vendors?

    6 components of vendor risk beyond cybersecurity.  Financial, Reputational, Operational, Strategic, Security, Regulatory & Compliance.

    Review your expectations with your vendors and hold them accountable

    Regulatory entities are looking beyond your organization’s internal compliance these days. Instead, they are more and more diving into your third-party and downstream relationships, particularly as awareness of downstream breaches increases globally.

    • Are you assessing your vendors regularly?
    • Are you validating those assessments?
    • Do your vendors have a map of their downstream support vendors?
    • Do they have the mechanisms to hold those downstream vendors accountable to your standards?

    Identify and manage risks

    Regulatory

    Regulatory agencies are putting more enforcement around ESG practices across the globe. As a result, organizations will need to monitor the changing regulations and validate that their vendors and n-party support vendors are adhering to these regulations or face penalties for non-compliance.

    Security-Data protection

    Data protection remains an issue. Organizations should ensure that the data their vendors obtain remains protected throughout the vendor’s lifecycle, including post-termination. Otherwise, they could be monitoring for a data breach in perpetuity.

    Mergers and acquisitions

    More prominent vendors continuously buy smaller companies to control the market in the IT industry. Organizations should put protections in their contracts to ensure that an IT vendor’s acquisition does not put them in a relationship with someone that could cause them an issue.

    Identify and manage risks

    Poor vendor performance

    Consider the impact of a vendor that fails to perform midway through the implementation. Organizations need to be able to manage the impact of replacing that vendor and cutting their losses rather than continuing to throw good money away after bad performance.

    Supply chain disruptions and global shortages

    Geopolitical disruptions and natural disasters have caused unprecedented interruptions to business. Incorporate forecasting of product and ongoing business continuity planning into your strategic plans to adapt as events unfold.

    Poorly configured systems

    Failing to ensure that your vendor-supported systems are properly configured and that your vendors are meeting your IT change control and configuration standards is more commonplace than expected. Proper oversight and management of your support vendors is crucial to ensure they are meeting expectations in this regard.

    What to look for

    Identify potential risk impacts

    • Is there a record of complaints against the vendor from their employees or customers?
    • Is the vendor financially sound, with the resources to support your needs?
    • Has the vendor been cited for regulatory compliance issues in the past?
    • Does the vendor have a comprehensive list of their n-party vendor partners?
      • Are they willing to accept appropriate contractual protections regarding them?
    • Does the vendor self-audit, or do they use a vetted third-party audit firm to issue a SOC report annually?
    • Does the vendor operate in regions known for instability?
    • Is the vendor willing to make concessions on contractual protections, or are they only offering one-sided agreements with as-is warranties?

    Prepare your vendor risk management for success

    Due diligence will enable successful outcomes.

    1. Obtain top-level buy-in; it is critical to success.
    2. Build enterprise risk management (ERM) through incremental improvement.
    3. Focus initial efforts on the “big wins” to prove the process works.
    4. Use existing resources.
    5. Build on any risk management activities that already exist in the organization.
    6. Socialize ERM throughout the organization to gain additional buy-in.
    7. Normalize the process long term with ongoing updates and continuing education for the organization.
    8. (Adapted from COSO)

    How to assess third-party risk

    1. Review organizational risks

      Understand the organizations risks to prepare for the “What If” game exercise.
    2. Identify and understand potential risks

      Play the “What If” game with the right people at the table.
    3. Create a risk profile packet for leadership

      Pull all the information together in a presentation document.
    4. Validate the risks

      Work with leadership to ensure that the proposed risks are in line with their thoughts.
    5. Plan to manage the risks

      Lower the overall risk potential by putting mitigations in place.
    6. Communicate the plan

      It is important not only to have a plan but also to socialize it in the organization for awareness.
    7. Enact the plan

      Once the plan is finalized and socialized, put it in place with continued monitoring for success.

    Adapted from Harvard Law School Forum on Corporate Governance

    Insight summary

    Risk impacts often come from unexpected places and have significant consequences.

    Knowing who your vendors are using for their support and supply chain could be crucial in eliminating the risk of non-compliance for your organization.

    Having a plan to identify and validate the regulatory compliance of your vendors is a must for any organization to avoid penalties.

    Insight 1

    Organizations’ strategic plans need to be adaptable to avoid vendors’ negative actions causing an expedited shift in priorities.

    For example, Philips’ recall of ventilators impacted its products and the availability of its competitors’ products as demand overwhelmed the market.

    Insight 2

    Organizations often fail to understand how n-party vendors could place them in non-compliance.

    Even if you know your complete third-party vendor landscape, you may not be aware of the downstream vendors in play. Ensure that you get visibility into this space as well, and hold your direct vendors accountable for the actions of their vendors.

    Insight 3

    Organizations need to know where their data lives and ensure it is protected.

    Make sure you know which vendors are accessing/storing your data, where they are keeping it, and that you can get it back and have the vendors destroy it when the relationship is over. Without adequate protections throughout the lifecycle of the vendor, you could be monitoring for breaches in perpetuity.

    Insight summary

    Assessing financial impacts is an ongoing, educative, and collaborative multidisciplinary process that vendor management initiatives are uniquely designed to coordinate and manage for organizations.

    Operational risk impacts often come from unexpected places and have unforeseen impacts. Knowing where your vendors place in critical business processes and those vendors' business continuity plans concerning your organization should be a priority for those managing the vendors.

    Insight 4

    Organizations need to learn how to assess the likelihood of potential risks in the rapidly changing online environments and recognize how their partnerships and subcontractors’ actions can affect their brand.

    For example, do you understand how a simple news article raises your profile for short-term and long-term adverse events?

    Insight 5

    Organizations fail to plan for vendor acquisitions appropriately.

    Vendors routinely get acquired in the IT space. Does your organization have appropriate safeguards from inadvertently entering a negative relationship? Do you have plans for replacing critical vendors purchased in such a manner?

    Insight 6

    Vendors are becoming more and more crucial to organizations’ overall operations, and most organizations have a poor understanding of the potential impacts they represent.

    Is your vendor solvent? Do they have enough staff to accommodate your needs? Has their long-term planning been affected by changes in the market? Are they unique in their space?

    Identifying vendor risk

    Who should be included in the discussion?

    • While it is true that executive-level leadership defines the strategy for an organization, it is vital for those making decisions to make informed decisions.
    • Getting input from operational experts at your organization will enhance your business's long-term potential for success.
    • Involving those who directly manage vendors and understand the market will aid operational experts in determining the forward path for relationships with your current vendors and identifying emerging potential strategic partners.
    • Make sure security, risk, and compliance are all at the table. These departments all look at risk from different angles for the business and give valuable insight collectively.
    • Organizations have a wealth of experience in their marketing departments that can help identify real-world scenarios of negative actions.

    See the blueprint Build an IT Risk Management Program

    Review your risk management plans for new risks on a regular basis.

    Keep in mind Risk =
    Likelihood x Impact

    (R=L*I).

    Impact (I) tends to remain the same, while Likelihood (L) is becoming closer to 100% as threat actors become more prevalent.

    Managing vendor risk impacts

    How could your vendors impact your organization?

    • Review vendors’ downstream connections to understand thoroughly who you are in business with
    • Institute continuous vendor lifecycle management
    • Develop IT risk governance and change control
    • Introduce continual risk assessment to monitor the relevant vendor markets
    • Monitor and schedule contract renewals and new service/module negotiations
    • Perform business alignment meetings to reassess relationships
    • Ensure strategic alignment in contracts
    • Review vendors’ business continuity plans and disaster recovery testing
    • Re-evaluate corporate policies frequently
    • Monitor your company’s and associated vendors’ online presence
    • Be adaptable and allow for innovations that arise from the current needs
      • Capture lessons learned from prior incidents to improve over time, and adjust your plans accordingly

    Organizations must review their risk appetite and tolerance levels, considering their complete landscape.

    Changing regulations, acquisitions, new security issues, and events that affect global supply chains are current realities, not unlikely scenarios.

    Ongoing Improvement

    Incorporating lessons learned.

    • Over time, despite everyone’s best observations and plans, incidents will catch us off guard.
    • When that happens, follow your incident response plans and act accordingly.
    • An essential step is to document what worked and what did not – collectively known as the “lessons learned.”
    • Use the lessons learned document to devise, incorporate, and enact a better risk management process.

    Sometimes disasters occur despite our best plans to manage them.

    When this happens, it is important to document the lessons learned and improve our plans going forward.

    The "what if" game

    1-3 hours

    Vendor management professionals are in an excellent position to help senior leadership identify and pull together resources across the organization to determine potential risks. By playing the "what if" game and asking probing questions to draw out – or eliminate – possible adverse outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

    1. Break into smaller groups (if too small, continue as a single group).
    2. Use the Comprehensive Risk Impact Tool to prompt discussion on potential risks. Keep this discussion flowing organically to explore all potentials but manage the overall process to keep the discussion pertinent and on track.
    3. Collect the outputs and ask the subject matter experts (SMEs) for management options for each one in order to present a comprehensive risk strategy. You will use this to educate senior leadership so that they can make an informed decision to accept or reject the solution.

    Download the Comprehensive Risk Impact Tool

    Input

    • List of identified potential risk scenarios scored by impact
    • List of potential mitigations of the scenarios to reduce the risk

    Output

    • Comprehensive risk profile on the specific vendor solution

    Materials

    • Whiteboard/flip charts
    • Comprehensive Risk Impact Tool to help drive discussion

    Participants

    • Vendor Management – Coordinator
    • Organizational Leadership
    • Operations Experts (SMEs)
    • Business Process Experts
    • Legal/Compliance/Risk Manager

    High risk example from tool

    High risk example from Tool.  Shows sample questions to ask to identify impacts, their associated score, weight, and comments or notes.

    Note: Even though a few items are “scored” they have not been added to the overall weight, signaling that the company has noted but does not necessarily hold them against the vendor.

    How to mitigate:

    • Contractually insist that the vendor have a third-party security audit performed annually with the stipulation that they will not denigrate below your acceptable standards.
    • At renewal negotiate better contractual terms and protections for your organization.

    Low risk example from tool

    Low risk example from Tool.  Shows sample questions to ask to identify impacts, their associated score, weight, and comments or notes.

    Summary

    Seek to understand all potential risk impacts to better prepare your organization for success.

    • Organizations need to understand and map out their entire vendor landscape.
    • Understand where all your data lives and how you can control it throughout the vendor lifecycle.
    • Organizations need to be realistic about the likelihood of potential risks in the changing global world.
    • Those organizations that consistently follow their established risk-assessment and due-diligence processes are better positioned to avoid penalties.
    • Understand how your vendors prioritize your organization in their business continuity processes.
    • Bring the right people to the table to outline potential risks in the market and your organization.
    • Socialize the third-party vendor risk management process throughout the organization to heighten awareness and enable employees to help protect the organization.
    • Organizations need to learn how to assess the likelihood of potential risks in the changing global markets and recognize how their partnerships and subcontracts affect their brand.
    • Incorporate lessons learned from prior incidents into your risk management process to build better plans for future issues.

    Organizations must evolve their risk assessments to be more meaningful to respond to global changes in the market.

    Organizations should increase the resources dedicated to monitoring the market as regulatory agencies continue to hold them more and more accountable.

    Bibliography

    Olaganathan, Rajee. “Impact of COVID-19 on airline industry and strategic plan for its recovery with special reference to data analytics technology.” Global Journal of Engineering and Technology Advances, vol 7, no 1, 2021, pp. 033-046.

    Tonello, Matteo. “Strategic Risk Management: A Primer for Directors.” Harvard Law School Forum on Corporate Governance, 23 Aug. 2012.

    Frigo, Mark L., and Richard J. Anderson. “Embracing Enterprise Risk Management: Practical Approaches for Getting Started.” COSO, 2011.

    Weak Cybersecurity is taking a toll on Small Businesses (tripwire.com)

    SecureLink 2022 White Paper SL_Page_EA+PAM (rocketcdn.me)

    Shared Assessments Member Poll March 2021 "Guide: Evolving Work Environments Impact of Covid-19 on Profile and Management of Third Parties“

    “Cybersecurity only the tip of the iceberg for third-party risk management”. Help Net Security, April 21, 2021. Accessed: 2022-07-29.

    “Third-Party Risk Management (TPRM) Managed Services”. Deloitte, 2022. Accessed: 2022-07-29.

    “The Future of TPRM: Third Party Risk Management Predictions for 2022”. OneTrust, December 20th2021. Accessed 2022-07-29.

    “Third Party Vendor definition”. Law Insider, Accessed 2022-07-29.

    “Third Party Risk”. AWAKE Security, Accessed 2022-07-29.

    Glidden, Donna. "Don't Underestimate the Need to Protect Your Brand in Publicity Clauses", Info-Tech Research Group, June 2022.

    Greenaway, Jordan. "Managing Reputation Risk: A start-to-finish guide", Transmission Private, July 2022. Accessed June 2022.

    Jagiello, Robert D, and Thomas T Hills. “Bad News Has Wings: Dread Risk Mediates Social Amplification in Risk Communication. ”Risk analysis : an official publication of the Society for Risk Analysis vol. 38,10 (2018): 2193-2207.doi:10.1111/risa.13117

    Kenton, Will. "Brand Recognition", Investopedia, August 2021. Accessed June 2022. Lischer, Brian. "How Much Does it Cost to Rebrand Your Company?", Ignyte, October 2017. Accessed June 2022.

    "Powerful Examples of How to Respond to Negative Reviews", Review Trackers, February 2022. Accessed June 2022.

    "The CEO Reputation Premium: Gaining Advantage in the Engagement Era", Weber Shadwick, March 2015. Accessed on June 2022.

    "Valuation of Trademarks: Everything You Need to Know",UpCounsel, 2022. Accessed June 2022.

    Related Info-Tech Research

    Identify and Manage Financial Risk Impacts on Your Organization

    • Vendor management practices educate organizations on potential financial impacts that vendors may incur and suggest systems to help manage them.
    • Standardize your processes for identifying and monitoring vendor risks to manage financial impacts with our Financial Risk Impact Tool.

    Identify and Manage Reputational Risk Impacts on Your Organization

    • Vendor management practices educate organizations on potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
    • Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your reputation and brand with our Reputational Risk Impact Tool.

    Identify and Manage Strategic Risk Impacts on Your Organization

    • Vendor management practices educate organizations on potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
    • Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your strategic plan with our Strategic Risk Impact Tool.

    Regulatory guidance and industry standards

    Develop a Security Operations Strategy

    • Buy Link or Shortcode: {j2store}264|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: $79,249 Average $ Saved
    • member rating average days saved: 28 Average Days Saved
    • Parent Category Name: Security Processes & Operations
    • Parent Category Link: /security-processes-and-operations
    • There is an onslaught of security data – generating information in different formats, storing it in different places, and forwarding it to different locations.
    • The organization lacks a dedicated enterprise security team. There is limited resourcing available to begin or mature a security operations center.
    • Many organizations are developing ad hoc security capabilities that result in operational inefficiencies, the misalignment of resources, and the misuse of security technology investments.
    • It is difficult to communicate the value of a security operations program when trying to secure organizational buy-in to gain the appropriate resourcing.
    • There is limited communication between security functions due to a centralized security operations organizational structure.

    Our Advice

    Critical Insight

    1. Security operations is no longer a center, but a process. The need for a physical security hub has evolved into the virtual fusion of prevention, detection, analysis, and response efforts. When all four functions operate as a unified process, your organization will be able to proactively combat changes in the threat landscape.
    2. Functional threat intelligence is a prerequisite for effective security operations – without it, security operations will be inefficient and redundant. Eliminate false positives by contextualizing threat data, aligning intelligence with business objectives, and building processes to satisfy those objectives.
    3. If you are not communicating, you are not secure. Collaboration eliminates siloed decisions by connecting people, processes, and technologies. You leave less room for error, consume fewer resources, and improve operational efficiency with a transparent security operations process.

    Impact and Result

    • A unified security operations process actively transforms security events and threat information into actionable intelligence, driving security prevention, detection, analysis, and response processes, addressing the increasing sophistication of cyberthreats, and guiding continuous improvement.
    • This blueprint will walk through the steps of developing a flexible and systematic security operations program relevant to your organization.

    Develop a Security Operations Strategy Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should enhance your security operations program, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Assess your current state

    Assess current prevention, detection, analysis, and response capabilities.

    • Develop a Security Operations Strategy – Phase 1: Assess Operational Requirements
    • Security Operations Preliminary Maturity Assessment Tool

    2. Develop maturity initiatives

    Design your optimized state of operations.

    • Develop a Security Operations Strategy – Phase 2: Develop Maturity Initiatives
    • Information Security Requirements Gathering Tool
    • Concept of Operations Maturity Assessment Tool

    3. Define operational interdependencies

    Identify opportunities for collaboration within your security program.

    • Develop a Security Operations Strategy – Phase 3: Define Operational Interdependencies
    • Security Operations RACI Chart & Program Plan
    • Security Operations Program Cadence Schedule Template
    • Security Operations Collaboration Plan
    • Security Operations Metrics Summary Document
    [infographic]

    Workshop: Develop a Security Operations Strategy

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Assess Operational Requirements

    The Purpose

    Determine current prevention, detection, analysis, and response capabilities, operational inefficiencies, and opportunities for improvement.

    Key Benefits Achieved

    Determine why you need a sound security operations program.

    Understand Info-Tech’s threat collaboration environment.

    Evaluate your current security operation’s functions and capabilities.

    Activities

    1.1 Understand the benefits of refining your security operations program.

    1.2 Gauge your current prevention, detection, analysis, and response capabilities.

    Outputs

    Security Operations Preliminary Maturity Assessment Tool

    2 Develop Maturity Initiatives

    The Purpose

    Begin developing and prioritizing gap initiatives in order to achieve the optimal state of operations.

    Key Benefits Achieved

    Establish your goals, obligations, scope, and boundaries.

    Assess your current state and define a target state.

    Develop and prioritize gap initiatives.

    Define the cost, effort, alignment, and security benefits of each initiative.

    Develop a security strategy operational roadmap.

    Activities

    2.1 Assess your current security goals, obligations, and scope.

    2.2 Design your ideal target state.

    2.3 Prioritize gap initiatives.

    Outputs

    Information Security Strategy Requirements Gathering Tool

    Security Operations Maturity Assessment Tool

    3 Define Operational Interdependencies

    The Purpose

    Identify opportunities for collaboration.

    Formalize your operational process flows.

    Develop a comprehensive and actionable measurement program.

    Key Benefits Achieved

    Understand the current security operations process flow.

    Define the security operations stakeholders and their respective deliverables.

    Formalize an internal information-sharing and collaboration plan.

    Activities

    3.1 Identify opportunities for collaboration.

    3.2 Formalize a security operations collaboration plan.

    3.3 Define operational roles and responsibilities.

    3.4 Develop a comprehensive measurement program.

    Outputs

    Security Operations RACI & Program Plan Tool

    Security Operations Collaboration Plan

    Security Operations Cadence Schedule Template

    Security Operations Metrics Summary

    Further reading

    INFO-TECH RESEARCH GROUP

    Develop a Security Operations Strategy

    Transition from a security operations center to a threat collaboration environment.

    Info-Tech Research Group, Inc. is a global leader in providing IT research and advice. Info-Tech’s products and services combine actionable insight and relevant advice with ready-to-use tools and templates that cover the full spectrum of IT concerns.
    © 1997-2017 Info-Tech Research Group Inc.

    ANALYST PERSPECTIVE

    “A reactive security operations program is no longer an option. The increasing sophistication of threats demands a streamlined yet adaptable mitigation and remediation process. Protect your assets by preparing for the inevitable; unify your prevention, detection, analysis, and response efforts and provide assurance to your stakeholders that you are making information security a top priority.”

    Phot of Edward Gray, Consulting Analyst, Security, Risk & Compliance, Info-Tech Research Group.

    Edward Gray,
    Consulting Analyst, Security, Risk & Compliance
    Info-Tech Research Group



    Our understanding of the problem

    This Research Is Designed For:
    • Chief Information Officer (CIO)
    • Chief Information Security Officer (CISO)
    • Chief Operating Officer (COO)
    • Security / IT Management
    • Security Operations Director / Security Operations Center (SOC)
    • Network Operations Director / Network Operations Center (NOC)
    • Systems Administrator
    • Threat Intelligence Staff
    • Security Operations Staff
    • Security Incident Responders
    • Vulnerability Management Staff
    • Patch Management
    This Research Will Help You:
    • Enhance your security program by implementing and streamlining next-generation security operations processes.
    • Increase organizational situational awareness through active collaboration between core threat teams, enriching internal security events with external threat intelligence and enhancing security controls.
    • Develop a comprehensive threat analysis and dissemination process: align people, process, and technology to scale security to threats.
    • Identify the appropriate technological and infrastructure-based sourcing decisions.
    • Design a step-by-step security operations implementation process.
    • Pursue continuous improvement: build a measurement program that actively evaluates program effectiveness.
    This Research Will Also Assist:
    • Board / Chief Executive Officer
    • Information Owners (Business Directors/VP)
    • Security Governance and Risk Management
    • Fraud Operations
    • Human Resources
    • Legal and Public Relations
    This Research Will Help Them
    • Aid decision making by staying abreast of cyberthreats that could impact the business.
    • Increase visibility into the organization’s threat landscape to identify likely targets or identify exposed vulnerabilities.
    • Ensure the business is compliant with regularity, legal, and/or compliance requirements.
    • Understand the value and return on investment of security operations offerings.

    Executive summary

    Situation

    • Current security practices are disjointed, operating independently with a wide variety of processes and tools to conduct incident response, network defense, and threat analysis. These disparate mitigations leave organizations vulnerable to the increasing number of malicious events.
    • Threat management has become resource intensive, requiring continuous monitoring, collection, and analysis of massive volumes of security event data, while juggling business, compliance, and consumer obligations.

    Complication

    • There is an onslaught of security data – generating information in different formats, storing it in different places, and forwarding it to different locations.
    • The organization lacks a dedicated enterprise security team. There is limited resourcing available to begin or mature a security operations center.
    • Many organizations are developing ad hoc security capabilities that result in operational inefficiencies, the misalignment of resources, and the misuse of their security technology investments.
    • It is difficult to communicate the value of a security operations program when trying to secure organizational buy-in to gain the appropriate resourcing.
    • There is limited communication between security functions due to a centralized security operations organizational structure.

    Resolution

    • A unified security operations process actively transforms security events and threat information into actionable intelligence, driving security prevention, detection, analysis, and response processes, addressing the increasing sophistication of cyberthreats, and guiding continuous improvement.
    • This blueprint will walk through the steps of developing a flexible and systematic security operations program relevant to your organization.

    Info-Tech Insight

    1. Security operations is no longer a center, but a process. The need for a physical security hub has evolved into the virtual fusion of prevention, detection, analysis, and response efforts. When all four functions operate as a unified process, your organization will be able to proactively combat changes in the threat landscape.
    2. Functional threat intelligence is a prerequisite for effective security operations – without it, security operations will be inefficient and redundant. Eliminate false positives by contextualizing threat data, aligning intelligence with business objectives, and building processes to satisfy those objectives.
    3. If you are not communicating, you are not secure. Collaboration eliminates siloed decisions by connecting people, processes, and technologies. You leave less room for error, consume fewer resources, and improve operational efficiency with a transparent security operations process.

    Data breaches are resulting in major costs across industries

    Horizontal bar chart of 'Per capita cost by industry classification of benchmarked companies', with the highest cost attributed to 'Health', 'Pharmaceutical', 'Financial', 'Energy', and 'Transportation'.

    Average data breach costs per compromised record hit an all-time high of $217 (in 2015); $74 is direct cost (e.g. legal fees, technology investment) and $143 is indirect cost (e.g. abnormal customer churn). (Source: Ponemon Institute, “2015 Cost of Data Breach Study: United States”)

    '% of systems impacted by a data breach', '1% No Impact', '19% 1-10% impacted', '41% 11-30% impacted', '24% 31-50% impacted', '15% more than 50% impacted
    Divider line.
    '% of customers lost from a data breach', '61% Lost <20%', '21% Lost 20-40%', '8% Lost 40-60%', '6% Lost 60-80%', '4% Lost 80-100%'.
    Divider line.
    '% of business opportunity lost from a data breach', '58% Lost <20%', '25% Lost 20-40%', '9% Lost, 40-60%', '5% Lost 60-80%', '4% Lost 80-100%'.
    (Source: The Network, “ Cisco 2017 Security Capabilities Benchmark Study”)

    Persistent issues

    • Organizational barriers separating prevention, detection, analysis, and response efforts.
      Siloed operations limit collaboration and internal knowledge sharing.
    • Lack of knowledgeable security staff.
      Human capital is transferrable between roles and functions and must be cross-trained to wear multiple hats.
    • Failure to evaluate and improve security operations.
      The effectiveness of operations must be frequently measured and (re)assessed through an iterative system of continuous improvement.
    • Lack of standardization.
      Pre-established use cases and policies outlining tier-1 operational efforts will eliminate ad hoc remediation efforts and streamline operations.
    • Failure to acknowledge the auditor as a customer.
      Many compliance and regulatory obligations require organizations to have comprehensive documentation of their security operations practices.

    60% Of organizations say security operation teams have little understanding of each other’s requirements.

    40% Of executives report that poor coordination leads to excessive labor and IT operational costs.

    38-100% Increase in efficiency after closing operational gaps with collaboration.
    (Source: Forbes, “The Game Plan for Closing the SecOps Gap”)

    The solution

    Bar chart of the 'Benefits of Internal Collaboration' with 'Increased Operational Efficiency' and 'Increased Problem Solving' having the highest percentage.

    “Empower a few administrators with the best information to enable fast, automated responses.”
    – Ismael Valenzuela, IR/Forensics Technical Practice Manager, Foundstone® Services, Intel Security)

    Insufficient security personnel resourcing has been identified as the most prevalent challenge in security operations…

    When an emergency security incident strikes, weak collaboration and poor coordination among critical business functions will magnify inefficiencies in the incident response (IR) process, impacting the organization’s ability to minimize damage and downtime.

    The solution: optimize your SOC. Info-Tech has seen SOCs with five analysts outperform SOCs with 25 analysts through tools and process optimization.

    Sources:
    Ponemon. "2016 State of Cybersecurity in Small & Medium-Sized Businesses (SMB).”
    Syngress. Designing and Building a Security Operations Center.

    Maintain a holistic security operations program

    Legacy security operations centers (SOCs) fail to address gaps between data sources, network controls, and human capital. There is limited visibility and collaboration between departments, resulting in siloed decisions that do not support the best interests of the organization.
    Venn diagram of 'Next-Gen Security Operations' with four intersecting circles: 'Prevent', 'Detect', 'Analyze', and 'Respond'.

    Security operations is part of what Info-Tech calls a threat collaboration environment, where members must actively collaborate to address cyberthreats affecting the organization’s brand, business operations, and technology infrastructure on a daily basis.

    Prevent: Defense in depth is the best approach to protect against unknown and unpredictable attacks. Diligent patching and vulnerability management, endpoint protection, and strong human-centric security (amongst other tactics) are essential. Detect: There are two types of companies – those who have been breached and know it and those who have been breached and don’t know it. Ensure that monitoring, logging, and event detection tools are in place and appropriate to your organizational needs
    Analyze: Raw data without interpretation cannot improve security and is a waste of time, money, and effort. Establish a tiered operational process that not only enriches data but also provides visibility into your threat landscape. Respond: Organizations can’t rely on an ad hoc response anymore – don’t wait until a state of panic. Formalize your response processes in a detailed incident runbook in order to reduce incident remediation time and effort.

    Info-Tech’s security operations blueprint ties together various initiatives

    Stock image 1.

    Design and Implement a Vulnerability Management Program

    Vulnerability Management
    Vulnerability management revolves around the identification, prioritization, and remediation of vulnerabilities. Vulnerability management teams hunt to identify which vulnerabilities need patching and remediating.
    Deliverables
    • Vulnerability Tracking Tool
    • Vulnerability Scanning Tool RFP Template
    • Penetration Test RFP Template
    • Vulnerability Mitigation Process Template
    Stock image 2.

    Integrate Threat Intelligence Into Your Security Operations

    Threat Intelligence
    Threat intelligence addresses the collection, analysis, and dissemination of external threat data. Analysts act as liaisons to their peers, publishing actionable threat alerts, reports, and briefings. Threat intelligence proactively monitors and identifies whether threat indicators are impacting your organization.
    • Maturity Assessment Tool
    • Threat Intelligence RACI Tool
    • Management Plan Template
    • Threat Intelligence Policy Template
    • Alert Template
    • Alert and Briefing Cadence Schedule
    Stock image 3.

    Develop Foundational Security Operations Processes

    Operations
    Security operations include the real-time monitoring and analysis of events based on the correlation of internal and external data sources. This also includes incident escalation based on impact. Analysts are constantly tuning and tweaking rules and reporting thresholds to further help identify which indicators are most impactful during the analysis phase of operations.
    • Maturity Assessment Tool
    • Event Prioritization Tool
    • Efficiency Calculator
    • SecOps Policy Template
    • In-House vs. Outsourcing Decision-Making Tool
    • SecOps RACI Tool
    • TCO & ROI Comparison Calculator
    Stock image 4.

    Develop and Implement a Security Incident Management Program

    Incident Response
    Effective and efficient management of incidents involves a formal process of analysis, containment, eradication, recovery, and post-incident activities. IR teams coordinate root-cause analysis and incident gathering while facilitating post-incident lessons learned. Incident response can provide valuable threat data that ties specific indicators to threat actors or campaigns.
    • Incident Management Policy
    • Maturity Assessment Tool
    • Incident Management RACI Tool
    • Incident Management Plan
    • Incident Runbook Prioritization Tool
    • Various Incident Management Runbooks

    This blueprint will…

    …better protect your organization with an interdependent and collaborative security operations program.

    Phase 01

    Assess your operational requirements.

    Phase 02

    Optimize and further mature your security operations processes

    Phase 3a

    Develop the process flow and specific interaction points between functions

    Phase 3b

    Test your current capabilities with a table top exercise
    Briefly assess your current prevention, detection, analysis, and response capabilities.
    Highlight operational weak spots that should be addressed before progressing.
    Develop a prioritized list of security-focused operational initiatives.
    Conduct a holistic analysis of your operational capabilities.
    Define the operational interaction points between security-focused operational departments.
    Document the results in comprehensive operational interaction agreement.
    Test your operational processes with Info-Tech’s security operations table-top exercise.

    Info-Tech integrates several best practices to create a best-of-breed security framework

    Legend for the 'Information Security Framework' identifying blue best practices as 'In Scope' and white best practices as 'Out of Scope'. Info-Tech's 'Information Security Framework' of best practices with two main categories 'Governance' and 'Management', each with subcategories such as 'Context & Leadership' and 'Prevention', each with a group of best practices color-coded to the associated legend identifying them as 'In Scope' or 'Out of Scope'.

    Benefits of a collaborative and integrated operations program

    Effective security operations management will help you do the following:

    • Improve efficacy
      Develop structured processes to automate activities and increase process consistency across the security program. Expose operational weak points and transition teams from firefighting to an innovator role.
    • Improve threat protection
      Enhance network controls through the hardening of perimeter defenses, an intelligence-driven analysis process, and a streamlined incident remediation process.
    • Improve visibility and information sharing
      Promote both internal and external information sharing to enable good decision making.
    • Create and clarify accountability and responsibility
      Security operations management practices will set a clear level of accountability throughout the security program and ensure role responsibility for all tasks and processes involved in service delivery.
    • Control security costs
      Security operations management is concerned with delivering promised services in the most efficient way possible. Good security operations management practices will provide insight into current costs across the organization and present opportunities for cost savings.
    • Identify opportunities for continuous improvement
      Increased visibility into current performance levels and the ability to accurately identify opportunities for continuous improvement.

    Impact

    Short term:

    • Streamlined security operations program development process.
    • Completed comprehensive list of operational gaps and initiatives.
    • Formalized and structured implementation process.
    • Standardized operational use cases that predefine necessary operational protocol.

    Long term:

    • Enhanced visibility into immediate threat environment.
    • Improved effectiveness of internal defensive controls.
    • Increased operational collaboration between prevention, detection, analysis, and response efforts.
    • Enhanced security pressure posture.
    • Improved communication with executives about relevant security risks to the business.

    Understand the cost of not having a suitable security operations program

    A practical approach, justifying the value of security operations, is to identify the assets at risk and calculate the cost to the company should the information assets be compromised (i.e. assess the damage an attacker could do to the business).

    Cost Structure Cost Estimation ($) for SMB
    (Small and medium-sized business)
    Cost Estimation ($) for LE
    (Large enterprise)
    Security controls Technology investment: software, hardware, facility, maintenance, etc.
    Cost of process implementation: incident response, CMBD, problem management, etc.
    Cost of resource: salary, training, recruiting, etc.
    $0-300K/year $200K-2M/year
    Security incidents
    (if no security control is in place)
    Explicit cost:
    1. Incident response cost:
      • Remediation costs
      • Productivity: (number of employees impacted) × (hours out) × (burdened hourly rate)
      • Extra professional services
      • Equipment rental, travel expenses, etc.
      • Compliance fine
      • Cost of notifying clients
    2. Revenue loss: direct loss, the impact of permanent loss of data, lost future revenues
    3. Financial performance: credit rating, stock price
      Hidden cost:
      • Reputation, customer loyalty, etc.
    $15K-650K/year $270K-11M/year

    Workshop Overview

    Contact your account representative or email Workshops@InfoTech.com for more information.

    Workshop Day 1 Workshop Day 2 Workshop Day 3 Workshop Day 4 Workshop Day 5
    Activities
    • Kick-off and introductions.
    • High-level overview of weekly activities and outcomes.
    • Activity: Define workshop objectives and current state of knowledge.
    • Understand the threat collaboration environment.
    • Understand the benefits of an optimized security operations.
    • Activity: Review preliminary maturity level.
    • Activity: Assess current people, processes, and technology capabilities.
    • Activity: Assess workflow capabilities.
    • Activity: Begin deep-dive into maturity assessment tool.
    • Discuss strategies to enhance the analysis process (ticketing, automation, visualization, use cases, etc.).
    • Activity: Design ideal target state.
    • Activity: Identify security gaps.
    • Build initiatives to bridge the gaps.
    • Activity: Estimate the resources needed.
    • Activity: Prioritize gap initiatives.
    • Activity: Develop dashboarding and visualization metrics.
    • Activity: Plan for a transition with the security roadmap and action plan.
    • Activity: Define and assign tier 1, 2 & 3 SOC roles and responsibilities.
    • Activity: Assign roles and responsibilities for each security operations initiative.
    • Activity: Develop a comprehensive measurement program.
    • Activity: Develop specific runbooks for your top-priority incidents (e.g. ransomware).
      • Detect the incident.
      • Analyze the incident.
      • Contain the incident.
      • Eradicate the root cause.
      • Recover from the incident.
      • Conduct post-incident analysis and communication.
    • Activity:Conduct attack campaign simulation.
    • Finalize main deliverables.
    • Schedule feedback call.
    Deliverables
    1. Security Operations Maturity Assessment Tool
    1. Target State and Gap Analysis (Security Operations Maturity Assessment Tool)
    1. Security Operations Role & Process Design
    2. Security Operations RACI Chart
    3. Security Operations Metrics Summary
    4. Security Operations Phishing Process Runbook
    5. Attack Campaign Simulation PowerPoint

    All Final Deliverables

    Develop a Security Operations Strategy

    PHASE 1

    Assess Operational Requirements

    1

    Assess Operational Requirements

    2

    Develop Maturity Initiatives

    3

    Define Interdependencies

    This step will walk you through the following activities:

    • Determine why you need a sound security operations program.
    • Understand Info-Tech’s threat collaboration environment.
    • Evaluate your current security operation’s functions and capabilities.

    Outcomes of this step

    • A defined scope and motive for completing this project.
    • Insight into your current security operations capabilities.
    • A prioritized list of security operations initiatives based on maturity level.

    Info-Tech Insight

    Security operations is no longer a center, but a process. The need for a physical security hub has evolved into the virtual fusion of prevention, detection, analysis, and response efforts. When all four functions operate as a unified process, your organization will be able to proactively combat changes in the threat landscape.

    Warm-up exercise: Why build a security operations program?

    Estimated time to completion: 30 minutes

    Discussion: Why are we pursuing this project?

    What are the objectives for optimizing and developing sound security operations?

    Stakeholders Required:

    • Key business executives
    • IT leaders
    • Security operations team members

    Resources Required

    • Sticky notes
    • Whiteboard
    • Dry-erase markers
    1. Briefly define the scope of security operations
      What people, processes, and technology fall within the security operations umbrella?
    2. Brainstorm the implications of not acting
      What does the status quo have in store? What are the potential risks?
    3. Define the goals of the project
      Clarify from the outset: what exactly do you want to accomplish from this project?
    4. Prioritize all brainstormed goals
      Classify the goals based on relevant prioritization criteria, e.g. urgency, impact, cost.

    Info-Tech Best Practice

    Don’t develop a security operations program with the objective of zero incidents. This reliance on prevention results in over-engineered security solutions that cost more than the assets being protected.

    Decentralizing the SOC: Security as a function

    Before you begin, remember that no two security operation programs are the same. While the end goal may be similar, the threat landscape, risk tolerance, and organizational requirements will differ from any other SOC. Determine what your DNA looks like before you begin to protect it.

    Security operations must provide several fundamental functions:
    • Real-time monitoring, detecting, and triaging of data from both internal and external sources.
    • In-depth analysis of indicators and incidents, leveraging malware analysis, correlation and rule tweaking, and forensics and eDiscovery techniques.
    • Network/host scanning and vulnerability patch management.
    • Incident response, remediation, and reporting. Security operations must disseminate appropriate information/intelligence to relevant stakeholders.
    • Comprehensive logging and ticketing capabilities that document and communicate events throughout the threat collaboration environment.
    • Tuning and tweaking of technologies to ingest collected data and enhance the analysis process.
    • Enhance overall organizational situational awareness by reporting on security trends, escalating incidents, and sharing adversary tools, tactics, and procedures.
    Venn diagram of 'Security Operations' with four intersecting circles: 'Prevent', 'Detect', 'Analyze', and 'Respond'.
    At its core, a security operations program is responsible for the prevention, detection, analysis, and response of security events.

    Optimized security operations can seamlessly integrate threat and incident management processes with monitoring and compliance workflows and resources. This integration unlocks efficiency.

    Understand the levels of security operations

    Take the time to map out what you need and where you should go. Security operations has to be more than just monitoring events – there must be a structured program.

    Foundational Arrow with a plus sign pointing right. Operational Arrow with a plus sign pointing right. Strategic
    • Intrusion Detection Management
    • Active Device and Event Monitoring
    • Log Collection and Retention
    • Reporting and Escalation Management
    • Incident Management
    • Audit Compliance
    • Vendor Management
    • Ticketing Processes
    • Packet Capture and Analysis
    • SIEM
    • Firewall
    • Antivirus
    • Patch Management
    • Event Analysis and Incident Triage
    • Security Log Management
    • Vulnerability Management
    • Host Hardening
    • Static Malware Analysis
    • Identity and Access Management
    • Change Management
    • Endpoint Management
    • Business Continuity Management
    • Encryption Management
    • Cloud Security (if applicable)
    • SIEM with Defined Use Cases
    • Big Data Security Analytics
    • Threat Intelligence
    • Network Flow Analysis
    • VPN Anomaly Detection
    • Dynamic Malware Analysis
    • Use-Case Management
    • Feedback and Continuous Improvement Management
    • Visualization and Dashboarding
    • Knowledge Portal Ticket Documentation
    • Advanced Threat Hunting
    • Control and Process Automation
    • eDiscovery and Forensics
    • Risk Management
    ——Security Operations Capabilities—–›

    Understand security operations: Establish a unified threat collaboration environment

    Stock image 1.

    Design and Implement a Vulnerability Management Program

    Security operations is part of what Info-Tech calls a threat collaboration environment, where members must actively collaborate to address threats impacting the organization’s brand, operations, and technology infrastructure.
    • Managing incident escalation and response.
    • Coordinating root-cause analysis and incident gathering.
    • Facilitating post-incident lessons learned.
    • Managing system patching and risk acceptance.
    • Conducting vulnerability assessment and penetration testing.
    • Monitoring in real-time and triaging of events.
    • Escalating events to incident management team.
    • Tuning and tweaking rules and reporting thresholds.
    • Gathering and analyzing external threat data.
    • Liaising with peers, industry, and government.
    • Publishing threat alerts, reports, and briefings.

    Info-Tech Best Practice

    Ensure that information flows freely throughout the threat collaboration environment – each function should serve to feed and enhance the next.

    Stock image 2.

    Integrate Threat Intelligence Into Your Security Operations

    Stock image 3.

    Develop Foundational Security Operations Processes

    Stock image 4.

    Develop and Implement a Security Incident Management Program

    The threat collaboration environment is comprised of three core elements

    Info-Tech Insight

    The value of a SOC can be achieved with fewer prerequisites than you think. While it is difficult to cut back on process and technology requirements, human capital is transferrable between roles and functions and can be cross-trained to satisfy operational gaps.

    Three hexes fitting together with the words 'People', 'Process', and 'Technology'. People. Effective human capital is fundamental to establishing an efficient security operations program, and if enabled correctly, can be the driving factor behind successful process optimization. Ensure you address several critical human capital components:
    • Who is responsible for each respective threat collaboration environment function?
    • What are the required operational roles, responsibilities, and competencies for each employee?
    • Are there formalized training procedures to onboard new employees?
    • Is there an established knowledge transfer and management program?
    Processes. Formal and informal mechanisms that bridge security throughout the collaboration environment and organization at large. Ask yourself:
    • Are there defined runbooks that clearly outline critical operational procedures and guidelines?
    • Is there a defined escalation protocol to transfer knowledge and share threats internally?
    • Is there a defined reporting procedure to share intelligence externally?
    • Are there formal and accessible policies for each respective security operations function?
    • Is there a defined measurement program to report on the performance of security operations?
    • Is there a continuous improvement program in place for all security operations functions?
    • Is there a defined operational vendor management program?
    Technology. The composition of all infrastructure, systems, controls, and tools that enable processes and people to operate and collaborate more efficiently. Determine:
    • Are the appropriate controls implemented to effectively prevent, detect, analyze, and remediate threats? Is each control documented with an assigned asset owner?
    • Can a solution integrate with existing controls? If so, to what extent?
    • Is there a centralized log aggregation tool such as a SIEM?
    • What is the operational cost to effectively manage each control?
    • Is the control the most up-to-date version? Have the most recent patches and configuration changes been applied? Can it be consolidated with or replaced by another control?

    Conduct a preliminary maturity assessment before tackling this project

    Stock image 1.

    Design and Implement a Vulnerability Management Program

    Sample of Info-Tech's Security Operations Preliminary Maturity Assessment

    At a high level, assess your organization’s operational maturity in each of the threat collaboration environment functions. Determine whether the foundational processes exist in order to mature and streamline your security operations.

    Stock image 2.

    Integrate Threat Intelligence Into Your Security Operations

    Stock image 3.

    Develop Foundational Security Operations Processes

    Stock image 4.

    Develop and Implement a Security Incident Management Program

    Assess the current maturity of your security operations program

    Prioritize the component most important to the development of your security operations program.

    Screenshot of a table from the Security Operations Preliminary Maturity Assessment presenting the 'Impact Sub-Weightings' of 'People', 'Process', 'Technology', and 'Policy'.
    Screenshot of a table from the Security Operations Preliminary Maturity Assessment assessing the 'Current State' and 'Target State' of different 'Security Capabilities'.
    Each “security capability” covers a component of the overarching “security function.” Assign a current and target maturity score to each respective security capability. (Note: The CMMI maturity scores are further explained on the following slide.) Document any/all comments for future Info-Tech analyst discussions.

    Assign each security capability a reflective and desired maturity score.

    Your current and target state maturity will be determined using the capability maturity model integration (CMMI) scale. Ensure that all participants understand the 1-5 scale.
    Two-way vertical arrow colored blue at the top and green at the bottom. Ad Hoc
    1 Arrow pointing right. Initial/Ad Hoc: Activity is not well defined and is ad hoc, e.g. no formal roles or responsibilities exist, de facto standards are followed on an individual-by-individual basis.
    2 Arrow pointing right. Developing: Activity is established and there is moderate adherence to its execution, e.g. while no formal policies have been documented, content management is occurring implicitly or on an individual-by-individual basis.
    3 Arrow pointing right. Defined: Activity is formally established, documented, repeatable, and integrated with other phases of the process, e.g. roles and responsibilities have been defined and documented in an accessible policy, however, metrics are not actively monitored and managed.
    4 Arrow pointing right. Managed and Measurable: Activity execution is tracked by gathering qualitative and quantitative feedback, e.g. metrics have been established to monitor the effectiveness of tier-1 SOC analysts.
    5 Arrow pointing right. Optimized: Qualitative and quantitative feedback is used to continually improve the execution of the activity, e.g. the organization is an industry leader in the respective field; research and development efforts are allocated in order to continuously explore more efficient methods of accomplishing the task at hand.
    Optimized

    Notes: Info-Tech seldom sees a client achieve a CMMI score of 4 or 5. To achieve a state of optimization there must be a subsequent trade-off elsewhere. As such, we recommend that organizations strive for a CMMI score of 3 or 4.

    Ensure that your threat collaboration environment is of a sufficient maturity before progressing

    Example report card from the maturity assessment. Functions are color-coded green, yellow, and red. Review the report cards for each of the respective threat collaboration environment functions.
    • A green function indicates that you have exceeded the operational requirements to proceed with the security operations initiative.
    • A yellow function indicates that your maturity score is below the recommended threshold; Info-Tech advises revisiting the attached blueprint. In the instance of a one-off case, the client can proceed with this security operations initiative.
    • A red function indicates that your maturity score is well below the recommended threshold; Info-Tech strongly advises to not proceed with the security operations initiative. Revisit the recommended blueprint and further mature the specific function.

    Are you ready to move on to the next phase?

    Self-Assessment Questions

    • Have you clearly defined the rationale for refining your security operations program?
    • Have you clearly defined and prioritized the goals and outcomes of optimizing your security operations program?
    • Have you assessed your respective people, process, and technological capabilities?
    • Have you completed the Security Operations Preliminary Maturity Assessment Tool?
    • Were all threat collaboration environment functions of a sufficient maturity level?

    If you answered “yes” to the questions, then you are ready to move on to Phase 2: Develop Maturity Initiatives

    Develop a Security Operations Strategy

    PHASE 2

    Develop Maturity Initiatives

    1

    Assess Operational Requirements

    2

    Develop Maturity Initiatives

    3

    Define Interdependencies

    This step will walk you through the following activities:

    • Establish your goals, obligations, scope, and boundaries.
    • Assess your current state and define a target state.
    • Develop and prioritize gap initiatives.
    • Define cost, effort, alignment, and security benefit of each initiative.
    • Develop a security strategy operational roadmap.

    Outcomes of this step

    • A formalized understanding of your business, customer, and regulatory obligations.
    • A comprehensive current and target state assessment.
    • A succinct and consolidated list of gap initiatives that will collectively achieve your target state.
    • A formally documented set of estimated priority variables (cost, effort, business alignment).
    • A fully prioritized security roadmap that is in alignment with business goals and informed by the organization’s needs and limitations.

    Info-Tech Insight

    Functional threat intelligence is a prerequisite for effective security operations – without it, security operations will be inefficient and redundant. Eliminate false positives by contextualizing threat data, aligning intelligence with business objectives, and building processes to satisfy those objectives

    Align your security operations program with corporate goals and obligations

    A common challenge for security leaders is learning to express their initiatives in terms that are meaningful to business executives.

    Frame the importance of your security operations program to
    align with that of the decision makers’ over-arching strategy.

    Oftentimes resourcing and funding is dependent on the
    alignment of security initiatives to business objectives.

    Corporate goals and objectives can be categorized into three major buckets:
    1. BUSINESS OBLIGATIONS
      The primary goals and functions of the organization at large. Examples include customer retention, growth, innovation, customer experience, etc.
    2. CONSUMER OBLIGATIONS
      The needs and demands of internal and external stakeholders. Examples include ease of use (external), data protection (external), offsite access (internal), etc.
    3. COMPLIANCE OBLIGATIONS
      The requirements of the organization to comply with mandatory and/or voluntary standards. Examples include HIPAA, PIPEDA, ISO 27001, etc.
    *Do not approach the above list with a security mindset – take a business perspective and align your security efforts accordingly.

    Info-Tech Best Practice

    Developing a security operations strategy is a proactive activity that enables you to get in front of any upcoming business projects or industry trends rather than having to respond reactively later on. Consider as many foreseeable variables as possible!

    Determine your security operations program scope and boundaries

    It is important to define all security-related areas of responsibility. Upon completion you should clearly understand what you are trying to secure.

    Ask yourself:
    Where does the onus of responsibility stop?

    The organizational scope and boundaries and can be categorized into four major buckets:
    1. PHYSICAL SCOPE
      The physical locations that the security operations program is responsible for. Examples include office locations, remote access, clients/vendors, etc.
    2. IT SYSTEMS
      The network systems that must be protected by the security operations program. Examples include fully owned systems, IaaS, PaaS, remotely hosted SaaS, etc.
    3. ORGANIZATIONAL SCOPE
      The business units, departments, or divisions that will be affected by the security operations program. Examples include user groups, departments, subsidiaries, etc.
    4. DATA SCOPE
      The data types that the business handles and the privacy/criticality level of each. Examples include top secret, confidential, private, public, etc.

    This also includes what is not within scope. For some outsourced services or locations you may not be responsible for security. For some business departments you may not have control of security processes. Ensure that it is made explicit at the outset, what will be included and what will be excluded from security considerations.

    Reference Info-Tech’s security strategy: goals, obligations, and scope activities

    Explicitly understanding how security aligns with the core business mission is critical for having a strategic plan and fulfilling the role of business enabler.

    Download and complete the information security goals, obligations and scope activities (Section 1.3) within the Info-Tech security strategy research publication. If previously completed, take the time to review your results.

    GOALS and OBLIGATIONS
    Proceed through each slide and brainstorm the ways that security operations supports business, customer, and compliance needs.

    Goals & Obligations
    Screenshots of slides from the information security goals, obligations and scope activities (Section 1.3) within the Info-Tech security strategy research publication.

    PROGRAM SCOPE & BOUNDARIES
    Assess your current organizational environment. Document current IT systems, critical data, physical environments, and departmental divisions.

    If a well-defined corporate strategy does not exist, these questions can help pinpoint objectives:

    • What is the message being delivered by the CEO?
    • What are the main themes of investments and projects?
    • What are the senior leaders measured on?
    Program Scope & Boundaries
    Screenshots of slides from the information security goals, obligations and scope activities (Section 1.3) within the Info-Tech security strategy research publication.

    INFO-TECH OPPORTUNITY

    For more information on how to complete the goals & obligations activity please reference Section 1.3 of Info-Tech’s Build an Information Security Strategy blueprint.

    Complete the Information Security Requirements Gathering Tool

    On tab 1. Goals and Obligations:
    • Document all business, customer, and compliance obligations. Ensure that each item is reflective of the over-arching business strategy and is not security focused.
    • In the second column, identify the corresponding security initiative that supports the obligation.
    Screenshot from tab 1 of Info-Tech's Information Security Requirements Gathering Tool. Columns are 'Business obligations', 'Security obligations to support the business (optional)', and 'Notes'.
    On tab 2. Scope and Boundaries:
    • Record all details for what is in and out of scope from physical, IT, organizational, and data perspectives.
    • Complete the affiliated columns for a comprehensive scope assessment.
    • As a discussion guide, refer to the considerations slides prior to this in phase 1.3.
    Screenshot from tab 2 of Info-Tech's Information Security Requirements Gathering Tool. Title is 'Physical Scope', Columns are 'Environment Name', 'Highest data criticality here', 'Is this in scope of the security strategy?', 'Are we accountable for security here?', and 'Notes'.
    For the purpose of this security operations initiative please IGNORE the risk tolerance activities on tab 3.

    Info-Tech Best Practice

    A common challenge for security leaders is expressing their initiatives in terms that are meaningful to business executives. This exercise helps make explicit the link between what the business cares about and what security is trying to do.

    Conduct a comprehensive security operations maturity assessment

    The following slides will walk you through the process below.

    Define your current and target state

    Self-assess your current security operations capabilities and determine your intended state.

    Create your gap initiatives

    Determine the operational processes that must be completed in order to achieve the target state.

    Prioritize your initiatives

    Define your prioritization criteria (cost, effort, alignment, security benefit) based on your organization

    Build a Gantt chart for your upcoming initiatives
    The final output will be a Gantt to action your prioritized initiatives

    Info-Tech Insight

    Progressive improvements provide the most value to IT and your organization. Leaping from pre-foundation to complete optimization is an ineffective goal. Systematic improvements to your security performance delivers value to your organization, each step along the way.

    Optimize your security operations workflow

    Info-Tech consulted various industry experts and consolidated their optimization advice.

    Dashboards: Centralized visibility, threat analytics, and orchestration enable faster threat detection with fewer resources.

    Adding more controls to a network never increases resiliency. Identify technological overlaps and eliminate unnecessary costs.

    Automation: There is shortfall in human capital in contrast to the required tools and processes. Automate the more trivial processes.

    SOCs with 900 employees are just as efficient as those with 35-40. There is an evident tipping point in marginal value.

    There are no plug-and-play technological solutions – each is accompanied by a growing pain and an affiliated human capital cost.

    Planning: Narrow the scope of operations to focus on protecting assets of value.

    Cross-train employees throughout different silos. Enable them to wear multiple hats.

    Practice: None of the processes happen in a vacuum. Make the most of tabletop exercises and other training exercises.

    Define appropriate use cases and explicitly state threat escalation protocol. Focus on automating the tier-1 analyst role.

    Self-assess your current-state capabilities and determine the appropriate target state

    1. Review:
    The heading in blue is the security domain, light blue is the subdomain and white is the specific control.
    2. Determine and Record:
    Ask participants to identify your organization’s current maturity level for each control. Next, determine a target maturity level that meets the requirements of the area (requirements should reflect the goals and obligations defined earlier).
    3.
    In small groups, have participants answer “what is required to achieve the target state?” Not all current/target state gaps will require additional description, explanation, or an associated imitative. You can generate one initiative that may apply to multiple line items.

    Screenshot of a table for assessing the current and target states of capabilities.

    Info-Tech Best Practice

    When customizing your gap initiatives consider your organizational requirements and scope while remaining realistic. Below is an example of lofty vs. realistic initiatives:
    Lofty: Perform thorough, manual security analysis. Realistic: Leverage our SIEM platform to perform more automated security analysis through the use of log information.

    Consolidate related gap initiatives to simplify and streamline your roadmap

    Identify areas of commonality between gap initiative in order to effectively and efficiently implement your new initiatives.

    Steps:
    1. After reviewing and documenting initiatives for each security control, begin sorting controls by commonality, where resources can be shared, or similar end goals and actions. Begin by copying all initiatives from tab 2. Current State Assessment into tab 5. Initiative List of the Security Operations Maturity Assessment Tool and then consolidating them.
    2. Initiatives Consolidated Initiatives
      Document data classification and handling in AUP —› Document data classification and handling in AUP Keep urgent or exceptional initiatives separate so they can be addressed appropriately.
      Document removable media in AUP —› Define and document an Acceptable Use Policy Other similar or related initiatives can be consolidated into one item.
      Document BYOD and mobile devices in AUP —›
      Document company assets in Acceptable Use Policy (AUP) —›

    3. Review grouped initiatives and identify specific initiatives should be broken out and defined separately.
    4. Record your consolidated gap initiatives in the Security Operations Maturity Assessment Tool, tab 6. Initiative Prioritization.

    Understand your organizational maturity gap

    After inputting your current and target scores and defining your gap initiatives in tab 2, review tab 3. Current Maturity and tab 4. Maturity Gap in Info-Tech’s Security Operations Maturity Assessment Tool.

    Automatically built charts and tables provide a clear visualization of your current maturity.

    Presenting these figures to stakeholders and management can help visually draw attention to high-priority areas and contextualize the gap initiatives for which you will be seeking support.

    Screenshot of tabs 3 and 4 from Info-Tech's Security Operations Maturity Assessment Tool. Bar charts titled 'Planning and Direction', 'Vulnerability Management', 'Threat Intelligence', and 'Security Maturity Level Gap Analysis'.

    Info-Tech Best Practice

    Communicate the value of future security projects to stakeholders by copying relevant charts and tables into an executive stakeholder communication presentation (ask an Info-Tech representative for further information).

    Define cost, effort, alignment, and security benefit

    Define low, medium, and high resource allocation, and other variables for your gap initiatives in the Concept of Operations Maturity Assessment Tool. These variables include:
    1. Define initial cost. One-time, upfront capital investments. The low cut-off would be a project that can be approved with little to no oversight. Whereas the high cut-off would be a project that requires a major approval or a formal capital investment request. Initial cost covers items such as appliance cost, installation, project based consulting fees, etc.
    2. Define ongoing cost. This includes any annually recurring operating expenses that are new budgetary costs, e.g. licensing or rental costs. Do not account for FTE employee costs. Generally speaking you can take 20-25% of initial cost as ongoing cost for maintenance and service.
    3. Define initial staffing in hours. This is total time in hours required to complete a project. Note: It is not total elapsed time, but dedicated time. Consider time required to research, document, implement, review, set up, fine tune, etc. Consider all staff hours required (2 staff at 8 hours means 16 hours total).
    4. Define ongoing staffing in hours. This is the ongoing average hours per week required to support that initiative. This covers all operations, maintenance, review, and support for the initiative. Some initiatives will have a week time commitment (e.g. perform a vulnerability scan using our tool once a week) versus others that may have monthly, quarterly, or annual time commitments that need to averaged out per week (e.g. perform annual security review requiring 0.4 hours/week (20 hours total based on 50 working weeks per year).
    Table relating the four definitions on the left, 'Initial Cost', 'Ongoing Cost (annual)', 'Initial Staffing in Hours', and 'Ongoing Staffing in Hours/Week'. Each row header is a definition and has four sub-rows 'High', 'Medium', 'Low', and 'Zero'.

    Info-Tech Best Practice

    When considering these parameters, aim to use already existing resource allocations.

    For example, if there is a dollar value that would require you to seek approval for an expense, this might be the difference between a medium and a high cost category.

    Define cost, effort, alignment, and security benefit

    1. Define Alignment with Business. This variable is meant to capture how well the gap initiative aligns with organizational goals and objectives. For example, something with high alignment usually can be tied to a specific organization initiative and will receive senior management support. You can either:
      • Set low, medium, and high based on levels of support the organization will provide (e.g. High – senior management support, Medium – VP/business unit head support, IT support only)
      • Attribute specific corporate goals or initiatives to the gap initiative (e.g. High – directly supports a customer requirement/key contract requirement; Medium – indirectly support customer requirement/key contract OR enables remote workforce; Low – security best practice).
    2. Define Security Benefit. This variable is meant to capture the relative security benefit or risk reduction being provided by the gap initiative. This can be represented through a variety of factors, such as:
      • Reduces compliance or regulatory risk by meeting a control requirement
      • Reduces availability and operational risk
      • Implements a non-existent control
      • Secures high-criticality data
      • Secures at-risk end users
    Table relating the two definitions on the left, 'Alignment with Business', and 'Security Benefit'. Each row header is a definition and has three sub-rows 'High', 'Medium', and 'Low'.

    Info-Tech Best Practice

    Make sure you consider the value of AND/OR. For either alignment with business or security benefit, the use of AND/OR can become useful thresholds to rank similar importance but different value initiatives.

    Example: with alignment with business, an initiative can indirectly support a key compliance requirement OR meet a key corporate goal.

    Info-Tech Insight

    You cannot do everything – and you probably wouldn’t want to. Make educated decisions about which projects are most important and why.

    Apply your variable criteria to your initiatives

    Identify easy-win tasks and high-value projects worth fighting for.
    Categorize the Initiative
    Select the gap initiative type from the down list. Each category (Must, Should, Could, and Won’t) is considered to be an “execution wave.” There is also a specific order of operations within each wave. Based on dependencies and order of importance, you will execute on some “must-do” items before others.
    Assign Criteria
    For each gap initiative, evaluate it based on your previously defined parameters for each variable.
    • Cost – initial and ongoing
    • Staffing – initial and ongoing
    • Alignment with business
    • Security benefit
    Overall Cost/Effort Rating
    An automatically generated score between 0 and 12. The higher the score attached to the initiative, the more effort required. The must-do, low-scoring items are quick wins and must be prioritized first.
    Screenshot of a table from Info-Tech's Concept of Operations Maturity Assessment Tool with all of the previous table row headers as column headers.

    A financial services organization defined its target security state and created an execution plan

    CASE STUDY
    Industry: Financial Services | Source: Info-Tech Research Group
    Framework Components
    Security Domains & Accompanied Initiatives
    (A portion of completed domains and initiatives)
    CSC began by creating over 100 gap initiatives across Info-Tech’s seven security domains.
    Current-State Assessment Context & Leadership Compliance, Audit & Review Security Prevention
    Gap Initiatives Created 12
    Initiatives
    14
    Initiatives
    45
    Initiatives
    Gap Initiative Prioritization
    Planned Initiative(s)* Initial Cost Ongoing Cost Initial Staffing Ongoing Staffing
    Document Charter Low - ‹$5K Low - ‹$1K Low - ‹1d Low - ‹2 Hour
    Document RACI Low - ‹$5K Low - ‹$1K Low - ‹1d Low - ‹2 Hour
    Expand IR processes Medium - $5K-$50K Low - ‹$1K High - ›2w Low - ‹2 Hour
    Investigate Threat Intel Low - ‹$5K Low - ‹$1K Medium - 1-10d Low - ‹2 Hour
    CSC’s defined low, medium, and high for cost and staffing are specific to the organization.

    CSC then consolidated its initiatives to create less than 60 concise tasks.

    *Initiatives and variables have been changed or modified to maintain anonymity

    Review your prioritized security roadmap

    Review the final Gantt chart to review the expected start and end dates for your security initiatives as part of your roadmap.

    In the Gantt chart, go through each wave in sequence and determine the planned start date and planned duration for each gap initiative. As you populate the planned start dates, take into consideration the resource constraints or dependencies for each project. Go back and revise the granular execution wave to resolve any conflicts you find.

    Screenshot of a 'Gantt Chart for Initiatives', a table with planned and actual start times and durations for each initiative, and beside it a roadmap with the dates from the Gantt chart plugged in.
    Review considerations
    • Does this roadmap make sense for our organization?
    • Do we focus too much on one quarter over others?
    • Will the business be going through any significant changes during the upcoming years that will directly impact this project?
    This is a living management document
    • You can use the same process on a per-case basis to decide where this new project falls in the priority list, and then add it to your Gantt chart.
    • As you make progress, check items off of the list, and periodically use this chart to retroactively update your progress towards achieving your overall target state.

    Consult an Info-Tech Analyst

    To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    Onsite workshops offer an easy way to accelerate your project. If a Guided Implementation isn’t enough, we offer low-cost onsite delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to successfully complete your project.
    Photo of TJ Minichillo, Senior Director – Security, Risk & Compliance, Info-Tech Research Group. TJ Minichillo
    Senior Director – Security, Risk & Compliance
    Info-Tech Research Group
    Edward Gray, Consulting Analyst – Security, Risk & Compliance, Info-Tech Research Group. Edward Gray
    Consulting Analyst – Security, Risk & Compliance
    Info-Tech Research Group
    Photo of Celine Gravelines, Research Manager – Security, Risk & Compliance, Info-Tech Research Group. Celine Gravelines
    Research Manager – Security, Risk & Compliance
    Info-Tech Research Group
    If you are not communicating, then you are not secure.

    Call 1-888-670-8889 or email workshops@infotech.com for more information.

    Are you ready to move on to the next phase?

    Self-Assessment Questions

    • Have you identified your organization’s corporate goals along with your obligations?
    • Have you defined the scope and boundaries of your security program?
    • Have you determined your organization’s risk tolerance level?
    • Have you considered threat types your organization may face?
    • Are the above answers documented in the Security Requirements Gathering Tool?
    • Have you defined your maturity for both your current and target state?
    • Do you have clearly defined initiatives that would bridge the gap between your current and target state?
    • Are each of the initiatives independent, specific, and relevant to the associated control?
    • Have you indicated any dependencies between your initiatives?
    • Have you consolidated your gap initiatives?
    • Have you defined the parameters for each of the prioritization variables (cost, effort, alignment, and security benefit)?
    • Have you applied prioritization parameters to each consolidated initiative?
    • Have you recorded your final prioritized roadmap in the Gantt chart tab?
    • Have you reviewed your final Gantt chart to ensure it aligns to your security requirements?

    If you answered “yes” to the questions, then you are ready to move on to Phase 3: Define Operational Interdependencies

    Develop a Security Operations Strategy

    PHASE 3

    Define Operational Interdependencies

    1

    Assess Operational Requirements

    2

    Develop Maturity Initiatives

    3

    Define Interdependencies

    This step will walk you through the following activities:

    • Understand the current security operations process flow.
    • Define the security operations stakeholders and their respective deliverables.
    • Formalize an internal information sharing and collaboration plan.

    Outcomes of this step

    • A formalized security operations interaction agreement.
    • A security operations service and product catalog.
    • A structured operations collection plan.

    Info-Tech Insight

    If you are not communicating, you are not secure. Collaboration eliminates siloed decisions by connecting people, processes, and technologies. You leave less room for error, consume fewer resources, and improve operational efficiency with a transparent security operations process.

    Tie everything together with collaboration

    If you are not communicating, you are not secure. Collaboration eliminates siloed decisions by connecting people, processes, and technologies. You leave less room for error, consume fewer resources, and improve operational efficiency with a transparent security operations process.

    Define Strategic Needs and Requirements Participate in Information Sharing Communicate Clearly
    • Establish a channel to communicate management needs and requirements and define important workflow activities. Focus on operationalizing those components.
    • Establish a feedback loop to ensure your actions satisfied management’s criteria.
    • Consolidate critical security data within a centralized portal that is accessible throughout the threat collaboration environment, reducing the human capital resources required to manage that data.
    • Participate in external information sharing groups such as ISACs. Intelligence collaboration allows organizations to band together to decrease risk and protect one another from threat actors.
    • Disseminate relevant information in clear and succinct alerts, reports, or briefings.
    • Security operations analysts must be able to translate important technical security issues and provide in-depth strategic insights.
    • Define your audience before presenting information; various stakeholders will interpret information differently. You must present it in a format that appeals to their interests.
    • Be transparent in your communications. Holding back information will only serve to alienate groups and hinder critical business decisions.

    Info-Tech Best Practice

    Simple collaborative activities, such as a biweekly meeting, can unite prevention, detection, analysis, and response teams to help prevent siloed decision making.

    Understand the security operations process flow

    Process standardization and automation is critical to the effectiveness of security operations.

    Process flow for security operations with column headers 'Monitoring', 'Preliminary Analysis (Tier 1)', 'Triage', 'Investigation & Analysis (Tier 2)', 'Response', and 'Advanced Threat Detection (Tier 3)'. All processes begin with elements in the 'Monitoring' column and end up at 'Visualization & Dashboarding'.

    Document your security operations’ capabilities and tasks

    Table of capabilities and tasks for security operations.
    Document your security operations’ functional capabilities and operational tasks to satisfy each capability. What resources will you leverage to complete the specific task/capability? Identify your internal and external collection sources to satisfy the individual requirement. Identify the affiliated product, service, or output generated from the task/capability. Determine your escalation protocol. Who are the stakeholders you will be sharing this information with?
    Capabilities

    The major responsibilities of a specific function. These are the high-level processes that are expected to be completed by the affiliated employees and/or stakeholders.

    Tasks

    The specific and granular tasks that need to be completed in order to satisfy a portion of or the entire capability.

    Download Info-Tech’s Security Operations RACI Chart & Program Plan.

    Convert your results into actionable process flowcharts

    Map each functional task or capability into a visual process-flow diagram.

    • The title should reflect the respective capability and product output.
    • List all involved stakeholders (inputs and threat escalation protocol) along the left side.
    • Ensure all relevant security control inputs are documented within the body of the process-flow diagram.
    • Map out the respective processes in order to achieve the desired outcome.
    • Segment each process within its own icon and tie that back to the respective input.
    Example of a process flow made with sticky notes.

    Title: Output #1 Example of a process flow diagram with columns 'Stakeholders', 'Input Processes', 'Output Processes', and 'Threat Escalation Protocol'. Processes are mapped by which stakeholder and column they fall to.

    Download Info-Tech’s Security Operations RACI Chart & Program Plan.

    Formalize the opportunities for collaboration within your security operations program

    Security Operations Collaboration Plan

    Security operations provides a single pane of glass through which the threat collaboration environment can manage its operations.

    How to customize

    The security operations interaction agreement identifies opportunities for optimization through collaboration and cross-training. The document is composed of several components:

    • Security operations program scope and objectives
    • Operational capabilities and outputs on a per function basis
    • A needs and requirements collection plan
    • Escalation protocol and respective information-sharing guidance (i.e. a detailed cadence schedule)
    • A security operations RACI chart
    Sample of Info-Tech's Security Operations Collaboration Plan.

    Info-Tech Best Practice

    Understand the operational cut-off points. While collaboration is encouraged, understand when the onus shifts to the rest of the threat collaboration environment.

    Assign responsibilities for the threat management process

    Security Operations RACI Chart & Program Plan

    Formally documenting roles and responsibilities helps to hold those accountable and creates awareness as to everyone’s involvement in various tasks.

    How to customize
    • Customize the header fields with applicable stakeholders.
    • Identify stakeholders that are:
      • Responsible: The person(s) who does the work to accomplish the activity; they have been tasked with completing the activity and/or getting a decision made.
      • Accountable: The person(s) who is accountable for the completion of the activity. Ideally, this is a single person and is often an executive or program sponsor.
      • Consulted: The person(s) who provides information. This is usually several people, typically called subject matter experts (SMEs).
      • Informed: The person(s) who is updated on progress. These are resources that are affected by the outcome of the activities and need to be kept up to date.
    Sample of Info-Tech's Security Operations Collaboration Plan.

    Download Info-Tech’s Security Operations RACI Chart & Program Plan.

    Identify security operations consumers and their respective needs and requirements

    Ensure your security operations program is constantly working toward satisfying a consumer need or requirement.

    Internal Consumers External Consumers
    • Business Executives & Management (CIO, CISO, COO):
      • Inform business decisions regarding threats and their association with future financial risk, reputational risk, and continuity of operations.
    • Human Resources:
      • Security operations must directly work with HR to enforce tight device controls, develop processes, and set expectations.
    • Legal:
      • Security operations is responsible to notify the legal department of data breaches and the appropriate course of action.
    • Audit and Compliance:
      • Work with the auditing department to define additional audits or controls that must be measured.
    • Public Relations/Marketing Employees:
      • Employees must be educated on prevalent threats and how to avoid or mitigate them.

    Note: Your organization might not be the final target, but it could be a primary path for attackers. If you exist as a third-party partner to another organization, your responsibility in your technology ecosystem extends beyond your own product or service offerings.

    • Third-Party Contractors:
      • Identify relevant threats across industries – security operations is responsible for protecting more than just itself.
    • Commercial Vendors:
      • Identify commercial vendors of control failures and opportunities for operational improvement.
    • Suppliers:
      • Provide or maintain a certain level of security delivery.
      • Meet the same level of security that is expected of business units.
    • All End Users:
      • Be notified of any data breaches and potential violations of privacy.

    Info-Tech Best Practice

    “In order to support a healthy constituency, network operations and security operations should be viewed as equal partners, rather than one subordinate to the other.” (Mitre world-class CISO)

    Define the stakeholders, their respective outputs, and the underlying need

    Security Operations Program Service & Product Catalog

    Create an informal security operations program service and product catalog. Work your way backwards – map each deliverable to the respective stakeholders and functions.

    Action/Output Arrow pointing right. Frequency Arrow pointing right. Stakeholders/Function
    Document the key services and outputs produced by the security operations program. For example:
    • Real-time monitoring
    • Event analysis and incident coordination
    • Malware analysis
    • External information sharing
    • Published alerts, reports, and briefings
    • Metrics
    Define the frequency for which each deliverable or service is produced or conducted. Leverage this activity to establish a state of accountability within your threat collaboration environment. Identify the stakeholders or groups affiliated with each output. Remember to include potential MSSPs.
    • Vulnerability Management
    • Threat Intelligence
    • Tier 1, 2, and 3 Analysts
    • Incident Response
    • MSSP
    • Network Operations
    Remember to include any target-state outputs or services identified in the maturity assessment. Use this exercise as an opportunity to organize your security operations outputs and services.

    Info-Tech Best Practice

    Develop a central web/knowledge portal that is easily accessible throughout the threat collaboration environment.

    Internal information sharing helps to focus operational efforts

    Organizations must share information internally and through secure external information sharing and analysis centers (ISACs).

    Ensure information is shared in a format that relates to the particular end user. Internal consumers fall into two categories:

    • Strategic Users — Intelligence enables strategic stakeholders to better understand security trends, minimize risk, and make more educated and informed decisions. The strategic intelligence user often lacks technical security knowledge; bridge the communication gap between security and non-technical decision makers by clearly communicating the underlying value and benefits.
    • Operational Users — Operational users integrate information and indicators directly into their daily operations and as a result have more in-depth knowledge of the technical terms. Reports help to identify escalated alerts that are part of a bigger campaign, provide attribution and context to attacks, identify systems that have been compromised, block malicious URLs or malware signatures in firewalls, IDPS systems, and other gateway products, identify patches, reduce the number of incidents, etc.
    Collaboration includes the exchange of:
    • Contextualized threat indicators, threat actors, TTPs, and campaigns.
    • Attribution of the attack, motives of the attacker, victim profiles, and frequent exploits.
    • Defensive and mitigation strategies.
    • Best-practice incident response procedures.
    • Technical tools to help normalize threat intelligence formats or decode malicious network traffic.
    Collaboration can be achieved through:
    • Manual unstructured exchanges such as alerts, reports, briefings, knowledge portals, or emails.
    • Automated centralized platforms that allow users to privately upload, aggregate, and vet threat intelligence. Current players include commercial, government, and open-source information-sharing and analysis centers.
    Isolation prevents businesses from learning from each others’ mistakes and/or successes.

    Define the routine of your security operations program in a detailed cadence schedule

    Security Operations Program Cadence Schedule Template

    Design your meetings around your security operations program’s outputs and capabilities

    How to customize

    Don’t operate in a silo. Formalize a cadence schedule to develop a state of accountability, share information across the organization, and discuss relevant trends. A detailed cadence schedule should include the following:

    • Activity, output, or topic being discussed.
    • Participants and stakeholders involved.
    • Value and purpose of meeting.
    • Duration and frequency of each meeting.
    • Investment per participant per meeting.
    Sample of Info-Tech's Security Operations Program Cadence Schedule Template.

    Info-Tech Best Practice

    Schedule regular meetings composed of key members from different working groups to discuss concerns, share goals, and communicate operational processes pertaining to their specific roles.

    Apply a strategic lens to your security operations program

    Frame the importance of optimizing the security operations program to align with that of the decision makers’ overarching strategy.

    Strategies
    1. Bridge the communication gap between security and non-technical decision makers. Communicate concisely in business-friendly terms.
    2. Quantify the ROI for the given project.
    3. Educate stakeholders – if stakeholders do not understand what a security operations program encompasses, it will be hard for them to champion the initiative.
    4. Communicate the implications, value, and benefits of a security operations program.
    5. Frame the opportunity as a competitive advantage, e.g. proactive security measures as a client acquisition strategy.
    6. Address the increasing prevalence of threat actors. Use objective data to demonstrate the impact, e.g. through case studies, recent media headlines, or statistics.

    Defensive Strategy diagram with columns 'Adversaries', 'Defenses', 'Assets', and priority level.
    (Source: iSIGHT, “ Definitive Guide to Threat Intelligence”)

    Info-Tech Best Practice

    Refrain from using scare tactics such as fear, uncertainty, and doubt (FUD). While this may be a short-term solution, it limits the longevity of your operations as senior management is not truly invested in the initiative.

    Example: Align your strategic needs with that of management.

    Identify assets of value, current weak security measures, and potential adversaries. Demonstrate how an optimized security operations program can mitigate those threats.

    Develop a comprehensive measurement program to evaluate the effectiveness of your security operations

    There are three types of metrics pertaining to security operations:

    1) Operations-focused

    Operations-focused metrics are typically communicated through a centralized visualization such as a dashboard. These metrics guide operational efforts, identifying operational and control weak points while ensuring the appropriate actions are taken to fix them.

    Examples include, but are not limited to:

    • Ticketing metrics (e.g. average ticket resolution rate, ticketing status, number of tickets per queue/analyst).
    • False positive percentage per control.
    • Incident response metrics (e.g. mean time to recovery).
    • CVSS scores per vulnerability.

    2) Business-focused

    The evaluation of operational success from a business perspective.

    Example metrics include:

    • Return on investment.
    • Total cost of ownership (can be segregated by function: prevent, detect, analyze, and respond).
    • Saved costs from mitigated breaches.
    • Security operations budget as a percentage of the IT budget.

    3) Initiative-focused

    The measurement of security operations project progress. These are frequently represented as time, resource, or cost-based metrics.

    Note: Remember to measure end-user feedback. Asking stakeholders about their current expectations via a formal survey is the most effective way to kick-start the continuous improvement process.

    Info-Tech Best Practice

    Operational metrics have limited value beyond security operations – when communicating to management, focus on metrics that are actionable from a business perspective.

    Download Info-Tech’s Security Operations Metrics Summary Document.Sample of Info-Tech's Security Operations Metrics Summary Document.

    Identify the triggers for continual improvement

    Continual Improvement

    • Audits: Check for performance requirements in order to pass major audits.
    • Assessments: Variances in efficiency or effectiveness of metrics when compared to the industry standard.
    • Process maturity: Opportunity to increase efficiency of services and processes.
    • Management reviews: Routine reviews that reveal gaps.
    • Technology advances: For example, new security architecture/controls have been released.
    • Regulations: Compliance to new or changed regulations.
    • New staff or technology: Disruptive technology or new skills that allow for improvement.

    Conduct tabletop exercises with Info-Tech’s onsite workshop

    Assess your security operations capabilities

    Leverage Info-Tech’s Security Operations Tabletop Exercise to guide simulations to validate your operational procedures.

    How to customize
    • Use the templates to document actions and actors.
    • For each new injection, spend three minutes discussing the response as a group. Then spend two minutes documenting each role’s contribution to the response. After the time limit, proceed to the following injection scenario.
    • Review the responses only after completing the entire exercise.
    Sample of Info-Tech's Security Operations Tabletop Exercise.

    This tabletop exercise is available through an onsite workshop as we can help establish and design a tabletop capability for your organization.

    Are you ready to implement your security operations program?

    Self-Assessment Questions

    • Is there a formalized security operations collaboration plan?
    • Are all key stakeholders documented and acknowledged?
    • Have you defined your strategic needs and requirements in a formalized collection plan?
    • Is there an established channel for management to communicate needs and requirements to the security operation leaders?
    • Are all program outputs documented and communicated?
    • Is there an accessible, centralized portal or dashboard that actively aggregates and communicates key information?
    • Is there a formalized threat escalation protocol in order to facilitate both internal and external information sharing?
    • Does your organization actively participate in external information sharing through the use of ISACs?
    • Does your organization actively produce reports, alerts, products, etc. that feed into and influence the output of other functions’ operations?
    • Have you assigned program responsibilities in a detailed RACI chart?
    • Is there a structured cadence schedule for key stakeholders to actively communicate and share information?
    • Have you developed a structured measurement program on a per function basis?
    • Now that you have constructed your ideal security operations program strategy, revisit the question “Are you answering all of your objectives?”

    If you answered “yes” to the questions, then you are ready to implement your security operations program.

    Summary

    Insights

    1. Security operations is no longer a center, but a process. The need for a physical security hub has evolved into the virtual fusion of prevention, detection, analysis, and response efforts. When all four functions operate as a unified process, your organization will be able to proactively combat changes in the threat landscape.
    2. Functional threat intelligence is a prerequisite for effective security operations – without it, security operations will be inefficient and redundant. Eliminate false positives by contextualizing threat data, aligning intelligence with business objectives, and building processes to satisfy those objectives
    3. If you are not communicating, then you are not secure. Collaboration eliminates siloed decisions by connecting people, processes, and technologies. You leave less room for error, consume fewer resources, and improve operational efficiency with a transparent security operations process.

    Best Practices

    • Have a structured plan of attack. Define your unique threat landscape, as well as business, regulatory, and consumer obligations.
    • Foster both internal and external collaboration.
    • Understand the operational cut-off points. While collaboration is encouraged, understand when the onus shifts to the rest of the threat collaboration environment.
    • Do not bite off more than you can chew. Identify current people, processes, and technologies that satisfy immediate problems and enable future expansion.
    • Leverage threat intelligence to create a predictive and proactive security operations analysis process.
    • Formalize escalation procedures with logic and incident management flow.
    • Don’t develop a security operations program with the objective of zero incidents. This reliance on prevention results in over-engineered security solutions that cost more than the assets being protected.
    • Ensure that information flows freely throughout the threat collaboration environment – each function should serve to feed and enhance the next.
    • Develop a central web/knowledge portal that is easily accessible throughout the threat collaboration environment
    Protect your organization with an interdependent and collaborative security operations program.

    Bibliography

    “2016 State of Cybersecurity in Small & Medium-Sized Businesses (SMB).” Ponemon Institute, June 2016. Web. 10 Nov. 2016.

    Ahmad, Shakeel et al. “10 Tips to Improve Your Security Incident Readiness and Response.” RSA, n.d. Web. 12 Nov. 2016.

    Anderson, Brandie. “ Building, Maturing & Rocking a Security Operations Center.” Hewlett Packard, n.d. Web. 4 Nov. 2016.

    Barnum, Sean. “Standardizing cyber threat intelligence information with the structured threat information expression.” STIX, n.d. Web. 03 Oct. 2016.

    Bidou, Renaud. “Security Operation Center Concepts & Implementation.” IV2-Technologies, n.d. Web. 20 Nov. 2016.

    Bradley, Susan. “Cyber threat intelligence summit.” SANS Institute InfoSec Reading Room, n.d. Web. 03 Oct. 2016.

    “Building a Security Operations Center.” DEF CON Communications, Inc., 2015. Web. 14 Nov. 2016.

    “Building a Successful Security Operations Center.” ArcSight, 2015. Web. 21 Nov. 2016.

    “Building an Intelligence-Driven Security Operations Center.” RSA, June 2014. Web. 25 Nov. 2016.

    Caltagirone, Sergio, Andrew Pendergast, and Christopher Betz. “Diamond Model of Intrusion Analysis,” Center for Cyber Threat Intelligence and Threat Research, 5 July 2013. Web. 25 Aug. 2016.

    “Cisco 2017 Annual Cybersecurity Report: Chief Security Officers Reveal True Cost of Breaches and the Actions Organizations Are Taking.” The Network. Cisco, 31 Jan. 2017. Web. 11 Nov. 2017.

    “CITP Training and Education.” Carnegie Mellon University, 2015. Web. 03 Oct. 2016.

    “Creating and Maintaining a SOC.” Intel Security, n.d. Web. 14 Nov. 2016.

    “Cyber Defense.” Mandiant, 2015. Web. 10 Nov. 2016.

    “Cyber Security Operations Center (CSOC).” Northrop Grumman, 2014. Web. 14 Nov. 2016.

    Danyliw, Roman. “Observations of Successful Cyber Security Operations.” Carnegie Mellon, 12 Dec. 2016. Web. 14 Dec. 2016.

    “Designing and Building Security Operations Center.” SearchSecurity. TechTarget, Mar. 2016. Web. 14 Dec. 2016.

    EY. “Managed SOC.” EY, 2015. Web. 14 Nov. 2016.

    Fishbach, Nicholas. “How to Build and Run a Security Operations Center.” Securite.org, n.d. Web. 20 Nov. 2016.

    “Framework for improving critical infrastructure cybersecurity.” National Institute of Standards and Technology, 12 Feb. 2014. Web.

    Friedman, John, and Mark Bouchard. “Definitive Guide to Cyber Threat Intelligence.” iSIGHT, 2015. Web. 1 June 2015.

    Goldfarb, Joshua. “The Security Operations Hierarchy of Needs.” Securityweek.com, 10 Sept. 2015. Web. 14 Dec. 2016.

    “How Collaboration Can Optimize Security Operations.” Intel, n.d. Web. 2 Nov. 2016.

    Hslatman. “Awesome threat intelligence.” GitHub, 16 Aug. 2016. Web. 03 Oct. 2016.

    “Implementation Framework – Collection Management.” Carnegie Mellon University, 2015. Web.

    “Implementation Framework – Cyber Threat Prioritization.” Carnegie Mellon University, 03 Oct. 2016. Web. 03 Oct. 2016.

    “Intelligent Security Operations Center.” IBM, 25 Feb. 2015. Web. 15 Nov. 2016.

    Joshi Follow , Abhishek. “Best Practices for Security Operations Center.” LinkedIn, 01 Nov. 2015. Web. 14 Nov. 2016.

    Joshi. “Best Practices for a Security Operations Center.” Cybrary, 18 Sept. 2015. Web. 14 Dec. 2016.

    Kelley, Diana and Ron Moritz. “Best Practices for Building a Security Operations Center.” Information Security Today, 2006. Web. 10 Nov. 2016.

    Killcrece, Georgia, Klaus-Peter Kossakowski, Robin Ruefle, and Mark Zajicek. ”Organizational Models for Computer Security Incident Response Teams (CSIRTs).” Carnegie Mellon Software Engineering Institute, Dec. 2003. Carnegie Mellon. Web. 10 Nov. 2016.

    Kindervag , John. “SOC 2.0: Three Key Steps toward the Next-generation Security Operations Center.” SearchSecurity. TechTarget, Dec. 2010. Web. 14 Dec. 2016.

    Kvochko, Elena. “Designing the Next Generation Cyber Security Operations Center.” Forbes Magazine, 14 Mar. 2016. Web. 14 Dec. 2016.

    Lambert, P. “ Security Operations Center: Not Just for Huge Enterprises.” TechRepublic, 31 Jan. 2013. Web. 10 Nov. 2016.

    Lecky, M. and D. Millier. “Re-Thinking Security Operations.” SecTor Security Education Conference. Toronto, 2014.

    Lee, Michael. “Three Elements That Every Advanced Security Operations Center Needs.” CSO | The Resource for Data Security Executives, n.d. Web. 16 Nov. 2016.

    Linch, David and Jason Bergstrom. “Building a Culture of Continuous Improvement in an Age of Disruption.” Deloitte LLP, 2014.

    Lynch, Steve. “Security Operations Center.” InfoSec Institute, 14 May 2015. Web. 14 Dec. 2016.

    Macgregor, Rob. “Diamonds or chains – cyber security updates.” PwC, n.d. Web. 03 Oct. 2016.

    “Make Your Security Operations Center (SOC) More Efficient.” Making Your Data Center Energy Efficient (2011): 213-48. Intel Security. Web. 20 Nov. 2016.

    Makryllos, Gordon. “The Six Pillars of Security Operations.” CSO | The Resource for Data Security Executives, n.d. Web. 14 Nov. 2016.

    Marchany, R. “ Building a Security Operations Center.” Virginia Tech, 2015. Web. 8 Nov. 2016.

    Marty, Raffael. “Dashboards in the Security Operations Center (SOC).” Security Bloggers Network, 15 Jan. 2016. Web. 14 Nov. 2016.

    Minu, Adolphus. “Discovering the Value of Knowledge Portal.” IBM, n.d. Web. 1 Nov. 2016.

    Muniz, J., G. McIntyre, and N. AlFardan. “Introduction to Security Operations and the SOC.” Security Operations Center: Building, Operating, and Maintaining your SOC. Cisco Press, 29 Oct. 2015. Web. 14 Nov. 2016.

    Muniz, Joseph and Gary McIntyre. “ Security Operations Center.” Cisco, Nov. 2015. Web. 14 Nov. 2016.

    Muniz, Joseph. “5 Steps to Building and Operating an Effective Security Operations Center (SOC).” Cisco, 15 Dec. 2015. Web. 14 Dec. 2016.

    Nathans, David. Designing and Building a Security Operations Center. Syngress, 2015. Print.

    National Institute of Standards and Technology. “SP 800-61 Revision 2: Computer Security Incident Handling Guide.” 2012. Web.

    National Institute of Standards and Technology. “SP 800-83 Revision 1.” 2013. Web.

    National Institute of Standards and Technology. “SP 800-86: Guide to Integrating Forensic Techniques into Incident Response.” 2006. Web.

    F5 Networks. “F5 Security Operations Center.” F5 Networks, 2014. Web. 10 Nov. 2016.

    “Next Generation Security Operations Center.” DTS Solution, n.d. Web. 20 Nov. 2016.

    “Optimizing Security Operations.” Intel, 2015. Web. 4 Nov. 2016.

    Paganini, Pierluigi. “What Is a SOC ( Security Operations Center)?” Security Affairs, 24 May 2016. Web. 14 Dec. 2016.

    Ponemon Institute LLC. “Cyber Security Incident Response: Are we as prepared as we think?” Ponemon, 2014. Web.

    Ponemon Institute LLC. “The Importance of Cyber Threat Intelligence to a Strong Security Posture.” Ponemon, Mar. 2015. Web. 17 Aug. 2016.

    Poputa-Clean, Paul. “Automated defense – using threat intelligence to augment.” SANS Institute InfoSec Reading Room, 15 Jan. 2015. Web.

    Quintagroup. “Knowledge Management Portal Solution.” Quintagroup, n.d. Web.

    Rasche, G. “Guidelines for Planning an Integrated Security Operations Center.” EPRI, Dec. 2013. Web. 25 Nov. 2016.

    Rehman, R. “What It Really Takes to Stand up a SOC.” Rafeeq Rehman – Personal Blog, 27 Aug. 2015. Web. 14 Dec. 2016.

    Rothke, Ben. “Designing and Building Security Operations Center.” RSA Conference, 2015. Web. 14 Nov. 2016.

    Ruks, Martyn and David Chismon. “Threat Intelligence: Collecting, Analysing, Evaluating.” MWR Infosecurity, 2015. Web. 24 Aug. 2016.

    Sadamatsu, Takayoshi. “Practice within Fujitsu of Security Operations Center.” Fujitsu, July 2016. Web. 15 Nov. 2016.

    Sanders, Chris. “Three Useful SOC Dashboards.” Chris Sanders, 24 Oct. 2016. Web. 14 Nov. 2016.

    SANS Institute. “Incident Handler's Handbook.” 2011. Web.

    Schilling, Jeff. “5 Pitfalls to Avoid When Running Your SOC.” Dark Reading, 18 Dec. 2014. Web. 14 Nov. 2016.

    Schinagl, Stef, Keith Schoon, and Ronald Paans. “A Framework for Designing a Security Operations Centre (SOC).” 2015 48th Hawaii International Conference on System Sciences. Computer.org, 2015. Web. 20 Nov. 2016.

    “Security – Next Gen SOC or SOF.” InfoSecAlways.com, 31 Dec. 2013. Web. 14 Nov. 2016.

    “Security Operations Center Dashboard.” Enterprise Dashboard Digest, n.d. Web. 14 Dec. 2016.

    “Security Operations Center Optimization Services.” AT&T, 2015. Web. 5 Nov. 2016.

    “Security Operations Centers — Helping You Get Ahead of Cybercrime Contents.” EY, 2014. Web. 6 Nov. 2016.

    Sheikh, Shah. “DTS Solution - Building a SOC (Security Operations Center).” LinkedIn, 4 May 2013. Web. 20 Nov. 2016.

    Soto, Carlos. “ Security Operations Center (SOC) 101.” Tom's IT Pro, 28 Oct. 2015. Web. 14 Dec. 2016.

    “Standardizing and Automating Security Operations.” National Institute of Standards and Technology, 3 Sept. 2006. Web.

    “Strategy Considerations for Building a Security Operations Center.” IBM, Dec. 2013. Web. 5 Nov. 2016.

    “Summary of Key Findings.” Carnegie Mellon University, 03 Oct. 2016. Web. 03 Oct. 2016.

    “Sustainable Security Operations.” Intel, 2016. Web. 20 Nov. 2016.

    “The Cost of Malware Containment.” Ponemon Institute, Jan. 2015. Web.

    “The Game Plan for Closing the SecOps Gap.” BMC. Forbes Magazine, Jan. 2016. Web. 10 Jan. 2017.

    Veerappa Srinivas, Babu. “Security Operations Centre (SOC) in a Utility Organization.” GIAC, 17 Sept. 2014. Web. 5 Nov. 2016.

    Wang, John. “Anatomy of a Security Operations Center.” NASA, 2015. Web. 2 Nov. 2016.

    Weiss, Errol. “Statement for the Record.” House Financial Services Committee, 1 June 2012. Web. 12 Nov. 2016.

    Wilson, Tim. “SOC 2.0: A Crystal-Ball Glimpse of the Next-Generation Security Operations Center.” Dark Reading, 22 Nov. 2010. Web. 10 Nov. 2016.

    Zimmerman, Carson. “Ten Strategies of a World-Class Cybersecurity Operations Center.” Mitre, 2014. Web. 24 Aug. 2016.

    Optimize Your SQA Practice Using a Full Lifecycle Approach

    • Buy Link or Shortcode: {j2store}405|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
    • member rating average days saved: Read what our members are saying
    • Parent Category Name: Testing, Deployment & QA
    • Parent Category Link: /testing-deployment-and-qa
    • Your software quality assurance (SQA) program is using the wrong set of metrics to measure how process improvements influence product quality improvements.
    • Roles & responsibilities and quality assurance initiatives are not well defined and need to be allocated to individuals that can be held responsible for quality-related issues.
    • You are finding it hard to determine a causation between SQA process improvements and an improvement in product quality.

    Our Advice

    Critical Insight

    • Your product is only as good as your process. A robust development and SQA process creates artifacts that are highly testable, easily maintained, and strongly traceable across the development lifecycle, ensuring that the product delivered meets expectations set out by the business.
    • A small issue within your development process can have a ripple effect on the level of product quality. Discover what you don’t know and identify areas within your SQA practice that require attention.

    Impact and Result

    • SQA must be viewed as more than defect analysis and testing. Instead, place greater emphasis on preventative measures to ensure application quality across the entire development lifecycle.
    • IT must create a comprehensive SQA plan that delineates roles and responsibilities as they relate to quality assurance. Ensure tasks and procedures improve process efficiency and quality, and formalize metrics that help to implement a continuous improvement cycle for SQA.
    • Our methodology provides simple-to-follow steps to develop an SQA plan that provides clear insight into your current quality assurance practices.
    • Establish a synchronous relationship between the business and IT to help stakeholders understand the importance and relative value of quality assurance tasks to current costs.

    Optimize Your SQA Practice Using a Full Lifecycle Approach Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should optimize your SQA practice using a full lifecycle approach, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Assess your current SQA capabilities

    Evaluate and understand your current SQA capabilities, as well as the degree to which metric objectives are being met.

    • Optimize Your SQA Practice Using a Full Lifecycle Approach – Phase 1: Assess Your Current SQA Capabilities
    • Software Quality Assurance Current State Assessment Tool
    • Software Quality Assurance Assessment Workbook

    2. Define SQA target state processes

    Identify and define SQA processes and metrics needed to meet quality objectives set by development teams and the business.

    • Optimize Your SQA Practice Using a Full Lifecycle Approach – Phase 2: Define SQA Target State Processes

    3. Determine optimization initiatives for improving your SQA practice

    Build your SQA plan and optimization roadmap.

    • Optimize Your SQA Practice Using a Full Lifecycle Approach – Phase 3: Determine Optimization Initiatives
    • Software Quality Assurance Plan Template
    • Software Quality Assurance Optimization Roadmap Tool
    • Software Quality Assurance Communication Template
    [infographic]

    Workshop: Optimize Your SQA Practice Using a Full Lifecycle Approach

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Assess Your Current SQA Capabilities

    The Purpose

    To help you assess and understand your current SQA capabilities as well as the degree to which metric objectives are being met.

    Key Benefits Achieved

    An analysis of current SQA practices to provide insight into potential inefficiencies, opportunities, and to provide the business with sufficient rationale for improving current quality assurance initiatives.

    Activities

    1.1 Conduct a high-level assessment of where to focus your current state analysis.

    1.2 Document your high-level development process.

    1.3 Create a RACI chart to understand roles and responsibilities.

    1.4 Perform a SIPOC-MC analysis for problem areas identified in your SDLC.

    1.5 Identify the individual control points involved with passing software artifacts through SDLC stages being assessed.

    1.6 Identify problem areas within your SDLC as they relate to SQA.

    Outputs

    Understanding of current overall development process and where it is most weak in the context of quality assurance

    Understanding of assigned roles and responsibilities across development teams, including individuals who are involved with making quality-related decisions for artifact hand-off

    Identification of problem areas within SQA process for further analysis

    2 Define SQA Target State Processes

    The Purpose

    To help you identify and define SQA processes and metrics needed to meet quality objectives set out by development teams and the business.

    Key Benefits Achieved

    A revised list of key SQA tasks along with metrics and associated tolerance limits used universally for all development projects.

    Activities

    2.1 Establish SQA metrics and tolerance limits across your SDLC.

    2.2 Determine your target state for SQA processes within the define/design stage of the SDLC.

    2.3 Determine your target state for SQA processes within the development stage of the SDLC.

    2.4 Determine your target state for SQA processes within the testing stage of the SDLC.

    2.5 Determine your target state for SQA processes within the deploy/release stage of the SDLC.

    Outputs

    Identification of the appropriate metrics and their associated tolerance limits to provide insights into meeting quality goals and objectives during process execution

    Identification of target state SQA processes that are required for ensuring quality across all development projects

    3 Prioritize SQA Optimization Initiatives and Develop Optimization Roadmap

    The Purpose

    Based on discovered inefficiencies, define optimization initiatives required to improve your SQA practice.

    Key Benefits Achieved

    Optimization initiatives and associated tasks required to address gaps and improve SQA capabilities.

    Activities

    3.1 Determine optimization initiatives for improving your SQA process.

    3.2 Gain the full scope of effort required to implement your SQA optimization initiatives.

    3.3 Identify the enablers and blockers of your SQA optimization.

    3.4 Define your SQA optimization roadmap.

    Outputs

    Prioritized list of optimization initiatives for SQA

    Assessment of level of effort for each SQA optimization initiative

    Identification of enablers and blockers for optimization initiatives

    Identification of roadmap timeline for implementing optimization initiatives

    Perform an Agile Skills Assessment

    • Buy Link or Shortcode: {j2store}153|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: $32,166 Average $ Saved
    • member rating average days saved: 15 Average Days Saved
    • Parent Category Name: Development
    • Parent Category Link: /development
    • Your organization is trying to address the key delivery challenges you are facing. Early experiments with Agile are starting to bear fruit.
    • As part of maturing your Agile practice, you want to evaluate if you have the right skills and capabilities in place.

    Our Advice

    Critical Insight

    • Focusing on the non-technical skills can yield significant returns for your products, your team, and your organization. These skills are what should be considered as the real Agile skills.

    Impact and Result

    • Define the skills and values that are important to your organization to be successful at being Agile.
    • Put together a standard criterion for measurement of the attainment of given skills.
    • Define the roadmap and communication plan around your agile assessment.

    Perform an Agile Skills Assessment Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should perform an agile skills assessment. review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Take stock of the Agile skills and values important to you

    Confirm the list of Agile skills that you wish to measure.

    • Perform an Agile Skills Assessment – Phase 1: Take Stock of the Agile Skills and Values Important to You
    • Agile Skills Assessment Tool
    • Agile Skills Assessment Tool Example

    2. Define an assessment method that works for you

    Define what it means to attain specific agile skills through a defined ascension path of proficiency levels, and standardized skill expectations.

    • Perform an Agile Skills Assessment – Phase 2: Define an Assessment Method That Works for You

    3. Plan to assess your team

    Determine the roll-out and communication plan that suits your organization.

    • Perform an Agile Skills Assessment – Phase 3: Plan to Assess Your Team
    • Agile Skills Assessment Communication and Roadmap Plan
    • Agile Skills Assessment Communication and Roadmap Plan Example
    [infographic]

    Workshop: Perform an Agile Skills Assessment

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Define Agile Skills and Maturity Levels

    The Purpose

    Learn about and define the Agile skills that are important to your organization.

    Define the different levels of attainment when it comes to your Agile skills.

    Define the standards on a per-role basis.

    Key Benefits Achieved

    Get a clear view of the Agile skills important into meet your Agile transformation goals in alignment with organizational objectives.

    Set a clear standard for what it means to meet your organizational standards for Agile skills.

    Activities

    1.1 Review and update the Agile skills relevant to your organization.

    1.2 Define your Agile proficiency levels to evaluate attainment of each skill.

    1.3 Define your Agile team roles.

    1.4 Define common experience levels for your Agile roles.

    1.5 Define the skill expectations for each Agile role.

    Outputs

    A list of Agile skills that are consistent with your Agile transformation

    A list of proficiency levels to be used during your Agile skills assessment

    A confirmed list of roles that you wish to measure on your Agile teams

    A list of experience levels common to Agile team roles (example: Junior, Intermediate, Senior)

    Define the skill expectations for each Agile role

    Create a Customized Big Data Architecture and Implementation Plan

    • Buy Link or Shortcode: {j2store}388|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
    • member rating average days saved: Read what our members are saying
    • Parent Category Name: Data Management
    • Parent Category Link: /data-management
    • Big data architecture is different from traditional data for several key reasons, including:
      • Big data architecture starts with the data itself, taking a bottom-up approach. Decisions about data influence decisions about components that use data.
      • Big data introduces new data sources such as social media content and streaming data.
      • The enterprise data warehouse (EDW) becomes a source for big data.
      • Master data management (MDM) is used as an index to content in big data about the people, places, and things the organization cares about.
      • The variety of big data and unstructured data requires a new type of persistence.
    • Many data architects have no experience with big data and feel overwhelmed by the number of options available to them (including vendor options, storage options, etc.). They often have little to no comfort with new big data management technologies.
    • If organizations do not architect for big data, there are a couple of main risks:
      • The existing data architecture is unable to handle big data, which will eventually result in a failure that could compromise the entire data environment.
      • Solutions will be selected in an ad hoc manner, which can cause incompatibility issues down the road.

    Our Advice

    Critical Insight

    • Before beginning to make technology decisions regarding the big data architecture, make sure a strategy is in place to document architecture principles and guidelines, the organization’s big data business pattern, and high-level functional and quality of service requirements.
    • The big data business pattern can be used to determine what data sources should be used in your architecture, which will then dictate the data integration capabilities required. By documenting current technologies, and determining what technologies are required, you can uncover gaps to be addressed in an implementation plan.
    • Once you have identified and filled technology gaps, perform an architectural walkthrough to pull decisions and gaps together and provide a fuller picture. After the architectural walkthrough, fill in any uncovered gaps. A proof-of-technology project can be started as soon as you have evaluation copies (or OSS) products and at least one person who understands the technology.

    Impact and Result

    • Save time and energy trying to fix incompatibilities between technology and data.
    • Allow the Data Architect to respond to big data requests from the business more quickly.
    • Provide the organization with valuable insights through the analytics and visualization technologies that are integrated with the other building blocks.

    Create a Customized Big Data Architecture and Implementation Plan Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Recognize the importance of big data architecture

    Big data is centered on the volume, variety, velocity, veracity, and value of data. Achieve a data architecture that can support big data.

    • Storyboard: Create a Customized Big Data Architecture and Implementation Plan

    2. Define architectural principles and guidelines while taking into consideration maturity

    Understand the importance of a big data architecture strategy. Assess big data maturity to assist with creation of your architectural principles.

    • Big Data Maturity Assessment Tool
    • Big Data Architecture Principles & Guidelines Template

    3. Build the big data architecture

    Come to accurate big data architecture decisions.

    • Big Data Architecture Decision Making Tool

    4. Determine common services needs

    What are common services?

    5. Plan a big data architecture implementation

    Gain business satisfaction with big data requests. Determine what steps need to be taken to achieve your big data architecture.

    • Big Data Architecture Initiative Definition Tool
    • Big Data Architecture Initiative Planning Tool

    Infographic

    Workshop: Create a Customized Big Data Architecture and Implementation Plan

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Recognize the Importance of Big Data Architecture

    The Purpose

    Set expectations for the workshop.

    Recognize the importance of doing big data architecture when dealing with big data.

    Key Benefits Achieved

    Big data defined.

    Understanding of why big data architecture is necessary.

    Activities

    1.1 Define the corporate strategy.

    1.2 Define big data and what it means to the organization.

    1.3 Understand why doing big data architecture is necessary.

    1.4 Examine Info-Tech’s Big Data Reference Architecture.

    Outputs

    Defined Corporate Strategy

    Defined Big Data

    Reference Architecture

    2 Design a Big Data Architecture Strategy

    The Purpose

    Identification of architectural principles and guidelines to assist with decisions.

    Identification of big data business pattern to choose required data sources.

    Definition of high-level functional and quality of service requirements to adhere architecture to.

    Key Benefits Achieved

    Key Architectural Principles and Guidelines defined.

    Big data business pattern determined.

    High-level requirements documented.

    Activities

    2.1 Discuss how maturity will influence architectural principles.

    2.2 Determine which solution type is best suited to the organization.

    2.3 Define the business pattern driving big data.

    2.4 Define high-level requirements.

    Outputs

    Architectural Principles & Guidelines

    Big Data Business Pattern

    High-Level Functional and Quality of Service Requirements Exercise

    3 Build a Big Data Architecture

    The Purpose

    Establishment of existing and required data sources to uncover any gaps.

    Identification of necessary data integration requirements to uncover gaps.

    Determination of the best suited data persistence model to the organization’s needs.

    Key Benefits Achieved

    Defined gaps for Data Sources

    Defined gaps for Data Integration capabilities

    Optimal Data Persistence technology determined

    Activities

    3.1 Establish required data sources.

    3.2 Determine data integration requirements.

    3.3 Learn which data persistence model is best suited.

    3.4 Discuss analytics requirements.

    Outputs

    Data Sources Exercise

    Data Integration Exercise

    Data Persistence Decision Making Tool

    4 Plan a Big Data Architecture Implementation

    The Purpose

    Identification of common service needs and how they differ for big data.

    Performance of an architectural walkthrough to test decisions made.

    Group gaps to form initiatives to develop an Initiative Roadmap.

    Key Benefits Achieved

    Common service needs identified.

    Architectural walkthrough completed.

    Initiative Roadmap completed.

    Activities

    4.1 Identify common service needs.

    4.2 Conduct an architectural walkthrough.

    4.3 Group gaps together into initiatives.

    4.4 Document initiatives on an initiative roadmap.

    Outputs

    Architectural Walkthrough

    Initiative Roadmap

    Integrate Physical Security and Information Security

    • Buy Link or Shortcode: {j2store}383|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Security Processes & Operations
    • Parent Category Link: /security-processes-and-operations

    Physical security is often managed by facilities, not by IT security, resulting in segmented security systems. Integrating physical and information security introduces challenges in:

    • Understanding the value proposition of investment in governing and managing integrated systems, including migration costs, compared to separated security systems.
    • Addressing complex risks and vulnerabilities of an integrated security system.
    • Operationalizing enhanced capabilities created by adoption of emerging and disruptive technologies.

    Our Advice

    Critical Insight

    • Integrate security in people, process, and technology to improve your overall security posture. Having siloed systems running security is not beneficial. Many organizations are realizing the benefits of consolidating into a single platform across physical security, cybersecurity, HR, legal, and compliance.
    • Plan and engage stakeholders. Assemble the right team to ensure the success of your integrated security ecosystem, decide the governance model, and clearly define the roles and responsibilities.
    • Enhance strategy and risk management. Strategically, we want a physical security system that is interoperable with most technologies, flexible with minimal customization, functional, and integrated, despite the challenges of proprietary configurations, complex customization, and silos.

    Impact and Result

    Info-Tech's approach is a modular, incremental, and repeatable process to integrate physical and information security to:

    • Ensure the integration will meet the business' needs and determine effort and technical requirements.
    • Establish GRC processes that include integrated risk management and compliance.
    • Design and deploy an integrated security architecture.
    • Establish security metrics of effectiveness and efficiency for senior management and leadership.

    Integrate Physical Security and Information Security Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Integrate Physical Security and Information Security Storyboard – A step-by-step document that walks you through how to integrate physical security and information security.

    Info-Tech provides a three-phased framework for integrating physical security and information security: Plan, Enhance, and Monitor & Optimize.

    • Integrate Physical Security and Information Security Storyboard

    2. Integrate Physical Security and Information Security Requirements Gathering Tool – A tool to map organizational goals to IT goals, facilities goals, OT goals (if applicable), and integrated security goals.

    This tool serves as a repository for information about security integration elements, compliance, and other factors that will influence your integration of physical security and information security.

    • Integrate Physical Security and Information Security Requirements Gathering Tool

    3. Integrate Physical Security and Information Security RACI Chart Tool – A tool to identify and understand the owners of various security integration stakeholders across the organization.

    Populating a RACI chart (Responsible, Accountable, Consulted, and Informed) is a critical step that will assist you in organizing roles for carrying out integration steps. Complete this tool to assign tasks to suitable roles.

    • Integrate Physical Security and Information Security RACI Chart Tool

    4. Integrate Physical Security and Information Security Communication Deck – A tool to present your findings in a prepopulated document that summarizes the work you have completed.

    Complete this template to effectively communicate your integrated security plan to stakeholders.

    • Integrate Physical Security and Information Security Communication Deck
    [infographic]

    Further reading

    Integrate Physical Security and Information Security

    Securing information security, physical security, or personnel security in silos may not secure much

    Analyst Perspective

    Ensure integrated security success with close and continual collaboration

    From physical access control systems (PACS) such as electronic locks and fingerprint biometrics to video surveillance systems (VSS) such as IP cameras to perimeter intrusion detection and prevention to fire and life safety and beyond: physical security systems pose unique challenges to overall security. Additionally, digital transformation of physical security to the cloud and the convergence of operational technology (OT), internet of things (IoT), and industrial IoT (IIoT) increase both the volume and frequency of security threats.

    These threats can be safety, such as the health impact when a gunfire attack downed wastewater pumps at Duke Energy Substation, North Carolina, US, in 2022. The threats can also be economic, such as theft of copper wire, or they can be reliability, such as when a sniper attack on Pacific Gas & Electric’s Metcalf Substation in California, US, damaged 17 out of 21 power transformers in 2013.

    Considering the security risks organizations face, many are unifying physical, cyber, and information security systems to gain the long-term overall benefits a consolidated security strategy provides.

    Ida Siahaan
    Ida Siahaan

    Research Director, Security and Privacy Practice
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    Physical security is often managed by facilities, not by IT security, resulting in segmented security systems. Meanwhile, integrating physical and information security introduces challenges in:

    • Value proposition of investment in governing and managing integrated systems including the migration costs compared to separated security systems.
    • Addressing complex risks and vulnerabilities of an integrated security system.
    • Operationalizing on enhanced capabilities created by adoption of emerging and disruptive technologies.

    Common Obstacles

    Physical security systems integration is complex due to various components such as proprietary devices and protocols and hybrid systems of analog and digital technology. Thus, open architecture with comprehensive planning and design is important.

    However, territorial protection by existing IT and physical security managers may limit security visibility and hinder security integration.

    Additionally, integration poses challenges in staffing, training and awareness programs, and dependency on third-party technologies and their migration plans.

    Info-Tech's Approach

    Info-Tech’s approach is a modular, incremental, and repeatable process to integrate physical and information security that enables organizations to:

    • Determine effort and technical requirements to ensure the integration will meet the business needs.
    • Establish GRC processes including integrated risk management and compliance.
    • Design and deploy integrated security architecture.
    • Establish metrics to monitor the effectiveness and efficiency of the security program.

    Info-Tech Insight

    An integrated security architecture, including people, process, and technology, will improve your overall security posture. These benefits are leading many organizations to consolidate their siloed systems into a single platform across physical security, cybersecurity, HR, legal, and compliance.

    Existing information security models are not comprehensive

    Current security models do not cover all areas of security, especially if physical systems and personnel are involved and safety is also an important property required.

    • The CIA triad (confidentiality, integrity, availability) is a well-known information security model that focuses on technical policies related to technology for protecting information assets.
    • The US Government’s Five Pillars of Information Assurance includes CIA, authentication, and non-repudiation, but it does not cover people and processes comprehensively.
    • The AAA model, created by the American Accounting Association, has properties of authentication, authorization, and accounting but focuses only on access control.
    • Donn Parker expanded the CIA model with three more properties: possession, authenticity, and utility. This model, which includes people and processes, is known as the Parkerian hexad. However, it does not cover physical and personnel security.

    CIA Triad

    The CIA Triad for Information Security: Confidentiality, Integrity, Availability


    Parkerian Hexad

    The Parkerian Hexad for Security: Confidentiality, Possession, Utility, Availability, Authenticity and Integrity

    Sources: Parker, 1998; Pender-Bey, 2012; Cherdantseva and Hilton, 2015

    Adopt an integrated security model

    Adopt an integrated security model which consists of information security, physical security, personnel security, and organizational security.

    The security ecosystem is shifting from segregation to integration

    Security ecosystem is shifting from the past proprietary model to open interfaces and future open architecture

    Sources: Cisco, n.d.; Preparing for Technology Convergence in Manufacturing, Info-Tech Research Group, 2018

    Physical security includes:

    • Securing physical access,
      e.g. facility access control, alarms, surveillance cameras
    • Securing physical operations
      (operational technology – OT), e.g. programmable logic controllers (PLCs), SCADA

    Info-Tech Insight

    Why is integrating physical and information security gaining more and more traction? Because the supporting technologies are becoming more matured. This includes, for example, migration of physical security devices to IP-based network and open architecture.

    Reactive responses to physical security incidents

    April 1995

    Target: Alfred P. Murrah Federal Building, Oklahoma, US. Method: Bombing. Impact: Destroyed structure of 17 federal agencies, 168 casualties, over 800 injuries. Result: Creation of Interagency Security Committee (ISC) in Executive Order 12977 and “Vulnerability Assessment of Federal Facilities” standard.
    (Source: Office of Research Services, 2017)

    April 2013

    Target: Pacific Gas & Electric’s Metcalf Substation, California, US. Method: Sniper attack. Impact: Out of 21 power transformers, 17 were damaged. Result: Creation of Senate Bill No. 699 and NERC- CIP-014 standard.
    (Source: T&D World, 2023)

    Sep. 2022

    Target: Nord Stream gas pipelines connecting Russia to Germany, Baltic sea. Method: Detonations. Impact: Methane leaks (~300,000 tons) at four exclusive economic zones (two in Denmark and two in Sweden). Result: Sweden’s Security Service investigation.
    (Source: CNBC News, 2022)

    Dec. 2022

    Target: Duke Energy Substation, North Carolina, US. Method: Gunfire. Impact: Power outages of ~40,000 customers and wastewater pumps in sewer lift stations down. Result: State of emergency was declared.
    (Source: CBS News, 2022)

    Info-Tech Insight

    When it comes to physical security, we have been mostly reactive. Typically the pattern starts with physical attacks. Next, the impacted organization mitigates the incidents. Finally, new government regulatory measures or private sector or professional association standards are put in place. We must strive to change our pattern to become more proactive.

    Physical security market forecast and top physical security challenges

    Physical security market forecast
    (in billions USD)

    A forecast by MarketsandMarkets projected growth in the physical security market, using historical data from 2015 until 2019, with a CAGR of 6.4% globally and 5.2% in North America.

    A forecast by MarketsandMarkets projected growth in the physical security market, using historical data from 2015 until 2019, with a CAGR of 6.4% globally and 5.2% in North America.

    Source: MarketsandMarkets, 2022

    Top physical security challenges

    An Ontic survey (N=359) found that threat data management (40%) was the top physical security challenge in 2022, up from 33% in 2021, followed by physical security threats to the C-suite and company leadership (35%), which was a slight increase from 2021. An interesting decrease is data protection and privacy (32%), which dropped from 36% in 2021.

    An Ontic survey (N=359) found that threat data management (40%) was the top physical security challenge in 2022, up from 33% in 2021, followed by physical security threats to the C-suite and company leadership (35%), which was a slight increase from 2021. An interesting decrease is data protection and privacy (32%), which dropped from 36% in 2021.

    Source: Ontic Center for Protective Intelligence, 2022

    Info-Tech Insight

    The physical security market is growing in systems and services, especially the integration of threat data management with cybersecurity.

    Top physical security initiatives and operations integration investments

    We know the physical security challenges and how the physical security market is growing, but what initiatives are driving this growth? These are the top physical security initiatives and top investments for physical security operations integration:

    Top physical security initiatives

    The number one physical security initiative is integrating physical security systems. Other initiatives with similar concerns included data and cross-functional integration

    A survey by Brivo asked 700 security professionals about their top physical security initiatives. The number one initiative is integrating physical security systems. Other initiatives with similar concerns included data and cross-functional integration.

    Source: Brivo, 2022

    Top investments for physical security operations integration

    The number one investment is on access control systems with software to identify physical threat actors. Another area with similar concern is integration of digital physical security with cybersecurity.

    An Ontic survey (N=359) on areas of investment for physical security operations integration shows the number one investment is on access control systems with software to identify physical threat actors. Another area with similar concern is integration of digital physical security with cybersecurity.

    Source: Ontic Center for Protective Intelligence, 2022

    Evaluate security integration opportunities with these guiding principles

    Opportunity focus

    • Identify the security integration problems to solve with visible improvement possibilities
    • Don’t choose technology for technology’s sake
    • Keep an eye to the future
    • Use strategic foresight

    Piece by piece

    • Avoid taking a big bang approach
    • Test technologies in multiple conditions
    • Run inexpensive pilots
    • Increase flexibility
    • Build a technology ecosystem

    Buy-in

    • Collaborate with stakeholders
    • Gain and sustain support
    • Maintain transparency
    • Increase uptake of open architecture

    Key Recommendations:

    Focus on your master plan

    Build a technology ecosystem

    Engage stakeholders

    Info-Tech Insight

    When looking for a quick win, consider learning the best internal or external practice. For example, in 1994 IBM reorganized its security operation by bringing security professionals and non-security professionals in one single structure, which reduced costs by approximately 30% in two years.

    Sources: Create and Implement an IoT Strategy, Info-Tech Research Group, 2022; Baker and Benny, 2013; Erich Krueger, Omaha Public Power District (contributor); Doery Abdou, March Networks Corporate (contributor)

    Case Study

    4Wall Entertainment – Asset Owner

    Industry: Architecture & Engineering
    Source: Interview

    4Wall Entertainment is quite mature in integrating its physical and information security; physical security has always been under IT as a core competency.

    4Wall Entertainment is a provider of entertainment lighting and equipment to event venues, production companies, lighting designers, and others, with a presence in 18 US and UK locations.

    After many acquisitions, 4Wall Entertainment needed to standardize its various acquired systems, including physical security systems such as access control. In its integrated security approach, IT owns the integrated security, but they interface with related entities such as HR, finance, and facilities management in every location. This allows them to obtain information such as holidays, office hours, and what doors need to be accessed as inputs to the security system and to get sponsorship in budgeting.

    In the past, 4Wall Entertainment tried delegating specific physical security to other divisions, such as facilities management and HR. This approach was unsuccessful, so IT took back the responsibility and accountability.

    Currently, 4Wall Entertainment works with local vendors, and its biggest challenge is finding third-party vendors that can provide nationwide support.

    In the future, 4Wall Entertainment envisions physical security modernization such as camera systems that allow more network accessibility, with one central system to manage and IoT device integration with SIEM and MDR.

    Results

    Lessons learned in integrating security from 4Wall Entertainment include:

    • Start with forming relationships with related divisions such as HR, finance, and facilities management to build trust and encourage sponsorship across management.
    • Create policies, procedures, and standards to deploy in various systems, especially when acquiring companies with low maturity in security.
    • Select third-party providers that offer the required functionalities, good customer support, and standard systems interoperability.
    • Close skill gaps by developing training and awareness programs for users, especially for newly acquired systems and legacy systems, or by acquiring expertise from consulting services.
    • Complete cost-benefit analysis for solutions on legacy systems to determine whether to keep them and create interfacing with other systems, upgrade them, or replace them entirely with newer systems.
    • Delegate maintenance of specific highly regulated systems, such as fire alarms and water sprinklers, to facilities management.
    Integration of Physical and Information Security Framework. Inputs: Integrated Items, Stakeholders, and Security Components. Phases, Outcomes and Benefits: Plan, Enhance and Monitor & Optimize.

    Tracking progress of physical and information security integration

    Physical security is often part of facilities management. As a result, there are interdependencies with both internal departments (such as IT, information security, and facilities) and external parties (such as third-party vendors). IT leaders, security leaders, and operational leaders should keep the big picture in mind when designing and implementing integration of physical and information security. Use this checklist as a tool to track your security integration journey.

    Plan

    • Engage stakeholders and justify value for the business.
    • Define roles and responsibilities.
    • Establish/update governance for integrated security.
    • Identify integrated elements and compliance obligations.

    Enhance

    • Determine the level of security maturity and update security strategy for integrated security.
    • Assess and treat risks of integrated security.
    • Establish/update integrated physical and information security policies and procedures.
    • Update incident response, disaster recovery, and business continuity plan.

    Monitor & Optimize

    • Identify skill requirements and close skill gaps for integrating physical and information security.
    • Design and deploy integrated security architecture and controls.
    • Establish, monitor, and report integrated security metrics on effectiveness and efficiency.

    Benefits of the security integration framework

    Today’s matured technology makes security integration possible. However, the governance and management of single integrated security presents challenges. These can be overcome using a multi-phased framework that enables a modular, incremental, and repeatable integration process, starting with planning to justify the value of investment, then enhancing the integrated security based on risks and open architecture. This is followed by using metrics for monitoring and optimization.

    1. Modular

      • Implementing a consolidated security strategy is complex and involves the integration of process, software, data, hardware, and network and infrastructure.
      • A modular framework will help to drive value while putting in appropriate guardrails.
    2. Incremental

      • Integration of physical security and information security involves many components such as security strategy, risk management, and security policies.
      • An incremental framework will help track, manage, and maintain each step while providing appropriate structure.
    3. Repeatable

      • Integration of physical security and information security is a journey that can be approached with a pilot program to evaluate effectiveness.
      • A repeatable framework will help to ensure quick time to value and enable immediate implementation of controls to meet operational and security requirements.

    Potential risks of the security integration framework

    Just as medicine often comes with side effects, our Integration of Physical and Information Security Framework may introduce risks too. However, as John F. Kennedy, thirty-fifth president of the United States, once said, "There are risks and costs to a program of action — but they are far less than the long-range cost of comfortable inaction."

    Plan Phase

    • Lack of transparency in the integration process can lead to lack of trust among stakeholders.
    • Lack of support from leadership results in unclear governance or lack of budget or human resources.
    • Key stakeholders leave the organization during the engagement and their replacements do not understand the organization’s operation yet.

    Enhance Phase

    • The risk assessment conducted focuses too much on IT risk, which may not always be applicable to physical security systems nor OT systems.
    • The integrated security does not comply with policies and regulations.

    Monitor and Optimize Phase

    • Lack of knowledge, training, and awareness.
    • Different testing versus production environments.
    • Lack of collected or shared security metrics.

    Data

    • Data quality issues and inadequate data from physical security, information security, and other systems, e.g. OT, IoT.
    • Too much data from too many tools are complex and time consuming to process.

    Develop an integration of information security, physical security, and personnel security that meets your organization’s needs

    Integrate security in people, process, and technology to improve your overall security posture

    Having siloed systems running security is not beneficial. Many organizations are realizing the benefits of consolidating into a single platform across physical security, cybersecurity, HR, legal, and compliance.

    Plan and engage stakeholders

    Assemble the right team to ensure the success of your integrated security ecosystem, decide the governance model, and clearly define the roles and responsibilities.

    Enhance strategy and risk management

    Strategically, we want a physical security system that is interoperable with most technologies, flexible with minimal customization, functional, and integrated, despite the challenges of proprietary configurations, complex customization, and silos.

    Monitor and optimize

    Find the most optimized architecture that is strategic, realistic, and based on risk. Next, perform an evaluation of the security systems and program by understanding what, where, when, and how to measure and to report the relevant metrics.

    Focus on master plan

    Identify the security integration problems to solve with visible improvement possibilities, and don’t choose technology for technology’s sake. Design first, then conduct market research by comparing products or services from vendors or manufacturers.

    Build a technology ecosystem

    Avoid a big bang approach and test technologies in multiple conditions. Run inexpensive pilots and increase flexibility to build a technology ecosystem.

    Deliverables

    Each step of this framework is accompanied by supporting deliverables to help you accomplish your goals:

    Integrate Physical Security and Information Security Requirements Gathering Tool

    Map organizational goals to IT goals, facilities goals, OT goals (if applicable), and integrated security goals. Identify your security integration elements and compliance.

    Integrate Physical Security and Information Security RACI Chart Tool

    Identify various security integration stakeholders across the organization and assign tasks to suitable roles.

    Key deliverable:

    Integrate Physical Security and Information Security Communication Deck

    Present your findings in a prepopulated document that summarizes the work you have completed.

    Plan

    Planning is foundational to engage stakeholders. Start with justifying the value of investment, then define roles and responsibilities, update governance, and finally identify integrated elements and compliance obligations.

    Plan

    Engage stakeholders

    • To initiate communication between the physical and information security teams and other related divisions, it is important to identify the entities that would be affected by the security integration and involve them in the process to gain support from planning to delivery and maintenance.
    • Possible stakeholders:
      • Executive leadership, Facilities Management leader and team, IT leader, Security & Privacy leader, compliance officer, Legal, Risk Management, HR, Finance, OT leader (if applicable)
    • A successful security integration depends on aligning your security integration initiatives and migration plan to the organization’s objectives by engaging the right people to communicate and collaborate.

    Info-Tech Insight

    It is important to speak the same language. Physical security concerns safety and availability, while information security concerns confidentiality and integrity. Thus, the two systems have different goals and require alignment.

    Similarly, taxonomy of terminologies needs to be managed,1 e.g. facility management with an emergency management background may have a different understanding from a CISO with an information security background when discussing the same term. For example:

    In emergency management prevention means “actions taken to eliminate the impact of disasters in order to protect lives, property and the environment, and to avoid economic disruption.”2

    In information security prevention is “preventing the threats by understanding the threat environment and the attack surfaces, the risks, the assets, and by maintaining a secure system.”3

    Sources: 1 Owen Yardley, Omaha Public Power District (contributor); 2 Translation Bureau, Government of Canada, n.d.; 3 Security Intelligence, 2020


    Map organizational goals to integrated security goals

    Input

    • Corporate, IT, and Facilities strategies

    Output

    • Your goals for the integrated security strategy

    Materials

    • Integrate Physical Security and Information Security Requirements Gathering Tool

    Participants

    • Executive leadership
    • Facilities Management leader and team
    • IT leader
    • Security & Privacy leader
    • Compliance officer
    • Legal
    • Risk Management
    • HR & Finance
    • OT leader (if applicable)
    1. As a group, brainstorm organization goals.
      • Review relevant corporate, IT, and facilities strategies.
    2. Record the most important business goals in the “Goals Cascade” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool. Try to limit the number of business goals to no more than ten goals. This limitation will be critical to helping focus on your integrated security goals.
    3. For each goal, identify one to two security alignment goals. These should be objectives for the security strategy that will support the identified organization goals.

    Download the Integrate Physical Security and Information Security Requirements Gathering Tool.

    Record organizational goals

    A table to identify Organization, IT, OT(if applicable), Facilities, and Security Goals Definitions.

    Refer to the Integration of Physical and Information Security Framework when filling in the table.

    1. Record your identified organizational goals in the “Goals Cascade” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.
    2. For each organizational goal, identify IT alignment goals.
    3. For each organizational goal, identify OT alignment goals (if applicable).
    4. For each organizational goal, identify Facilities alignment goals.
    5. For each organizational goal, select an integrated security goal from the drop-down menu.

    Justify value for the business

    Facilities in most cases have a team that is responsible for physical security installations such as access key controllers. Whenever there is an issue, they contact the provider to fix the error. However, with smart buildings and smart devices, the threat surface grows to include information security threats, and Facilities may not possess the knowledge and skills required to deal with them. At the same time, delegating physical security to IT may add more tasks to their already-too-long list of responsibilities. Consolidating security to a focused security team that covers both physical and information security can help.1 We need to develop the security integration business case beyond physical security "gates, guns, and guards" mentality.2

    An example of a cost-benefit analysis for security integration:

    Benefits

    Metrics

    Operational Efficiency and Cost Savings

    • Reduction in deployment, maintenance, and staff time in manual operations of physical security devices such as logs collection from analog cameras to be automated into digital.
    • Reduction in staffing costs by bringing physical security SOC and information security SOC in one single structure.

    Reliability Improvements

    • Reduction in field crew time by identifying hardware that can be virtualized to have a centralized remote control.
    • Improvement of operating reliability through continuous and real-time monitoring of equipment such as door access control systems and camera surveillance systems.

    Customers & Users Benefits

    • Improvement of customer safety for essential services such as access to critical locations only by authorized personnel.
    • Improvement of reliability of services and address human factor in adoption of change by introducing change as a friendly activity.

    Cost

    Metrics

    Equipment and Infrastructure

    • Upgrade of existing physical security equipment, e.g. replacement of separated access control, video management system (VMS), and physical access control system (PACS) with a unified security platform.
    • Implementation of communication network equipment and labor to install, configure, and maintain the new network component.

    Software and Commission

    • The software and maintenance fee as well as upgrade implementation project cost.
    • Labor cost of field commissioning and troubleshooting.
    • Integration with security systems, e.g. event and log management, continuous monitoring, and investigation.

    Support and Resources

    • Cost to hire/outsource security FTEs for ongoing management and operation of security devices, e.g. SOC, MSSP.
    • Cost to hire/outsource FTEs to analyze, design, and deploy the integrated security architecture, e.g. consulting fee.

    Sources: 1 Andrew Amaro, KLAVAN Security Services (contributor); 2 Baker and Benny, 2013;
    Industrial Control System Modernization, Info-Tech Research Group, 2023; Lawrence Berkeley National Laboratory, 2021

    Plan

    Define roles and responsibilities

    Input

    • List of relevant stakeholders

    Output

    • Roles and responsibilities for the integration of physical and information security program

    Materials

    • Integrate Physical Security and Information Security RACI Chart Tool

    Participants

    • Executive leadership
    • Facilities Management leader and team
    • HR & Finance
    • IT leader and team
    • OT leader and team
    • Security & Privacy leader and team

    Many factors impact an organization’s level of effectiveness as it relates to integration of physical and information security. How the team interacts, what skill sets exist, the level of clarity around roles and responsibilities, and the degree of executive support and alignment are only a few. Thus, we need to identify stakeholders that are:

    • Responsible: The person(s) who does the work to accomplish the activity; they have been tasked with completing the activity and/or getting a decision made.
    • Accountable: The person(s) who is accountable for the completion of the activity. Ideally, this is a single person and is often an executive or program sponsor.
    • Consulted: The person(s) who provides information. This is usually several people, typically called subject matter experts (SMEs).
    • Informed: The person(s) who is updated on progress. These are resources that are affected by the outcome of the activities and need to be kept up to date.

    Download the Integrate Physical Security and Information Security RACI Chart Tool

    Define RACI chart

    Define Responsible, Accountable, Consulted, Informed (RACI) stakeholders.

    1. Customize the Work Units to best reflect your operation with applicable stakeholders.
    2. Customize the Action rows as required.

    Integrate Physical Security and Information Security RACI Chart

    Sources: ISC, 2015; ISC, 2021

    Info-Tech Insight

    The roles and responsibilities should be clearly defined. For example, IT Security should be responsible for the installation and configuration of all physical access controllers and devices, and facility managers should be responsible for the physical maintenance including malfunctioning such as access device jammed or physically broken.

    Plan

    Establish/update governance for integrated security

    HR & Finance

    HR provides information such as new hires and office hours as input to the security system. Finance assists in budgeting.

    Security & Privacy

    The security and privacy team will need to evaluate solutions and enforce standards on various physical and information security systems and to protect data privacy.

    Business Leaders

    Business stakeholders will provide clarity for their strategy and provide input into how they envision security furthering those goals.

    IT Executives

    IT stakeholders will be a driving force, ensuring all necessary resources are available and funded.

    Facilities/ Operations

    Operational plans will include asset management, monitoring, and support to meet functional goals and manage throughout the asset lifecycle.

    Infrastructure & Enterprise Architects

    Each solution added to the environment will need to be chosen and architected to meet business goals and security functions.

    Info-Tech Insight

    Assemble the right team to ensure the success of your integrated security ecosystem and decide the governance model, e.g. security steering committee (SSC) or a centralized single structure.

    Adapted from Create and Implement an IoT Strategy, Info-Tech Research Group, 2022

    What does the SSC do?

    Ensuring proper governance over your security program is a complex task that requires ongoing care and feeding from executive management to succeed.

    Your SSC should aim to provide the following core governance functions for your security program:

    1. Define Clarity of Intent and Direction

      How does the organization’s security strategy support the attainment of the business, IT, facilities management, and physical and information security strategies? The SSC should clearly define and communicate strategic linkage and provide direction for aligning security initiatives with desired outcomes.
    2. Establish Clear Lines of Authority

      Security programs contain many important elements that need to be coordinated. There must be clear and unambiguous authority, accountability, and responsibility defined for each element so lines of reporting/escalation are clear and conflicting objectives can be mediated.
    3. Provide Unbiased Oversight

      The SSC should vet the organization’s systematic monitoring processes to ensure there is adherence to defined risk tolerance levels and that monitoring is appropriately independent from the personnel responsible for implementing and managing the security program.
    4. Optimize Security Value Delivery

      Optimized value delivery occurs when strategic objectives for security are achieved and the organization’s acceptable risk posture is attained at the lowest possible cost. This requires constant attention to ensure controls are commensurate with any changes in risk level or appetite.

    Adapted from Improve Security Governance With a Security Steering Committee , Info-Tech Research Group, 2018

    Plan

    Identify integrated elements and compliance obligations

    To determine what elements need to be integrated, it’s important to scope the security integration program and to identify the consequences of integration for compliance obligations.

    INTEGRATED ELEMENTS

    What are my concerns?

    Process integrations

    Determine which processes need to be integrated and how

    • Examples: Security prevention, detection, and response; risk assessment

    Software and data integration

    Determine which software and data need to be integrated and how

    • Examples: Threat management tools, SIEM, IDPS, security event logs

    Hardware integration

    Determine which hardware needs to be integrated and how

    • Examples: Sensors, alarms, cameras, keys, locks, combinations, and card readers

    Network and infrastructure

    Determine which network and infrastructure components need to be integrated and how

    • Example: Network segmentation for physical access controllers.

    COMPLIANCE

    How can I address my concerns?

    Regulations

    Adhere to mandatory laws, directives, industry standards, specific contractual obligations, etc.

    • Examples: NERC CIP (North American Utilities), Network and Information Security (NIS) Directive (EU), Health and Safety at Work etc Act 1974 (UK), Occupational Safety and Health Act, 1970 (US), Emergency Management Act, 2007 (Canada)

    Standards

    Adhere to voluntary standards and obligations

    • Examples: NIST Cybersecurity Framework (CSF), The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard (US), Cybersecurity Maturity Model Certification (CMMC), Service Organization Control (SOC 1 and 2)

    Guidelines

    Adopt guidelines that can improve the integrated security program

    • Examples: Best Practices for Planning and Managing Physical Security Resources (US Interagency Security Committee), Information Security Manual - Guidelines for Physical Security (Australian Cyber Security Centre), 1402-2021-Guide for Physical Security of Electric Power Substations (IEEE)

    Record integrated elements

    Scope and Boundaries from the Integrate Physical Security and Information Security Requirements Gathering Tool.

    Refer to the “Scope” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool when filling in the following elements.

    1. Record your integrated elements, i.e. process integration, software and data integration, hardware integration, network and infrastructure, and physical scope of your security integration, in the “Scope” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.
    2. For each of your scoping give the rationale for including them in the Comments column. Careful attention should be paid to any elements that are not in scope.

    Record your compliance obligations

    Refer to the “Compliance Obligations” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.

    1. Identify your compliance obligations. These can include both mandatory and voluntary obligations. Mandatory obligations include:
      • Laws
      • Government regulations
      • Industry standards
      • Contractual agreements
      Voluntary obligations include standards that the organization has chosen to follow for best practices and any obligations that are required to maintain certifications. Organizations will have many different compliance obligations. For the purposes of your integrated security, include those that include physical security requirements.
    2. Record your compliance obligations, along with any notes, in your copy of the Integrate Physical Security and Information Security Requirements Gathering Tool.
    3. Refer to the “Compliance DB” tab for lists of standards/regulations/ guidelines.
    The “Compliance Obligations” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.

    Remediate third-party compliance gaps

    If you have third-party compliance gaps, there are four primary ways to eliminate them:

    1. Find a New, Compliant Partner

      Terminate existing contract and find another organization to partner with.
    2. Bring the Capability In-House

      Expense permitting, this may be the best way to protect yourself.
    3. Demand Compliance

      Tell the third party they must become compliant. Make sure you set a deadline.
    4. Accept Noncompliance and Assume the Risk

      Sometimes remediation just isn’t cost effective and you have no choice.

    Follow Contracting Best Practices to Mitigate the Risk of Future Third-Party Compliance Gaps

    1. Perform Initial Due Diligence: Request proof of third-party compliance prior to entering into a contract.
    2. Perform Ongoing Due Diligence: Request proof of third-party contractor compliance annually.
    3. Contract Negotiation: Insert clauses requesting periodic assertions of compliance.

    View a sample contract provided by the US Department of Health and Human Services.

    Source: Take Control of Compliance Improvement to Conquer Every Audit, Info-Tech Research Group, 2015

    Pitfalls to avoid when planning security integration

    • No Resources Lineups

      Integration of security needs support from leadership, proper planning, and clear and consistent communication across the organization.
    • Not Addressing Holistic Security

      Create policies and procedures and follow standards that are holistic and based on threats and risks, e.g. consolidated access control policies.
    • Lack of Governance

      While the IT department is a critical partner in cybersecurity, the ownership of such a role sits squarely in the organizational C-suite, with regular reporting to the board of directors (if applicable).
    • Overlooking Business Continuity Effort

      IT and physical security are integral to business continuity and disaster recovery strategies.
    • Not Having Relevant Training and Awareness

      Provide a training and awareness program based on relevant attack vectors. Trained employees are key assets to the development of a safe and secure environment. They must form the base of your security culture.
    • Overbuilding or Underbuilding

      Select third-party providers that offer systems interoperability with other security tools. The intent is to promote a unified approach to security to avoid a cumbersome tooling zoo.

    Sources: Real Time Networks, 2022; Andrew Amaro, KLAVAN Security Services (contributor)

    Enhance

    Enhancing is the development of an integrated security strategy, policies, procedures, BCP, DR, and IR based on the organization’s risks.

    Enhance

    Determine the level of security maturity and update the security strategy

    • Before updating your security strategies, you need to understand the organization’s business strategies, IT strategies, facilities strategies, and physical and information security strategies. The goal is to align your integrated security strategies to contribute to your organization’s success.
    • The integrated security leaders need to understand the direction of the organization. For example:
      • Growth expectation
      • Expansions or mergers anticipation
      • Product or service changes
      • Regulatory requirements
    • Wise security investments depend on aligning your security initiatives to the organization’s objectives by supporting operational performance and ensuring brand protection and shareholder values.
    Integrated security strategies. Consists of an organization’s business strategies, IT strategies, facilities strategies, and physical and information security strategies.

    Sources: Amy L. Meger, Platte River Power Authority (contributor); Baker and Benny, 2013; IFSEC Global, 2023; Security Priorities 2023, Info-Tech Research Group, 2023; Build an Information Security Strategy, Info-Tech Research Group, 2020; ISC, n.d.

    Understanding security maturity

    Maturity models are very effective for determining security states. This table provides examples of general descriptions for physical and information security maturity levels.

    Determine which framework is suitable and select the description that most accurately reflects the ideal state for security in your organization.

    Level 1

    Level 2

    Level 3

    Level 4

    Level 5

    Minimum security with simple physical barriers. Low-level security to prevent and detect some unauthorized external activity. Medium security to prevent, detect, and assess most unauthorized external activity and some unauthorized internal activity. High-level security to prevent, detect, and assess most unauthorized external and internal activity. Maximum security to prevent, detect, assess, and neutralize all unauthorized external and internal activity.

    Physical security maturity level1

    Initial/Ad hoc security programs are reactive. Developing security programs can be effective at what they do but are not holistic. A defined security program is holistic, documented, and proactive. Managed security programs have robust governance and metrics processes. An optimized security program is based on strong risk management practices, including the production of key risk indicators (KRIs).

    Information security maturity level2

    Sources: 1 Fennelly, 2013; 2 Build an Information Security Strategy, Info-Tech Research Group, 2020

    Enhance

    Assess and treat integrated security risks

    The risk assessment conducted consists of analyzing existing inherent risks, existing pressure to the risks such as health and safety laws and codes of practice, new risks from the integration process, risk tolerance, and countermeasures.

    • Some organizations already integrate security into corporate security that consists of risk management, compliance, governance, information security, personnel security, and physical security. However, some organizations are still separating security components, especially physical security and information security, which limits security visibility and the organization’s ability to complete a comprehensive risks assessment.
    • Many vendors are also segregating physical security and information security solutions because their tools do well only on certain aspects. This forces organizations to combine multiple tools, creating a complex environment.
    • Additionally, risks related to people such as mental health issues must be addressed properly. The prevalence of hybrid work post-pandemic makes this aspect especially important.
    • Assess and treat risks based on the organization’s requirements, including its environments. For example, the US federal facility security organization is required to conduct risk assessments at least every five years for Level I (lowest risk) and Level II facilities and at least every three years for Level III, IV, and V (highest risk) facilities.

    Sources: EPA, n.d.; America's Water Infrastructure Act (AWIA), 2018; ISC, 2021

    “In 2022, 95% of US companies are consolidating into a single platform across physical security, cybersecurity, HR, legal and compliance.”

    Source: Ontic Center for Protective Intelligence, 2022; N=359

    Example risk levels

    The risk assessment conducted is based on a combination of physical and information security factors such as certain facilities factors. The risk level can be used to determine the baseline level of protection (LOP). Next, the baseline LOP is customized to the achievable LOP. The following is an example for federal facilities determined by Interagency Security Committee (ISC).

    Risk factor, points and score. Facility security level (FSL), level of risk, and baseline level of protection.

    Source: ISC, 2021

    Example assets

    It is important to identify the organization’s requirements, including its environments (IT, IoT, OT, facilities, etc.), and to measure and evaluate its risks and threats using an appropriate risk framework and tools with the critical step of identifying assets prior to acquiring solutions.

    Organizational requirements including its environments(IT, loT, OT, facilities, etc.)

    Info-Tech Insight

    Certain exceptions must be identified in risk assessment. Usually physical barriers such as gates and intrusion detection sensors are considered as countermeasures,1 however, under certain assessment, e.g. America's Water Infrastructure Act (AWIA),2 physical barriers are also considered assets and as such must also be assessed.

    Compromising a fingerprint scanner

    An anecdotal example of why physical security alone is not sufficient.

    Biometrics: secure access and data security.

    Image by Rawpixel.com on Freepik

    Lessons learned from using fingerprints for authentication:

    • Fingerprint scanners can be physically circumvented by making a copy an authorized user’s fingerprint with 3D printing or even by forcefully amputating an authorized user’s finger.
    • Authorized users may not be given access when the fingerprint cannot be recognized, e.g. if the finger is covered by bandage due to injury.
    • Integration with information security may help detect unauthorized access, e.g. a fingerprint being scanned in a Canadian office when the same user was scanned at a close time interval from an IP in Europe will trigger an alert of a possible incident.

    Info-Tech Insight

    In an ideal world, we want a physical security system that is interoperable with all technologies, flexible with minimal customization, functional, and integrated. In the real world, we may have physical systems with proprietary configurations that are not easily customized and siloed.

    Source: Robert Dang, Info-Tech Research Group

    Use case: Microchip implant

    Microchip implants can be used instead of physical devices such as key cards for digital identity and access management. Risks can be assessed using quantitative or qualitative approaches. In this use case a qualitative approach is applied to impact and likelihood, and a quantitative approach is applied to revenue and cost.

    Asset: Microchip implant

    Benefits

    Impact

    • Improve user satisfaction by removing the need to carry key cards, IDs, etc.
    • Improve operating reliability by reducing the likelihood of losing physical devices such as key cards.
    • Improve reliability of services through continuous and real-time connection with other systems such as payment system.

    Likelihood

    • Improve user satisfaction: High
    • Improve operating reliability: High
    • Improve reliability of services: High

    Revenue

    • Acquire new customers or retain existing customers by making daily lives easier with no need to carry key cards, IDs, etc.
    • Cost reduction in staffing of security personnel, e.g. reducing the staffing of building guards or receptionist.

    Risks

    Impact

    • Security: issues such as biohacking of wearable technology and interconnected devices.
    • Safety: issues such as infections or reactions in the body's immune system.
    • Privacy: issues such as unauthorized surveillance and tracking of activities.

    Likelihood

    • Biohacking: Medium
    • Infections: Low
    • Surveillance: High

    Cost

    • Installation costs and hardware costs.
    • Overall lifecycle cost including estimated software and maintenance costs.
    • Estimated cost of training and estimated increase in productivity.

    Sources: Business Insider, 2018; BBC News, 2022; ISC, 2015

    Enhance

    Update integrated security policies and procedures

    Global policies with local implementation

    This model works for corporate groups with a parent company. In this model, global security policies are developed by a parent company and local policies are applied to the unique business that is not supported by the parent company.

    Update of existing security policies

    This model works for organizations with sufficient resources. In this model, integrated security policies are derived from various policies. For example, physical security in smart buildings/devices (sensors, automated meters, HVAC, etc.) and OT systems (SCADA, PLCs, RTUs, etc.) introduce unique risk exposures, necessitating updates to security policies.

    Customization of information security policies

    This model works for smaller organizations with limited resources. In this model, integrated security policies are derived from information security policies. The issue is when these policies are not applicable to physical security systems or other environments, e.g. OT systems.

    Sources: Kris Krishan, Waymo (contributor); Isabelle Hertanto, Info-Tech Research Group (contributor); Physical and Environmental Security Policy Template, Info-Tech Research Group, 2022.

    Enhance

    Update BCP, DR, IR

    • Physical threats such as theft of material, vandalism, loitering, and the like are also part of business continuity threats.
    • These threats can be carried out by various means such as vehicles breaching perimeter security, bolt cutters used for cutting wire and cable, and ballistic attack.
    • Issues may occur when security operations are owned separately by physical security or information security, thus lacking consistent application of best practices.
    • To overcome this issue, organizations need to update BCP, DR, and IR holistically based on a cost-benefit analysis and the level of security maturity, which can be defined based on the suitable framework.

    Sources: IEEE, 2021; ISC, 2021

    “The best way to get management excited about a disaster plan is to burn down the building across the street.”

    Source: Dan Erwin, Security Officer, Dow Chemical Co., in Computerworld, 2022

    Optimize

    Optimizing means working to make the most effective and efficient use of resources, starting with identifying skill requirements and closing skill gaps, followed by designing and deploying integrated security architecture and controls, and finally monitoring and reporting integrated security metrics.

    Optimize

    Identify skill requirements and close skill gaps

    • The pandemic changed how people work and where they choose to work, and most people still want a hybrid work model. Our survey in July 2022 (N=516) found that 55.8% of employees have the option to work offsite 2-3 days per week, 21.0% can work offsite 1 day per week, and 17.8% can work offsite 4 days per week.
    • The investment (e.g. on infrastructure and networks) to initiate remote work was huge, and the costs didn’t end there; organizations needed to maintain the secure remote work infrastructure to facilitate the hybrid work model.
    • Moreover, roles are evolving due to convergence and modernization. These new roles require an integrative skill set. For example, the grid security and ops team might consist of an IT security specialist, a SCADA technician/engineer, and an OT/IIOT security specialist, where OT/IIOT security specialist is a new role.
    Identify skill gaps that hinder the successful execution of the hybrid work security strategy. Use the identified skill gaps to define the technical skill requirements for current and future work roles. Conduct a skills assessment on your current workforce to identify employee skill gaps. Decide whether to train (including certification), hire, contract, or outsource to close each skill gap.

    Strategic investment in internal security team

    Internal security governance and management using in-house developed tools or off-the-shelf solutions, e.g. security information and event management (SIEM).

    Security management using third parties

    Internal security management using third-party security services, e.g. managed security service providers (MSSPs).

    Outsourcing security management

    Outsourcing the entire security functions, e.g. using managed detection and response (MDR).

    Sources: Info-Tech Research Group’s Security Priorities 2023, Close the InfoSec Skills Gap, Build an IT Employee Engagement Program, and Grid Modernization

    Select the right certifications

    What are the options?

    • One issue in security certification is the complexity of relevancy in topics with respect to roles and levels.
    • The European Union Agency for Cybersecurity (ENISA) takes the approach of analyzing existing certifications of ICS/SCADA professionals' cybersecurity skills by orientation, scope, and supporting bodies that are grouped into specific certifications, relevant certifications, and safety certifications (ENISA, 2015).
    • This approach can also be applied to integrated security certifications.

    Physical security certification

    • Examples: Industrial Security Professional Certification (NCMS-ISP); Physical Security Professional (ASIS-PSP); Physical Security Certification (CDSE-PSC); ISC I-100, I-200, I-300, and I-400

    Cyber physical system security certification

    • Examples: Certified SCADA Security Architect (CSSA), EC-Council ICS/SCADA Cybersecurity Training Course

    Information security certification

    • Examples: Network and Information Security (NIS) Driving License, ISA/IEC 62443 Cybersecurity Certificate Program, GIAC Global Industrial Cyber Security Professional (GICSP)

    Safety Certifications

    • Examples: Board of Certified Safety Professionals (BCSP), European Network of Safety and Health Professional Organizations (ENSHPO)
    Table showing options for Certification orientation, scope and supporting bodies.

    Optimize

    Design and deploy integrated security architecture and controls

    • A survey by Brivo found that 38% of respondents have partly centralized security platforms, 25% have decentralized platforms, and 36% have centralized platforms (Brivo, 2022; N=700).
    • If your organization’s security program is still decentralized or partly centralized and your organization is planning to establish an integrated security program, then the recommendation is to perform a holistic risk assessment based on probability and impact assessments on threats and vulnerabilities.
    • The impacted factors, for example, are customers served, criticality of services, equipment present inside the building, personnel response time for operational recovery and the mitigation of hazards, and costs.
    • Frameworks such as Sherwood Applied Business Security Architecture (SABSA), Control Objectives for Information and Related Technologies (COBIT), and The Open Group Architecture Framework (TOGAF) can be used to build security architecture that aligns security goals with business goals.
    • Finally, analyze the security design against the design criteria.

    Sources: ISA and Honeywell Integrated Security Technology Lab, n.d.; IEEE, 2021

    “As long as organizations treat their physical and cyber domains as separate, there is little hope of securing either one.”

    Source: FedTech magazine, 2009

    Analyze architecture design

    Cloud, on-premises, or hybrid? During the pandemic, many enterprises were under tight deadlines to migrate to the cloud. Many did not refactor data and applications correctly for cloud platforms during migration, with the consequence of high cloud bills. This happened because the migrated applications cannot take advantage of on-premises capabilities such as autoscaling. Thus, in 2023, it is plausible that enterprises will bring applications and data back on-premises.

    Below is an example of a security design analysis of platform architecture. Design can be assessed using quantitative or qualitative approaches. In this example, a qualitative approach is applied using high-level advantages and disadvantages.

    Design criteria

    Cloud

    Hybrid

    On-premises

    Effort

    Consumer effort is within a range, e.g. < 60%

    Consumer effort is within a range e.g. < 80%

    100% organization

    Reliability

    High reliability

    High reliability

    Medium reliability that depends on data centers

    Cost

    High cost when data and applications are not correctly designed for cloud

    Optimized cost when data and applications are correctly designed either for cloud or native

    Medium cost when data and applications take advantage of on-prem capabilities

    Info-Tech Insight

    It is important for organizations to find the most optimized architecture to support them, for example, a hybrid architecture of cloud and on-premises based on operations and cost-effectiveness. To help design a security architecture that is strategic, realistic, and based on risk, see Info-Tech’s Identify the Components of Your Cloud Security Architecture research.

    Sources: InfoWorld, 2023; Identify the Components of Your Cloud Security Architecture , Info-Tech Research Group, 2021

    Analyze equipment design

    Below is an example case of a security design analysis of electronic security systems. Design can be assessed using quantitative or qualitative approaches. In this example a qualitative approach is applied using advantages and disadvantages.

    Surveillance design criteria

    Video camera

    Motion detector

    Theft of security system equipment

    Higher economic loss Lower economic loss

    Reliability

    Positive detection of intrusion Spurious indication and lower reliability

    Energy savings and bandwidth

    Only record when motion is detected Detect and process all movement

    Info-Tech Insight

    Once the design has been analyzed, the next step is to conduct market research to analyze the solutions landscape, e.g. to compare products or services from vendors or manufacturers.

    Sources: IEEE, 202; IEC, n.d.; IEC, 2013

    Analyze off-the-shelf solutions

    Criteria to consider when comparing solutions:

    Criteria to consider when comparing solutions: 1 - Visibility and asset management. 2 - Threat detection, mitigation and response. 3 - Risk assessment and vulnerability management. 4 - Usability, architecture, Cost.

    Visibility and Asset Management

    Passively monitoring data using various protocol layers, actively sending queries to devices, or parsing configuration files of physical security devices, OT, IoT, and IT environments on assets, processes, and connectivity paths.

    Threat Detection, Mitigation, and Response (+ Hunting)

    Automation of threat analysis (signature-based, specification-based, anomaly-based, flow-based, content-based, sandboxing) not only in IT but also in relevant environments, e.g. physical, IoT, IIoT, and OT on assets, data, network, and orchestration with threat intelligence sharing and analytics.

    Risk Assessment and Vulnerability Management

    Risk scoring approach (qualitative, quantitative) based on variables such as behavioral patterns and geolocation. Patching and vulnerability management.

    Usability, Architecture, Cost

    The user and administrative experience, multiple deployment options, extensive integration capabilities, and affordability.

    Source: Secure IT/OT Convergence, Info-Tech Research Group, 2022

    Optimize

    Establish, monitor, and report integrated security metrics

    Security metrics serve various functions in a security program.1 For example:

    • As audit requirements. For integrated security, the requirements are derived from mandatory or voluntary compliance, e.g. NERC CIP.
    • As an indicator of maturity level. For integrated security, maturity level is used to measure the state of security, e.g. C2M2, CMMC.
    • As a measurement of effectiveness and efficiency. Security metrics consist of operational metrics, financial metrics, etc.

    Safety

    Physical security interfaces with the physical world. Thus, metrics based on risks related to safety are crucial. These metrics motivate personnel by making clear why they should care about security.
    Source: EPRI, 2017

    Business Performance

    The impact of security on the business can be measured with various metrics such as operational metrics, service level agreements (SLAs), and financial metrics.
    Source: BMC, 2022

    Technology Performance

    Early detection leads to faster remediation and less damage. Metrics such as maximum tolerable downtime (MTD) and mean time to recovery (MTR) indicate system reliability.
    Source: Dark Reading, 2022

    Security Culture

    Measure the overall quality of security culture with indicators such as compliance and audit, vulnerability management, and training and awareness.

    Info-Tech Insight

    Security failure can be avoided by evaluating the security systems and program. Security evaluation requires understanding what, where, when, and how to measure and to report the relevant metrics.

    Related Info-Tech Research

    Secure IT/OT Convergence

    The previously entirely separate OT ecosystem is migrating into the IT ecosystem, primarily to improve access via connectivity and to leverage other standard IT capabilities for economic benefit.

    Hence, IT and OT need to collaborate, starting with communication to build trust and to overcome their differences and followed by negotiation on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and establishing metrics for OT security.

    Preparing for Technology Convergence in Manufacturing

    Information technology (IT) and operational technology (OT) teams have a long history of misalignment and poor communication.

    Stakeholder expectations and technology convergence create the need to leave the past behind and build a culture of collaboration.

    Build an Information Security Strategy

    Info-Tech has developed a highly effective approach to building an information security strategy – an approach that has been successfully tested and refined for over seven years with hundreds of organizations.

    This unique approach includes tools for ensuring alignment with business objectives, assessing organizational risk and stakeholder expectations, enabling a comprehensive current-state assessment, prioritizing initiatives, and building a security roadmap.

    Bibliography

    "1402-2021 - IEEE Guide for Physical Security of Electric Power Substations." IEEE, 2021. Accessed 25 Jan. 2023.

    "2022 State of Protective Intelligence Report." Ontic Center for Protective Intelligence, 2022. Accessed 16 Jan. 2023.

    "8 Staggering Statistics: Physical Security Technology Adoption." Brivo, 2022. Accessed 5 Jan. 2023.

    "America's Water Infrastructure Act of 2018." The United States' Congress, 2018. Accessed 19 Jan. 2023.

    Baker, Paul and Daniel Benny. The Complete Guide to Physical Security. Auerbach Publications. 2013

    Bennett, Steve. "Physical Security Statistics 2022 - Everything You Need to Know." WebinarCare, 4 Dec. 2022. Accessed 30 Dec. 2022.

    "Best Practices for Planning and Managing Physical Security Resources: An Interagency Security Committee Guide." Interagency Security Committee (ISC), Dec. 2015. Accessed 23 Jan. 2023.

    Black, Daniel. "Improve Security Governance With a Security Steering Committee." Info-Tech Research Group, 23 Nov. 2018. Accessed 30 Jan. 2023.

    Borg, Scott. "Don't Put Up Walls Between Your Security People." FedTech Magazine, 17 Feb. 2009. Accessed 15 Dec. 2022.

    Burwash, John. “Preparing for Technology Convergence in Manufacturing.” Info-Tech Research Group, 12 Dec. 2018. Accessed 7 Dec. 2022.

    Carney, John. "Why Integrate Physical and Logical Security?" Cisco. Accessed 19 Jan. 2023.

    "Certification of Cyber Security Skills of ICS/SCADA Professionals." European Union Agency for Cybersecurity (ENISA), 2015. Accessed 27 Sep. 2022.

    Cherdantseva, Yulia and Jeremy Hilton. "Information Security and Information Assurance. The Discussion about the Meaning, Scope and Goals." Organizational, Legal, and Technological Dimensions of IS Administrator, Almeida F., Portela, I. (eds.), pp. 1204-1235. IGI Global Publishing, 2013.

    Cobb, Michael. "Physical security." TechTarget. Accessed 8 Dec. 2022.

    “Conduct a Drinking Water or Wastewater Utility Risk Assessment.” United States Environmental Protection Agency (EPA), n.d. Web.

    Conrad, Sandi. "Create and Implement an IoT Strategy." Info-Tech Research Group, 28 July 2022. Accessed 7 Dec. 2022.

    Cooksley, Mark. "The IEC 62443 Series of Standards: A Product Manufacturer's Perspective." YouTube, uploaded by Plainly Explained, 27 Apr. 2021. Accessed 26 Aug. 2022.

    "Cyber and physical security must validate their value in 2023." IFSEC Global, 12 Jan. 2023. Accessed 20 Jan. 2023.

    "Cybersecurity Evaluation Tool (CSET®)." Cybersecurity and Infrastructure Security Agency (CISA). Accessed 23 Jan. 2023.

    "Cybersecurity Maturity Model Certification (CMMC) 2.0." The United States' Department of Defense (DOD), 2021. Accessed 29 Dec. 2022.

    “Cyber Security Metrics for the Electric Sector: Volume 3.” Electric Power Research Institute (EPRI), 2017.

    Czachor, Emily. "Mass power outage in North Carolina caused by gunfire, repairs could take days." CBS News, 5 Dec. 2022. Accessed 20 Jan. 2023.

    Dang, Robert, et al. “Secure IT/OT Convergence.” Info-Tech Research Group, 9 Dec. 2022. Web.

    "Emergency Management Act (S.C. 2007, c. 15)." The Government of Canada, 2007. Accessed 19 Jan. 2023.

    "Emergency management vocabulary." Translation Bureau, Government of Canada. Accessed 19 Jan. 2023.

    Fennelly, Lawrence. Effective physical security. Butterworth-Heinemann, 2013.

    Ghaznavi-Zadeh, Rassoul. "Enterprise Security Architecture - A Top-down Approach." The Information Systems Audit and Control Association (ISACA). Accessed 25 Jan. 2023.

    "Good Practices for Security of Internet of Things." European Union Agency for Cybersecurity (ENISA), 2018. Accessed 27 Sep. 2022.

    "Health and Safety at Work etc Act 1974." The United Kingdom Parliament. Accessed 23 Jan. 2023.

    Hébert, Michel, et al. “Security Priorities 2023.” Info-Tech Research Group, 1 Feb. 2023. Web.

    "History and Initial Formation of Physical Security and the Origin of Authority." Office of Research Services (ORS), National Institutes of Health (NIH). March 3, 2017. Accessed 19 Jan. 2023.

    "IEC 62676-1-1:2013 Video surveillance systems for use in security applications - Part 1-1: System requirements - General." International Electrotechnical Commission (IEC), 2013. Accessed 9 Dec. 2022.

    "Incident Command System (ICS)." ICS Canada. Accessed 17 Jan. 2023.

    "Information Security Manual - Guidelines for Physical Security." The Australian Cyber Security Centre (ACSC), Dec. 2022. Accessed 13 Jan. 2023.

    "Integrated Physical Security Framework." Anixter. Accessed 8 Dec. 2022.

    "Integrating Risk and Security within a TOGAF® Enterprise Architecture." TOGAF 10, The Open Group. Accessed 11 Jan. 2023.

    Latham, Katherine. "The microchip implants that let you pay with your hand." BBC News, 11 Apr. 2022. Accessed 12 Jan. 2023.

    Linthicum, David. "2023 could be the year of public cloud repatriation." InfoWorld, 3 Jan. 2023. Accessed 10 Jan. 2023.

    Ma, Alexandra. "Thousands of people in Sweden are embedding microchips under their skin to replace ID cards." Business Insider, 14 May 2018. Accessed 12 Jan. 2023.

    Mendelssohn, Josh and Dana Tessler. "Take Control of Compliance Improvement to Conquer Every Audit." Info-Tech Research Group, 25 March 2015. Accessed 27 Jan. 2023.

    Meredith, Sam. "All you need to know about the Nord Stream gas leaks - and why Europe suspects 'gross sabotage'." CNBC, 11 Oct. 2022. Accessed 20 Jan. 2023.

    Nicaise, Vincent. "EU NIS2 Directive: what’s changing?" Stormshield, 20 Oct. 2022. Accessed 17 Nov. 2022.

    "NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations." The National Institute of Standards and Technology (NIST), 13 Jul. 2022. Accessed 27 Jan. 2023.

    "North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) Series." NERC. Accessed 23 Jan. 2023.

    "North America Physical Security Market - Global Forecast to 2026." MarketsandMarkets, June 2021. Accessed 30 Dec. 2022.

    "NSTISSI No. 4011 National Training Standard For Information Systems Security (InfoSec) Professionals." The United States Committee on National Security Systems (CNSS), 20 Jun. 1994. Accessed 23 Jan. 2023.

    "Occupational Safety and Health Administration (OSH) Act of 1970." The United States Department of Labor. Accessed 23 Jan. 2023.

    Palter, Jay. "10 Mistakes Made in Designing a Physical Security Program." Real Time Networks, 7 Sep. 2022. Accessed 6 Jan. 2023.

    Parker, Donn. Fighting Computer Crime. John Wiley & Sons, 1998.

    Pathak, Parag. "What Is Threat Management? Common Challenges and Best Practices." Security Intelligence, 2020. Accessed 5 Jan. 2023.

    Pender-Bey, Georgie. "The Parkerian Hexad." Lewis University, 2012. Accessed 24 Jan. 2023.

    Philippou, Oliver. "2023 Trends to Watch: Physical Security Technologies." Omdia. Accessed 20 Jan. 2023.

    Phinney, Tom. "IEC 62443: Industrial Network and System Security." ISA and Honeywell Integrated Security Technology Lab. Accessed 30 Jan. 2023.

    "Physical Security Market, with COVID-19 Impact Analysis - Global Forecast to 2026." MarketsandMarkets, Jan. 2022. Accessed 30 Dec. 2022.

    "Physical Security Professional (PSP)" ASIS International. Accessed 17 Jan. 2023.

    "Physical Security Systems (PSS) Assessment Guide" The United States' Department of Energy (DOE), Dec. 2016. Accessed 23 Jan. 2023.

    "Policies, Standards, Best Practices, Guidance, and White Papers." Interagency Security Committee (ISC). Accessed 23 Jan. 2023.

    "Profiles, Add-ons and Specifications." ONVIF. Accessed 9 Dec. 2022.

    "Protective Security Policy Framework (PSPF)." The Australian Attorney-General's Department (AGD). Accessed 13 Jan. 2023.

    "Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.

    ""Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.

    Satgunananthan, Niru. "Challenges in Security Convergence?" LinkedIn, 8 Jan. 2022. Accessed 20 Dec. 2022.

    Sooknanan, Shastri and Isaac Kinsella. "Identify the Components of Your Cloud Security Architecture." Info-Tech Research Group, 12 March 2021. Accessed 26 Jan. 2023.

    "TC 79 Alarm and electronic security systems." International Electrotechnical Commission (IEC), n.d. Accessed 9 Dec. 2022.

    "The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard." Interagency Security Committee (ISC), 2021. Accessed 26 Jan. 2023.

    "The Short Guide to Why Security Programs Can Fail." CyberTalk, 23 Sep. 2021. Accessed 30 Dec. 2022.

    Verton, Dan. "Companies Aim to Build Security Awareness." Computerworld, 27 Nov. 2022. Accessed 26 Jan. 2023.

    "Vulnerability Assessment of Federal Facilities." The United States' Department of Justice, 28 Jun. 1995. Accessed 19 Jan. 2023.

    "What is IEC 61508?" 61508 Association. Accessed 23 Jan. 2023.

    Wolf, Gene. "Better Include Physical Security With Cybersecurity." T&D World 5 Jan. 2023. Accessed 19 Jan. 2023.

    Wood, Kate, and Isaac Kinsella. “Build an Information Security Strategy.” Info-Tech Research Group, 9 Sept. 2020. Web.

    Woolf, Tim, et al. "Benefit-Cost Analysis for Utility-Facing Grid Modernization Investments: Trends, Challenges, and Considerations." Lawrence Berkeley National Laboratory, Feb. 2021. Accessed 15 Nov. 2022.

    "Work Health and Safety Act 2011." The Australian Government. Accessed 13 Jan. 2023.

    Wu, Jing. “Industrial Control System Modernization: Unlock the Value of Automation in Utilities.” Info-Tech Research Group, 6 April 2023. Web.

    Research Contributors and Experts

    Amy L. Meger, IGP

    Information and Cyber Governance Manager
    Platte River Power Authority

    Andrew Amaro

    Chief Security Officer (CSO) & Founder
    KLAVAN Security

    Bilson Perez

    IT Security Manager
    4Wall Entertainment

    Dan Adams

    VP of Information Technology
    4Wall Entertainment

    Doery Abdou

    Senior Manager
    March Networks Corporate

    Erich Krueger

    Manager of Security Engineering
    Omaha Public Power District

    Kris Krishan

    Head of IT
    Waymo

    Owen Yardley

    Director, Facilities Security Preparedness
    Omaha Public Power District

    2020 Applications Priorities Report

    • Buy Link or Shortcode: {j2store}159|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Optimization
    • Parent Category Link: /optimization
    • Although IT may have time to look at trends, it does not have the capacity to analyze the trends and turn them into initiatives.
    • IT does not have time to parse trends for initiatives that are relevant to them.
    • The business complains that if IT does not pursue trends the organization will get left behind by cutting-edge competitors. At the same time, when IT pursues trends, the business feels that IT is unable to deal with the basic issues.

    Our Advice

    Critical Insight

    • Take advantage of a trend by first understanding why it is happening and how it is actionable. Build momentum now. Breaking a trend into bite-sized initiatives and building them into your IT foundations enables the organization to maintain pace with competitors and make the technological leap.
    • The concepts of shadow IT and governance are critical. As it becomes easier for the business to purchase its own applications, it will be essential for IT to embrace this form of user empowerment. With a diminished focus on vendor selection, IT will drive the most value by directing its energy toward data and integration governance.

    Impact and Result

    • Determine how to explore, adopt, and optimize the technology and practice initiatives in this report by understanding which core objective(s) each initiative serves:
      • Optimize the effectiveness of the IT organization.
      • Boost the productivity of the enterprise.
      • Enable business growth through technology.

    2020 Applications Priorities Report Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief for a summary of the priorities and themes that an IT organization should focus on this year.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Read the 2020 Applications Priorities Report

    Use Info-Tech's 2020 Applications Priorities Report to learn about the five initiatives that IT should prioritize for the coming year.

    • 2020 Applications Priorities Report Storyboard
    [infographic]

    In Case Of Emergency...

    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    1. Get people to safety efficiently by following the floor warden's information and get out if needed
      If there are no floor wardens, YOU take the initiative and alert people. Vacate the premises if you suspect danger.
      Err on the side of caution. Nobody ever got fired over keeping people safe.
    2. Get people to safety (yes! double check this)
    3. Check what is happening
    4. Stop the bleeding
    5. Check what you broke while stopping the bleeding
    6. Check if you need to go into DR mode
    7. Go into DR mode if that is the fastest way to restore the service
    8. Only now start to look deeper

    Notice what is missing in this list?

    • WHY did this happen?
    • WHO did what

    During the first reactions to an event, stick to the facts of what is happening and the symptoms. If the symptoms are bad, attend to people first, no matter the financial losses occurring.
    Remember that financial losses are typically insured. Human life is not. Only loss of income and ability to pay is insured! Not the person's life.

    The WHY, HOW, WHO and other root cause questions are asked in the aftermath of the incident and after you have stabilized the situation.
    In ITIL terms, those are Problem Management and Root Cause Analysis stage questions.

     

     

     

    Management, incident, reaction, emergency

    Change Management's Role in Incident Prevention: standard changes

    • Large vertical image:
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A

    During peak business hours, I witnessed a straightforward database field addition bring down a whole e-commerce platform. It was meant to be standard procedure, the type of “standard change” that is automatically approved because we have performed it innumerable times.

    Adding a field to the end of a table and having applications retrieve data by field name instead of position made the change itself textbook low-impact. There is no need to alter the application or the functional flow. This could have been problematic in the past if you added a field in the middle of the list and it affected the values of other fields, but adding it at the end? That ought to have been impenetrable.

    However, it wasn't.

    Before I tell you what went wrong, let me explain why this is important to all of the IT professionals who are reading this.

    Over the past three decades, industry data has repeatedly supported what this incident taught me: our presumptions about “safe” changes are frequently our greatest weakness. Upon reviewing the ITIL research, I was not surprised to learn that failed changes, many of which were categorized as “standard” or “low-risk,” are responsible for about 80% of unplanned outages.

    When you look more closely, the numbers become even more concerning. Since I've been following the Ponemon Institute's work for years, I wasn't surprised to learn that companies with well-established change management procedures have 65% fewer unscheduled outages. The paradox surprised me: many of these “mature” procedures still operate under the premise that safety correlates with repetition.

    What I had been observing in the field for decades was confirmed when Gartner released their research showing that standard changes are responsible for almost 40% of change-related incidents. The very changes we consider safe enough to avoid thorough review subtly create some of our greatest risks. IBM's analysis supports the pattern I've seen in innumerable organizations: standard changes cause three times as much business disruption due to their volume and our decreased vigilance around them, whereas emergency changes receive all the attention and scrutiny.

    Aberdeen Group data indicates that the average cost of an unplanned outage has increased to $300,000 per hour, with change-related failures accounting for the largest category of preventable incidents. This data makes the financial reality stark.

    What precisely went wrong with the addition of that database field that caused our e-commerce platform to crash?

    We were unaware that the addition of this one field would cause the database to surpass an internal threshold, necessitating a thorough examination of its execution strategy. In its algorithmic wisdom, the database engine determined that the table structure had changed enough to necessitate rebuilding its access and retrieval mechanisms. Our applications relied on high-speed requests, and the new execution plan was terribly unoptimized for them.

    Instead of completing quotes or purchases, customers were spending minutes viewing error pages. All applications began to time out while they awaited data that just wasn't showing up in the anticipated amounts of time. Thousands of transactions were impacted by a single extra field that should have been invisible to the application layer.

    The field addition itself was not the primary cause. We assumed that since we had made similar adjustments dozens of times previously, this one would also act in the same way. Without taking into account the hidden complexities of database optimization thresholds, we had categorized it as a standard change based on superficial similarities.

    My approach to standard changes was completely altered by this experience, and it is now even more applicable in DevOps-driven environments. Many organizations use pipeline deployments, which produce a standard change at runtime. It's great for speed and reliability, but it can easily fall into the same trap.

    However, I have witnessed pipeline deployments result in significant incidents for non-code-related reasons. Due to timing, resource contention, or environmental differences that weren't noticeable in earlier runs, a deployment that performed flawlessly in development and staging abruptly fails in production. Although the automation boosts our confidence, it may also reveal blind spots.

    Over the course of thirty years, I have come to the unsettling realization that there is no such thing as a truly routine change in complex systems. Every modification takes place in a slightly different setting, with varying environmental factors, data states, and system loads. What we refer to as “standard changes” are actually merely modifications with comparable processes rather than risk profiles.

    For this reason, I support contextual change management. We must consider the system state, timing, dependencies, and cumulative effect of recent changes rather than just categorizing them based on their technical features. After three other changes have changed the system's behavior patterns, a change made at two in the morning on a Sunday with little system load is actually different from the same change made during peak business hours.

    Effective change advisory boards must therefore go beyond assessing individual changes separately. I've worked with organizations where the change board carefully considered and approved each modification on its own merits, only to find that the cumulative effect of seemingly unrelated changes led to unexpected interactions and stress on the system. The most developed change management procedures I've come across mandate that their advisory boards take a step back and look at the whole change portfolio over a specified period of time. They inquire whether we are altering the database too frequently during a single maintenance window. Could there be unanticipated interactions between these three different application updates? What is the total resource impact of this week's approved changes?

    It's the distinction between forest management and tree management. While each change may seem logical individually, when combined, they can create situations beyond the scope of any single change assessment.

    Having worked in this field for thirty years, I've come to the conclusion that our greatest confidences frequently conceal our greatest vulnerabilities. Our primary blind spots frequently arise from the changes we've made a hundred times before, the procedures we've automated and standardized, and the adjustments we've labeled as “routine.”

    Whether we should slow down our deployment pipelines or stop using standard changes is not the question. In the current competitive environment, speed and efficiency are crucial. The issue is whether we are posing the appropriate queries before carrying them out. Are we taking into account not only what the change accomplishes but also when it occurs, what else is changing at the same time, and how our systems actually look right now?

    I've discovered that the phrase “we've done this before” is more dangerous in IT operations than “what could go wrong?” Because, despite what we may believe, we never actually perform the same action twice in complex systems.

    Here is what I would like you to think about: which everyday modifications are subtly putting your surroundings at risk? Which procedures have you standardized or automated to the extent that you no longer challenge their presumptions? Most importantly, when was the last time your change advisory board examined your changes as a cohesive portfolio of system modifications rather than as discrete items on a checklist?

    Remember that simple addition to a database field the next time you're tempted to accept a standard change. The most unexpected outcomes can occasionally result from the most routine adjustments.

    I'm always up for a conversation if you want to talk about your difficulties with change management.

    Develop Meaningful Service Metrics

    • Buy Link or Shortcode: {j2store}399|cart{/j2store}
    • member rating overall impact: 9.5/10 Overall Impact
    • member rating average dollars saved: $20,308 Average $ Saved
    • member rating average days saved: 30 Average Days Saved
    • Parent Category Name: Service Management
    • Parent Category Link: /service-management
    • IT organizations measure services from a technology perspective but rarely from a business goal or outcome perspective.
    • Most organizations do a poor job of identifying and measuring service outcomes over the duration of a service’s lifecycle – never ensuring the services remain valuable and meet expected long-term ROI.

    Our Advice

    Critical Insight

    • Service metrics are critical to ensuring alignment of IT service performance and business service value achievement.
    • Service metrics reinforce positive business and end-user relationships by providing user-centric information that drives responsiveness and consistent service improvement.
    • Poorly designed metrics drive unintended and unproductive behaviors that have negative impacts on IT and produce negative service outcomes.

    Impact and Result

    Effective service metrics will provide the following service gains:

    • Confirm service performance and identify gaps.
    • Drive service improvement to maximize service value.
    • Validate performance improvements while quantifying and demonstrating business value.
    • Ensure service reporting aligns with end-user experience.
    • Achieve and confirm process and regulatory compliance.

    Which will translate into the following relationship gains:

    • Embed IT into business value achievement.
    • Improve the relationship between the business and IT.
    • Achieve higher customer satisfaction (happier end users receiving expected service, the business is able to identify how things are really performing).
    • Reinforce desirable actions and behaviors from both IT and the business.

    Develop Meaningful Service Metrics Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should develop meaningful service metrics, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Develop Meaningful Service Metrics – Executive Brief
    • Develop Meaningful Service Metrics – Phases 1-3

    1. Design the metrics

    Identify the appropriate service metrics based on stakeholder needs.

    • Develop Meaningful Service Metrics to Ensure Business and User Satisfaction – Phase 1: Design the Metrics
    • Metrics Development Workbook

    2. Design reports and dashboards

    Present the right metrics in the most interesting and stakeholder-centric way possible.

    • Develop Meaningful Service Metrics to Ensure Business and User Satisfaction – Phase 2: Design Reports and Dashboards
    • Metrics Presentation Format Selection Guide

    3. Implement, track, and maintain

    Run a pilot with a smaller sample of defined service metrics, then continuously validate your approach and make refinements to the processes.

    • Develop Meaningful Service Metrics to Ensure Business and User Satisfaction – Phase 3: Implement, Track, and Maintain
    • Metrics Tracking Tool
    [infographic]

    Workshop: Develop Meaningful Service Metrics

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Design the Metrics

    The Purpose

    Define stakeholder needs for IT based on their success criteria and identify IT services that are tied to the delivery of business outcomes.

    Derive meaningful service metrics based on identified IT services and validate that metrics can be collected and measured.

    Key Benefits Achieved

    Design meaningful service metrics from stakeholder needs.

    Validate that metrics can be collected and measured.

    Activities

    1.1 Determine stakeholder needs, goals, and pain points.

    1.2 Determine the success criteria and related IT services.

    1.3 Derive the service metrics.

    1.4 Validate the data collection process.

    1.5 Validate metrics with stakeholders.

    Outputs

    Understand stakeholder priorities

    Adopt a business-centric perspective to align IT and business views

    Derive meaningful business metrics that are relevant to the stakeholders

    Determine if and how the identified metrics can be collected and measured

    Establish a feedback mechanism to have business stakeholders validate the meaningfulness of the metrics

    2 Design Reports and Dashboards

    The Purpose

    Determine the most appropriate presentation format based on stakeholder needs.

    Key Benefits Achieved

    Ensure the metrics are presented in the most interesting and stakeholder-centric way possible to guarantee that they are read and used.

    Activities

    2.1 Understand the different presentation options.

    2.2 Assess stakeholder needs for information.

    2.3 Select and design the metric report.

    Outputs

    Learn about infographic, scorecard, formal report, and dashboard presentation options

    Determine how stakeholders would like to view information and how the metrics can be presented to aid decision making

    Select the most appropriate presentation format and create a rough draft of how the report should look

    3 Implement, Track, and Maintain Your Metrics

    The Purpose

    Run a pilot with a smaller sample of defined service metrics to validate your approach.

    Make refinements to the implementation and maintenance processes prior to activating all service metrics.

    Key Benefits Achieved

    High user acceptance and usability of the metrics.

    Processes of identifying and presenting metrics are continuously validated and improved.

    Activities

    3.1 Select the pilot metrics.

    3.2 Gather data and set initial targets.

    3.3 Generate the reports and validate with stakeholders.

    3.4 Implement the service metrics program.

    3.5 Track and maintain the metrics program.

    Outputs

    Select the metrics that should be first implemented based on urgency and impact

    Complete the service intake form for a specific initiative

    Create a process to gather data, measure baselines, and set initial targets

    Establish a process to receive feedback from the business stakeholders once the report is generated

    Identify the approach to implement the metrics program across the organization

    Set up mechanism to ensure the success of the metrics program by assessing process adherence and process validity

    Further reading

    Develop Meaningful Service Metrics

    Select IT service metrics that drive business value.

    ANALYST PERSPECTIVE

    Are you measuring and reporting what the business needs to know?

    “Service metrics are one of the key tools at IT’s disposal in articulating and ensuring its value to the business, yet metrics are rarely designed and used for that purpose.

    Creating IT service metrics directly from business and stakeholder outcomes and goals, written from the business perspective and using business language, is critical to ensuring that the services that IT provides are meeting business needs.

    The ability to measure, manage, and improve IT service performance in relation to critical business success factors, with properly designed metrics, embeds IT in the value chain of the business and ensures IT’s focus on where and how it enables business outcomes.”

    Valence Howden,
    Senior Manager, CIO Advisory
    Info-Tech Research Group

    Our understanding of the problem

    This Research Is Designed For:
    • CIO
    • IT VPs
    This Research Will Help You:
    • Align business/IT objectives (design top-down or outside-in)
    • Significantly improve the relationship between the business and IT aspects of the organization
    • Reinforce desirable actions and behaviors
    This Research Will Also Assist:
    • Service Level Managers
    • Service Owners
    • Program Owners
    This Research Will Help Them
    • Identify unusual deviations from the normal operating state
    • Drive service improvement to maximize service value
    • Validate the value of performance improvements while quantifying and demonstrating benefits realization

    Executive summary

    Situation

    • IT organizations measure services from a technology perspective yet rarely measure services from a business goal/outcome perspective.
    • Most organizations do a poor job of identifying and measuring service outcomes over the duration of a service’s lifecycle – never ensuring the services remain valuable and meet expected long-term ROI.

    Complication

    • IT organizations have difficulty identifying the right metrics to demonstrate the value of IT services to the business in tangible terms.
    • IT metrics, as currently designed, reinforce division between the IT and business perspectives of service performance. They drive siloed thinking and finger-pointing within the IT structure, and prevent IT resources from understanding how their work impacts business value.

    Resolution

    • Our program enables IT to develop the right service metrics to tie IT service performance to business value and user experience.
    • Ensure the metrics you implement have immediate stakeholder value, reinforcing alignment between IT and the business while influencing behavior in the desired direction.
    • Make sure that your metrics are defined in relation to the business goals and drivers, ensuring they will provide actionable outcomes.

    Info-Tech Insight

    1. Service metrics are critical to ensuring alignment of IT service performance and business service value achievement.
    2. Service metrics reinforce positive business and end-user relationships by providing user-centric information that drives responsiveness and consistent service improvement.
    3. Poorly designed metrics drive unintended and unproductive behaviors, which have negative impacts on IT and produce negative service outcomes.

    Service metrics 101

    What are service metrics?

    Service metrics measure IT services in a way that relates to a business outcome. IT needs to measure performance from the business perspective using business language.

    Why do we need service metrics?

    To ensure the business cares about the metrics that IT produces, start with business needs to make sure you’re measuring the right things. This will give IT the opportunity talk to the right stakeholders and develop metrics that will meet their business needs.

    Service metrics are designed with the business perspective in mind, so they are fully aligned with business objectives.

    Perspectives Matter

    Different stakeholders will require different types of metrics. A CEO may require metrics that provide a snapshot of the critical success of the company while a business manager is more concerned about the performance metrics of their department.

    What are the benefits of implementing service metrics?

    Service metrics help IT communicate with the business in business terms and enables IT to articulate how and where they provide business value. Business stakeholders can also easily understand how IT services contribute to their success.

    The majority of CIOs feel metrics relating to business value and stakeholder satisfaction require significant improvement

    A significantly higher proportion of CIOs than CEOs feel that there is significant improvement necessary for business value metrics and stakeholder satisfaction reporting. Stacked horizontal bar chart presenting survey results from CIOs and CXOs of 'Business Value Metrics'. Answer options are 'Effective', 'Some Improvement Necessary', 'Significant Improvement Necessary', and 'Not Required'.N=364

    Stacked horizontal bar chart presenting survey results from CIOs and CXOs of 'Stakeholder Satisfaction Reporting'. Answer options are 'Effective', 'Some Improvement Necessary', 'Significant Improvement Necessary', and 'Not Required'.N=364

    (Source: Info-Tech CIO-CXO Alignment Diagnostic Survey)

    Meaningless metrics are a headache for the business

    A major pitfall of many IT organizations is that they often provide pages of technical metrics that are meaningless to their business stakeholders.

    1. Too Many MetricsToo many metrics are provided and business leaders don’t know what to do with these metrics.
    2. Metrics Are Too TechnicalIT provides technical metrics that are hard to relate to business needs, and methods of calculating metrics are not clearly understood, articulated, and agreed on.
    3. Metrics Have No Business ValueService metrics are not mapped to business goals/objectives and they drive incorrect actions or spend.
    When considering only CEOs who said that stakeholder satisfaction reporting needed significant improvement, the average satisfaction score goes down to 61.6%, which is a drop in satisfaction of 12%.

    A bar that says 73% dropping to a bar that says 61%. Description above.

    (Source: Info-Tech Research Group CIO-CXO Alignment Diagnostic Survey)

    Poorly designed metrics hurt IT’s image within the organization

    By providing metrics that do not articulate the value of IT services, IT reinforces its role as a utility provider and an outsider to strategic decisions.

    When the CIOs believe business value metrics weren’t required, 50% of their CEOs said that significant improvements were necessary.

    Pie Chart presenting the survey results from CEOs regarding 'Business Value Metrics'. Description above.

    (Source: Info-Tech Research Group CIO-CXO Alignment Diagnostic Survey)
    1. Reinforce the wrong behaviorThe wrong metrics drive us-against-them, siloed thinking within IT, and meeting metric targets is prioritized over providing meaningful outcomes.
    2. Do not reflect user experienceMetrics don’t align with actual business/user experience, reinforcing a poor view of IT services.
    3. Effort ≠ ValueInvesting dedicated resources and effort to the achievement of the wrong metrics will only leave IT more constrained for other important initiatives.

    Articulate meaningful service performance that supports the achievement of business outcomes

    Service metrics measure the performance of IT services and how they enable or drive the activity outcomes.

    A business process consists of multiple business activities. In many cases, these business activities require one or more supporting IT services.

    A 'Business Process' broken down to its parts, multiple 'Business Activities' and their 'IT Services'. For each business process, business stakeholders and their goals and objectives should be identified.

    For each business activity that supports the completion of a business process, define the success criteria that must be met in order to produce the desirable outcome.

    Identify the IT services that are used by business stakeholders for each business activity. Measure the performance of these services from a business perspective to arrive at the appropriate service metrics.

    Differentiate between different types of metrics

    Stakeholders have different goals and objectives; therefore, it is critical to identify what type of metrics should be presented to each stakeholder.

    Business Metrics

    Determine Business Success

    Business metrics are derived from a pure business perspective. These are the metrics that the business stakeholders will measure themselves on, and business success is determined using these metrics.

    Arrow pointing right.

    Service Metrics

    Manage Service Value to the Business

    Service metrics are used to measure IT service performance against business outcomes. These metrics, while relating to IT services, are presented in business terms and are tied to business goals.

    Arrow pointing right.

    IT Metrics

    Enable Operational Excellence

    IT metrics are internal to the IT organization and used to manage IT service delivery. These metrics are technical, IT-specific, and drive action for IT. They are not presented to the business, and are not written in business language.

    Implementing service metrics is a key step in becoming a service provider and business partner

    As a prerequisite, IT organizations must have already established a solid relationship with the business and have a clear understanding of its critical business-facing services.

    At the very least, IT needs to have a service-oriented view and understand the specific needs and objectives associated with each stakeholder.

    Visualization of 'Business Relationship Management' with an early point on the line representing 'Service Provider: Establish service-oriented culture and business-centric service delivery', and the end of the line being 'Strategic Partner'.

    Once IT can present service metrics that the business cares about, it can continue on the service provider journey by managing the performance of services based on business needs, determine and influence service demand, and assess service value to maximize benefits to the business.

    Which processes drive service metrics?

    Both business relationship management (BRM) and service level management (SLM) provide inputs into and receive outputs from service metrics.

    Venn Diagram of 'Business Relationship Management', 'Service Metrics', and 'Service Level Management'.

    Business Relationship Management

    BRM works to understand the goals and objectives of the business and inputs them into the design of the service metrics.

    Service Metrics

    BRM leverages service metrics to help IT organizations manage the relationship with the business.

    BRM articulates and manages expectations and ensures IT services are meeting business requirements.

    Which processes drive service metrics?

    Both BRM and SLM provide inputs into and receive outputs from service metrics.

    Venn Diagram of 'Business Relationship Management', 'Service Metrics', and 'Service Level Management'.

    Service Level Management

    SLM works with the business to understand service requirements, which are key inputs in designing the service metrics.

    Service Metrics

    SLM leverages service metrics in overseeing the day-to-day delivery of IT services. It ensures they are provided to meet expected service level targets and objectives.

    Effective service metrics will deliver both service gains and relationship gains

    Effective service metrics will provide the following service gains:

    • Confirm service performance and identify gaps
    • Drive service improvement to maximize service value
    • Validate performance improvements while quantifying and demonstrating business value
    • Ensure service reporting aligns with end-user experience
    • Achieve and confirm process and regulatory compliance
        Which will translate into the following relationship gains:
        • Embed IT into business value achievement
        • Improve relationship between the business and IT
        • Achieve higher customer satisfaction (happier end users receiving expected service, the business is able to identify how things are really performing)
        • Reinforce desirable actions and behaviors from both IT and the business

    Don’t let conventional wisdom become your roadblock

    Conventional Wisdom

    Info-Tech Perspective

    Metrics are measured from an application or technology perspective Metrics need to be derived from a service and business outcome perspective.
    The business doesn’t care about metrics Metrics are not usually designed to speak in business terms about business outcomes. Linking metrics to business objectives creates metrics that the business cares about.
    It is difficult to have a metrics discussion with the business It is not a metrics/number discussion, it is a discussion on goals and outcomes.
    Metrics are only presented for the implementation of the service, not the ongoing outcome of the service IT needs to focus on service outcome and not project outcome.
    Quality can’t be measured Quality must be measured in order to properly manage services.

    Our three-phase approach to service metrics development

    Let Info-Tech guide you through your service metrics journey

    1

    2

    3

    Design Your Metrics Develop and Validate Reporting Implement, Track, and Maintain
    Sample of Phase 1 of Info-Tech's service metric development package, 'Design Your Metrics'. Sample of Phase 2 of Info-Tech's service metric development package, 'Develop and Validate Reporting'. Sample of Phase 3 of Info-Tech's service metric development package, 'Implement, Track, and Maintain'.
    Start the development and creation of your service metrics by keeping business perspectives in mind, so they are fully aligned with business objectives. Identify the most appropriate presentation format based on stakeholder preference and need for metrics. Track goals and success metrics for your service metrics programs. It allows you to set long-term goals and track your results over time.

    CIOs must actively lead the design of the service metrics program

    The CIO must actively demonstrate support for the service metrics program and lead the initial discussions to determine what matters to business leaders.

    1. Lead the initiative by defining the need
      Show visible support and demonstrate importance
    2. Articulate the value to both IT and the business
      Establish the urgency and benefits
    3. Select and assemble an implementation group
      Find the best people to get the job done
    4. Drive initial metrics discussions: goals, objectives, actions
      Lead brainstorming with senior business leaders
    5. Work with the team to determine presentation formats and communication methods
      Identify the best presentation approach for senior stakeholders
    6. Establish a feedback loop for senior management
      Solicit feedback on improvements
    7. Validate the success of the metrics
      Confirm service metrics support business outcomes

    Measure the success of your service metrics

    It is critical to determine if the designed service metrics are fulfilling their intended purpose. The process of maintaining the service metrics program and the outcomes of implementing service metrics need to be monitored and tracked.

    Validating Service Metrics Design

    Target Outcome

    Related Metrics

    The business is enabled to identify and improve service performance to their end customer # of improvement initiatives created based on service metrics
    $ cost savings/revenue generated due to actions derived from service metrics

    Procedure to validate the usefulness of IT metrics

    # / % of service metrics added/removed per year

    Alignment between IT and business objectives and processes Business’ satisfaction with IT

    Measure the success of your service metrics

    It is critical to determine if the designed service metrics are fulfilling their intended purpose. The process of maintaining the service metrics program and the outcomes of implementing service metrics need to be monitored and tracked.

    Validating Service Metrics Process

    Target Outcome

    Related Metrics

    Properly defined service metrics aligned with business goals/outcomes
    Easy understood measurement methodologies
    % of services with (or without) defined service metrics

    % of service metrics tied to business goals

    Consistent approach to review and adjust metrics# of service metrics adjusted based on service reviews

    % of service metrics reviewed on schedule

    Demonstrate monetary value and impact through the service metrics program

    In a study done by the Aberdeen Group, organizations engaged in the use of metrics benchmarking and measurement have:
    • 88% customer satisfaction rate
    • 60% service profitability
    • 15% increase in workforce productivity over the last 12 months

    Stock image of a silhouette of three people's head and shoulders.
    (Source: Aberdeen Group. “Service Benchmarking and Measurement.”)

    A service metric is defined for: “Response time for Business Application A

    The expected response time has not been achieved and this is visible in the service metrics. The reduced performance has been identified as having an impact of $250,000 per month in lost revenue potential.

    The service metric drove an action to perform a root-cause analysis, which identified a network switch issue and drove a resolution action to fix the technology and architect redundancy to ensure continuity.

    The fix eliminated the performance impact, allowing for recovery of the $250K per month in revenue, improved end-user confidence in the organization, and increased use of the application, creating additional revenue.

    Implementing and measuring a video conferencing service

    CASE STUDY
    Industry: Manufacturing | Source: CIO interview and case material
    Situation

    The manufacturing business operates within numerous countries and requires a lot of coordination of functions and governance oversight. The company has monthly meetings, both regional and national, and key management and executives travel to attend and participate in the meetings.

    Complication

    While the meetings provide a lot of organizational value, the business has grown significantly and the cost of business travel has started to become prohibitive.

    Action

    It was decided that only a few core meetings would require onsite face-to-face meetings, and for all other meetings, the company would look at alternative means. The face-to-face aspect of the meetings was still considered critical so they focused on options to retain that aspect.

    The IT organization identified that they could provide a video conferencing service to meet the business need. The initiative was approved and rolled out in the organization.

    Result:

    IT service metrics needed to be designed to confirm that the expected value outcome of the implementation of video conferencing was achieved.

    Under the direction of the CIO, the business goals and needs driving use of the service (i.e. reduction in travel costs, efficiency, no loss of positive outcome) were used to identify success criteria and key questions to confirm success.

    With this information, the service manager was able to implement relevant service metrics in business language and confirmed an 80% adoption rate and a 95% success rate in term meetings running as expected and achieving core outcomes.

    Use these icons to help direct you as you navigate this research

    Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.

    A small monochrome icon of a wrench and screwdriver creating an X.

    This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project.

    A small monochrome icon depicting a person in front of a blank slide.

    This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization.

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    Guided Implementation

    Workshop

    Consulting

    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks used throughout all four options

    Develop meaningful service metrics to ensure business and user satisfaction

    1. Design the Metrics 2. Design Reports and Dashboards 3. Implement, Track, and Maintain
    Supporting Tool icon

    Best-Practice Toolkit

    1. Defining stakeholder needs for IT based on their success criteria
    2. Derive meaningful service metrics based on identified IT services and validate with business stakeholders
    3. Validate metrics can be collected and measured
    4. Determine calculation methodology
    1. Presentation format selected based on stakeholder needs and preference for information
    2. Presentation format validated with stakeholders
    1. Identify metrics that will be presented first to the stakeholders based on urgency or impact of the IT service
    2. Determine the process to collect data, select initial targets, and integrate with SLM and BRM functions
    3. Roll out the metrics implementation for a broader audience
    4. Establish roles and timelines for metrics maintenance

    Guided Implementations

    • Design metrics based on business needs
    • Validate the metrics
    • Select presentation format
    • Review metrics presentation design
    • Select and implement pilot metrics
    • Determine rollout process and establish maintenance/tracking mechanism
    Associated Activity icon

    Onsite Workshop

    Module 1:
    Derive Service Metrics From Business Goals
    Module 2:
    Select and Design Reports and Dashboards
    Module 3:
    Implement, Track, and Maintain Your Metrics to Ensure Success
    Phase 1 Outcome:
    • Meaningful service metrics designed from stakeholder needs
    Phase 2 Outcome:
    • Appropriate presentation format selected for each stakeholder
    Phase 3 Outcome:
    • Metrics implemented and process established to maintain and track program success

    Workshop overview

    Contact your account representative or email Workshops@InfoTech.com for more information.
    Workshop Day 1 Workshop Day 2 Workshop Day 3 Workshop Day 4
    Design the Metrics
    Determine Presentation Format and Implement Metrics
    Gather Service Level Requirements
    Monitor and Improve Service Levels

    Activities

    • 1.1 Determine stakeholder needs
    • 1.2 Determine success criteria and key performance indicators
    • 1.3 Derive metrics
    • 1.4 Validate the metric collection
    • 2.1 Discuss stakeholder needs/preference for data and select presentation format
    • 2.2 Select and design the metric report
    • Requirements
    • 3.1 Determine the business requirements
    • 3.2 Negotiate service levels
    • 3.3 Align operational level agreements (OLAs) and supplier contracts
    • 4.1 Conduct service report and perform service review
    • 4.2 Communicate service review
    • 4.3 Remediate issues using action plan
    • 4.4 Proactive prevention

    Deliverables

    1. Metrics Development Workbook
    1. Metrics Presentation Format Selection Guide
    2. Metrics Tracking Tool
    1. Service Level Management SOP
    2. Service Level Agreement
    1. Service Level Report
    2. Service Level Review
    3. Business Satisfaction Report

    Develop Meaningful Service Metrics to Ensure Business and User Satisfaction

    PHASE 1

    Design the Metrics

    Step (1): Design the Metrics

    PHASE 1 PHASE 2 PHASE 3

    1.1

    Derive the Service Metrics

    1.2

    Validate the Metrics

    2.1

    Determine Reporting Format

    3.1

    Select Pilot Metrics

    3.2

    Activate and Maintain Metrics

    This step involves the following participants:

    • CIO
    • Business Relationship Manager (BRM)
    • Service Level Manager (SLM)

    Outcomes of this step

    • Defined stakeholder needs for IT based on their success criteria
    • Identified IT services that are tied to the delivery of business outcomes
    • Derived meaningful service metrics based on identified IT services and validated with business stakeholders
    • Validated that metrics can be collected and measured
    • Determined calculation methodology

    Phase 1 outline

    Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 1: Design the Metrics

    Proposed Time to Completion (in weeks): 4 weeks
    Step 1.1: Design Metrics Step 1.2: Validate the Metrics
    Start with an analyst kick-off call:
    • Determine the stakeholder and their needs
    • Identify IT services that are tied to the delivery of business outcomes
    • Derive the service metrics
    Review findings with analyst:
    • For the selected metrics, identify the data source for collection
    • Validate whether or not the data can be created
    • Create a calculation method for the metrics
    Then complete these activities…
    • Using the methodology provided, identify additional stakeholders and map out their success criteria, including KPIs to determine the appropriate service metrics
    Then complete these activities…
    • Determine whether the designed metrics are measurable, and if so, how
    With these tools & templates:
    • Metrics Development Workbook
    With these tools & templates:
    • Metrics Development Workbook

    Design your service metrics – overview

    Figure representing 'CIO'. Step 1
    Derive your service metrics

    Metrics Worksheet

    Figure representing 'SLM' and/or 'BRM'. Step 2
    Validate your metrics

    Metrics Worksheet

    Figures representing 'CIO', 'SLM', and/or 'BRM'. Step 3
    Confirm with stakeholders

    Metrics Tracking Sheet

    A star.

    Defined IT Service Metrics

    Deriving the right metrics is critical to ensuring that you will generate valuable and actionable service metrics.

    Derive your service metrics from business objectives and needs

    Service metrics must be designed with the business perspective in mind so they are fully aligned with business objectives.

    Thus, IT must start by identifying specific stakeholder needs. The more IT understands about the business, the more relevant the metrics will be to the business stakeholders.

    1. Who are your stakeholders?
    2. What are their goals and pain points?
    3. What do the stakeholders need to know?
    4. What do I need to measure?
    5. Derive your service metrics

    Derive your service metrics

    Supporting Tool icon 1.1 Metrics Development Workbook

    This workbook guides the development and creation of service metrics that are directly tied to stakeholder needs.

    This process will ensure that your service metrics are designed with the business perspective in mind so they are fully aligned with business objectives.

    1. Who are the relevant stakeholders?
    2. What are the goals and pain points of your stakeholders?
    3. What do the stakeholders need to know?
    4. What does IT need to measure?
    5. What are the appropriate IT metrics?

    Download the Metrics Development Workbook.

    Sample of Info-Tech's Metrics Development Workbook.

    Determine your stakeholders

    Supporting Tool icon 1.1 0.5 Hour

    Who are your stakeholders?

    1. Identify the primary stakeholders of your service metrics. Stakeholders are the people who have a very specific need to know about how IT services affect their business outcomes. Different stakeholders can have different perspective on the same IT service metric.Most often, the primary target of service metrics are the business stakeholders, e.g. VP of a business unit.
    2. Identify any additional stakeholders. The CIO is also a stakeholder since they are effectively the business relationship manager for the senior leaders.

    Video Conferencing Case Study
    Manufacturing company

    For this phase, we will demonstrate how to derive the service metrics by going through the steps in the methodology.

    At a manufacturing company, the CIO’s main stakeholder is the CEO, whose chief concern is to improve the financial position of the company.

    Identify goals and pain points of your stakeholders

    Supporting Tool icon 1.2 0.5 Hour

    What are their goals and pain points?

    1. Clearly identify each stakeholder’s business goals and outcomes. These would be particular business goals related to a specific business unit.
    2. Identify particular pain points for each business unit to understand what is preventing them from achieving the desirable business outcome.

    VC Case Study

    One of the top initiatives identified by the company to improve financial performance was to reduce expense.

    Because the company has several key locations in different states, company executives used to travel extensively to carry out meetings at each location.

    Therefore, travel expenses represent a significant proportion of operational expenses and reducing travel costs is a key goal for the company’s executives.

    What do the stakeholders need to know?

    Supporting Tool icon 1.3 0.5 Hour

    What do the stakeholders need to know?

    1. Identify the key things that the stakeholders would need to know based on the goals and pain points derived from the previous step.These are your success criteria and must be met to successfully achieve the desired goals.

    VC Case Study

    The CEO needs to have assurance that without executives traveling to each location, remote meetings can be as effective as in-person meetings.

    These meetings must provide the same outcome and allow executives to collaborate and make similar strategic decisions without the onsite, physical presence.

    Therefore, the success criteria are:

    • Reduced travel costs
    • Effective collaboration
    • High-quality meetings

    What do I need to measure?

    Supporting Tool icon 1.4 1 Hour

    What does IT need to measure?

    1. Identify the IT services that are leveraged to achieve the business goals and success criteria.
    2. Identify the users of those services and determine the nature of usage for each group of users.
    3. Identify the key indicators that must be measured for those services from an IT perspective.

    VC Case Study

    The IT department decides to implement the video conferencing service to reduce the number of onsite meetings. This technology would allow executives to meet remotely with both audio and video and is the best option to replicate a physical meeting.

    The service is initially available to senior executives and will be rolled out to all internal users once the initial implementation is deemed successful.

    To determine the success of the service, the following needs to be measured:

    1. Outcomes of VC meetings
    2. Quality of the VC meetings
    3. Reduction in travel expenses

    Derive service metrics

    Supporting Tool icon 1.5 0.5 Hour

    Derive your service metrics

    1. Derive the service metrics that are meaningful to business stakeholders based on the IT services and the key indicators identified in the previous steps.
    2. Distinguish between service metrics and business metrics. You may identify some business metrics in addition to the IT metrics, and although these are important, IT doesn’t own the process of tracking and reporting business metrics.

    VC Case Study

    In the previous step, IT identified that it must measure the outcomes of VC meetings, quality of the VC meetings, and the reduction in travel expenses. From these, the appropriate service metrics can be derived to answer the needs of the CEO.

    IT needs to measure:

    1. Percent of VC meetings successfully delivered
    2. Growth of number of executive meetings conducted via VC
    Outcomes

    IT also identified the following business metrics:

    1. Reduction in percent of travel expense/spend
    2. Reduction in lost time due to travel

    Validate your metrics

    Once appropriate service metrics are derived from business objectives, the next step is to determine whether or not it is viable to actually measure the metrics.

    Can you measure it? The first question IT must answer is whether the metric is measurable. IT must identify the data source, validate its ability to collect the data, and specify the data requirement. Not all metrics can be measured!
    How will you measure it? If the metric is measurable, the next step is to create a way to measure the actual data. In most cases, simple formulas that can be easily understood are the best approach.
    Define your actions Metrics must be used to drive or reinforce desirable outcomes and behaviors. Thus, IT must predetermine the necessary actions associated with the different metric levels, thresholds, or trends.

    Determine if you can measure the identified metric

    Supporting Tool icon 1.6 0.5 Hour

    INSTRUCTIONS

    1. Determine what data sources are available. Make sure that you know where the information you need is captured, or will need to be captured. This would include:
      • A ticket/request system
      • An auto discovery tool
      • A configuration management database ( CMDB)
    2. Confirm that IT has the ability to collect the information.
      • If the necessary data is already contained in an identified data source, then you can proceed.
      • If not, consider whether it’s possible to gather the information using current sources and systems.
      • Understand the constraints and cost/ROI to implement new technology or revise processes and data gathering to produce the data.

    VC Case Study

    Using the metric derived from the video conferencing service example, IT wants to measure the % of VC meetings successfully delivered.

    What are the data sources?

    • Number of VC meetings that took place
    • Number of service incidents
    • User survey

    Determine if you can measure the identified metric

    Supporting Tool icon 1.6 0.5 Hour

    INSTRUCTIONS

    1. Understand your data requirements
      • To produce relevant metrics from your data, you need to ensure the level of quality and currency that provides you with useful information. You need to define:
        • The level of detail that has to be captured to make the data useful.
        • The consistency of the data, and how it needs to be entered or gathered.
        • The accuracy of the data. This includes how current the data needs to be, how quickly changes have to be made, and how data quality will be verified.

    VC Case Study

    Data requirement for percent of successful VC meetings:

    • Level of detail – user category, location, date/time,
    • Consistency – how efficiently are VC-related incidents opened and closed? Is the data collected and stored consistently?
    • Accuracy – is the information entered accurately?

    Create the calculation to measure it

    Supporting Tool icon 1.7 0.5 Hour

    Determine how to calculate the metrics.

    INSTRUCTIONS
    1. Develop the calculations that will be used for each accepted metric. The measurement needs to be clear and straightforward.
    2. Define the scope and assumptions for each calculation, including:
      • The defined measurement period (e.g. monthly, weekly)
      • Exclusions (e.g. nonbusiness hours, during maintenance windows)

    VC Case Study

    Metric: Percent of VC meetings delivered successfully

    IT is able to determine the total number of VC meetings that took place and the number of VC service requests to the help desk.

    That makes it possible to use the following formula to determine the success percentage of the VC service:

    ((total # VC) – (# of VC with identified incidents)) / (total # VC) * 100

    Define the actions to be taken for each metric

    Supporting Tool icon 1.7 1.5 Hour

    INSTRUCTIONS

    Centered on the defined metrics and their calculations, IT can decide on the actions that should be driven out of each metric based on one of the following scenarios:
    • Scenario 1: Ad hoc remedial action and root-cause investigation. If the reason for the result is unknown, determining root cause or identifying trends is required to determine required actions.
    • Scenario 2: Predefined remedial action. A set of predetermined actions associated with different results. This is useful when the meaning of the results is clear and points to specific issues within the environment.
    • Scenario 3: Nonremedial action. The metrics may produce a result that reinforces or supports company direction and strategy, or identifies an opportunity that may drive a new initiative or idea.

    VC Case Study

    If the success rate of the VC meetings is below 90%, IT needs to focus on determining if there is a common cause and identify if this is a consistent downward trend.

    A root-cause analysis is performed that identifies that network issues are causing difficulties, impacting the connection quality and usability of the VC service.

    Validate the confirmed metrics with the business

    Supporting Tool icon 1.8 1 Hour

    INPUT: Selected service metrics, Discussion with the business

    OUTPUT: Validated metrics with the business

    Materials: Metrics with calculation methodology

    Participants: IT and business stakeholders, Service owners

    INSTRUCTIONS

    1. Once you have derived the appropriate metrics and established that the metrics are measurable, you must go back to the targeted stakeholders and validate that the selected metrics will provide the right information to meet their identified goals and success criteria.
    2. Add confirmed metrics to the Metrics Tracking Tool, in the Metrics Tracking Plan tab.
    Service Metric Corresponding
    Business Goal
    Measurement
    Method
    Defined Actions

    Example: Measuring the online banking service at a financial institution

    Who are IT’s stakeholders? The financial institution provides various banking solutions to its customers. Retail banking is a core service offered by the bank and the VP of retail banking is a major stakeholder of IT.
    What are their goals and pain points? The VP of retail banking’s highest priorities are to increase revenue, increase market share, and maintain the bank’s brand and reputation amongst its customers.
    What do they need to know? In order to measure success, the VP of retail banking needs to determine performance in attracting new clients, retaining clients, expanding into new territory, and whether they have increased the number of services provided to existing clients.
    What does IT need to measure? The recent implementation of an online banking service is a key initiative that will keep the bank competitive and help retail banking meet its goals. The key indicators of this service are: the total number of clients, the number of products per client, percent of clients using online banking, number of clients by segment, service, territory.
    Derive the service metrics Based on the key indicators, IT can derive the following service metrics:
    1. Number of product applications originated from online banking
    2. Customer satisfaction/complaints
    As part of the process, IT also identified some business metrics, such as the number of online banking users per month or the number of times a client accesses online banking per month.

    Design service metrics to track service performance and value

    CASE STUDY
    Industry: Manufacturing | Source: CIO
    Challenge Solution Results
    The IT organization needed to generate metrics to show the business whether the video conferencing service was being adopted and if it was providing the expected outcome and value.

    Standard IT metrics were technical and did not provide a business context that allowed for easy understanding of performance and decision making.

    The IT organization, working through the CIO and service managers, sat down with the key business stakeholders of the video conferencing service.

    They discussed the goals for the meeting and defined the success criteria for those goals in the context of video conference meeting outcomes.

    The success criteria that were discussed were then translated into a set of questions (key performance indicators) that if answered, would show that the success criteria were achieved.

    The service manager identified what could be measured to answer the defined questions and eliminated any metrics that were either business metrics or non-IT related.

    The remaining metrics were identified as the possible service metrics, and the ability to gather the information and produce the metric was confirmed.

    Service metrics were defined for:

    1. Percent of video conference meetings delivered successfully
    2. Growth in the number of executive meetings conducted via video conference

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    Photo of Valence Howden, Senior Manager, CIO Advisory, Info-Tech Research Group.
    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    1.1

    Sample of activity 1.1 'Determine your stakeholders'. Determine stakeholder needs, goals, and pain points

    The onsite analyst will help you select key stakeholders and analyze their business objectives and current pain points.

    1.2

    Sample of activity 1.2 'Identify goals and pain points of your stakeholders'. Determine the success criteria and related IT services

    The analyst will facilitate a discussion to uncover the information that these stakeholders care about. The group will also identify the IT services that are supporting these objectives.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    1.5

    Sample of activity 1.5 'Derive service metrics'. Derive the service metrics

    Based on the key performance indicators obtained in the previous page, derive meaningful business metrics that are relevant to the stakeholders.

    1.6

    Sample of activity 1.6 'Determine if you can measure the identified metric'. Validate the data collection process

    The analyst will help the workshop group determine whether the identified metrics can be collected and measured. If so, a calculation methodology is created.

    1.7

    Sample of activity 1.7 'Create the caluclation to measure it'. Validate metrics with stakeholders

    Establish a feedback mechanism to have business stakeholders validate the meaningfulness of the metrics.

    Develop Meaningful Service Metrics to Ensure Business and User Satisfaction

    PHASE 2

    Design Reports and Dashboards

    Step (2): Design Reports and Dashboards

    PHASE 1PHASE 2PHASE 3

    1.1

    Derive the Service Metrics

    1.2

    Validate the Metrics

    2.1

    Determine Reporting Format

    3.1

    Select Pilot Metrics

    3.2

    Activate and Maintain Metrics

    This step involves the following participants:

    • Business Relationship Manager
    • Service Level Manager
    • Business Stakeholders

    Outcomes of this step

    • Presentation format selected based on stakeholder needs and preference for information
    • Presentation format validated with stakeholders

    Phase 2 outline

    Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 2: Design Reports and Dashboards

    Proposed Time to Completion (in weeks): 3 weeks
    Step 2.1: Select Presentation Format Step 2.2: Review Design
    Start with an analyst kick-off call:
    • Review the different format of metrics presentation and discuss the pros/cons of each format
    • Discuss stakeholder needs/preference for data
    • Select the presentation format
    Review findings with analyst:
    • Discuss stakeholder feedback based on selected presentation format
    • Modify and adjust the presentation format as needed
    Then complete these activities…
    • Design the metrics using the selected format
    Then complete these activities…
    • Finalize the design for metrics presentation
    With these tools & templates:
    • Metrics Presentation Format Selection Guide
    With these tools & templates:
    • Metrics Presentation Format Selection Guide

    Design the reports – overview

    Figure representing 'SLM' and/or 'BRM'. Step 1
    Understand the pros and cons of different reporting styles
    Figure representing 'SLM' and/or 'BRM'. Step 2
    Determine your reporting and presentation style

    Presentation Format Selection

    Figure representing 'SLM' and/or 'BRM'. Step 3
    Design your metrics reports
    A star.

    Validated Service Reports

    The design of service metrics reporting is critically important. The reporting style must present the right information in the most interesting and stakeholder-centric way possible to ensure that it is read and used.

    The reports must also display information in a way that generates actions. If your stakeholders cannot make decisions, kick off activities, or ask questions based on your reports, then they have no value.

    Determine the right presentation format for your metrics

    Most often, metrics are presented in the following ways:

    Dashboard
    (PwC. “Mega-Trends and Implications.”)
    Sample of the 'Dashboard' metric presentation format.
    Infographic
    (PwC. “Healthcare’s new entrants.”)
    Sample of the 'Infographic' metric presentation format.
    Report
    (PwC Blogs. “Northern Lights.”)
    Sample of the 'Report' metric presentation format.
    Scorecard
    (PwC. “Annual Report 2015.”)
    Sample of the 'Scorecard' metric presentation format.

    Understand the advantages and disadvantages of each reporting style – Dashboard

    A dashboard is a reporting method that provides a dynamic at-a-glance view of key metrics from the perspective of key stakeholders. It provides a quick graphical way to process important performance information in real time.

    Features

    Typically web-based

    Dynamic data that is updated in real time

    Advantage

    Aggregates a lot of information into a single view

    Presents metrics in a simplistic style that is well understood

    Provides a quick point-in-time view of performance

    Easy to consume visual presentation style

    Disadvantage

    Complicated to set up well.
    Requires additional technology support: programming, API, etc.

    Promotes a short-term outlook – focus on now, no historical performance and no future trends. Doesn’t provide the whole picture and story.

    Existing dashboard tools are often not customized enough to provide real value to each stakeholder.

    Dashboards present real-time metrics that can be accessed and viewed at any time

    Sample of the 'Dashboard' metric presentation format.
    (Source: PwC. “Mega-Trends and Implications.”)
    Metrics presented through online dashboards are calculated in real time, which allows for a dynamic, current view into the performance of IT services at any time.

    Understand the advantages and disadvantages of each reporting style – Infographic

    An infographic is a graphical representation of metrics or data, which is used to show information quickly and clearly. It’s based on the understanding that people retain and process visual information more readily than written details.

    Features

    Turns dry into attractive –transforms data into eye-catching visual memory that is easier to retain

    Can be used as the intro to a formal report

    There are endless types of infographics

    Advantage

    Easily consumable

    Easy to retain

    Eye catching

    Easily shared

    Spurs conversation

    Customizable

    Disadvantage

    Require design expertise and resources

    Can be time consuming to generate

    Could be easily misinterpreted

    Message can be lost with poor design

    Infographics allow for completely unique designs

    Sample of the 'Infographic' metric presentation format.
    (Source: PwC. “Healthcare’s new entrants…”)
    There is no limit when it comes to designing an infographic. The image used here visually articulates the effects of new entrants pulling away the market.

    Understand the advantages and disadvantages of each reporting style – Formal Report

    A formal report is a more structured and official reporting style that contains detailed research, data, and information required to enable specific business decisions, and to help evaluate performance over a defined period of time.

    Definition

    Metrics can be presented as a component of a periodic, formal report

    A physical document that presents detailed information to a particular audience

    Advantage

    More detailed, more structured and broader reporting period

    Formal, shows IT has put in the effort

    Effectively presents a broader and more complete story

    Targets different stakeholders at the same time

    Disadvantage

    Requires significant effort and resources

    Higher risk if the report does not meet the expectation of the business stakeholder

    Done at a specific time and only valuable for that specific time period

    Harder to change format

    Formal reports provide a detailed view and analysis of performance

    Sample of the 'Formal Report' metric presentation format.
    (Source: PwC Blogs. “Northern Lights: Where are we now?”)
    An effective report incorporates visuals to demonstrate key improvements.

    Formal reports can still contain visuals, but they are accompanied with detailed explanations.

    Understand the advantages and disadvantages of each reporting style – Scorecard

    A scorecard is a graphic view of the progress and performance over time of key performance metrics. These are in relation to specified goals based on identified critical stakeholder objectives.

    Features

    Incorporates multiple metrics effectively.

    Scores services against the most important organizational goals and objectives. Scorecards may tie back into strategy and different perspectives of success.

    Advantage

    Quick view of performance against objectives

    Measure against a set of consistent objectives

    Easily consumable

    Easy to retain

    Disadvantage

    Requires a lot of forethought

    Scorecards provide a time-bound summary of performance against defined goals

    Sample of the 'Scorecard' metric presentation format.
    (PwC. “Annual Report 2015.”)
    Scorecards provide a summary of performance that is directly linked to the organizational KPIs.

    Determine your report style

    Supporting Tool icon 2.1 Metrics Presentation Format Selection Guide

    In this section, you will determine the optimal reporting style for the service metrics.

    This guide contains four questions, which will help IT organizations identify the most appropriate presentation format based on stakeholder preference and needs for metrics.

    1. Who is the relevant stakeholder?
    2. What are the defined actions for the metric?
    3. How frequently does the stakeholder need to see the metric?
    4. How does the stakeholder like to receive information?
    Sample of Info-Tech's Metrics Presentation Format Selection Guide.
    Download the Metrics Presentation Format Selection Guide.

    Determine your best presentation option

    Supporting Tool icon 2.1 2 Hours

    INPUT: Identified stakeholder and his/her role

    OUTPUT: Proper presentation format based on need for information

    Materials: Metrics Presentation Format Selection Guide

    Participants: BRM, SLM, Program Manager

    After deciding on the report type to be used to present the metric, the organization needs to consider how stakeholders will consume the metric.

    There are three options based on stakeholder needs and available presentation options within IT.

    1. Paper-based presentation is the most traditional form of reporting and works well with stakeholders who prefer physical copies. The report is produced at a specific time and requires no additional IT capability.
    2. Online documents stored on webpages, SharePoint, or another knowledge management system could be used to present the metrics. This allows the report to be linked to other information and easily shared.
    3. Online dashboards and graphics can be used to have dynamic, real-time reporting and anytime access. These webpages can be incorporated into an intranet and allow the user to view the metrics at any time. This will require IT to continuously update the data in order to maintain the accuracy of the metrics.

    Design your metric reports with these guidelines in mind

    Supporting Tool icon 2.2 30 Minutes
    1. Stakeholder-specificThe report must be driven by the identified stakeholder needs and preferences and articulate the metrics that are important to them.
    2. ClarityTo enable decision making and drive desired actions, the metrics must be clear and straightforward. They must be presented in a way that clearly links the performance measurement to the defined outcome without leading to different interpretations of the results.
    3. SimplicityThe report must be simple to read, understand, and analyze. The language of the report must be business-centric and remove as much complexity as possible in wording, imaging, and context.

    Be sure to consider access rights for more senior reports. Site and user access permissions may need to be defined based on the level of reporting.

    Metrics reporting on the video conferencing service

    CASE STUDY
    Industry: Manufacturing | Source: CIO Interview
    The Situation

    The business had a clear need to understand if the implementation of video conferencing would allow previously onsite meetings to achieve the same level of effectiveness.

    Reporting Context

    Provided reports had always been generated from an IT perspective and the business rarely used the information to make decisions.

    The metrics needed to help the business understand if the meetings were remaining effective and be tied into the financial reporting against travel expenses, but there would be limited visibility during the executive meetings.

    Approach

    The service manager reviewed the information that he had gathered to confirm how often they needed information related to the service. He also met with the CIO to get some insight into the reports that were already being provided to the business, including the ones that were most effective.

    Considerations

    The conversations identified that there was no need for a dynamic real-time view of the performance of the service, since tracking of cost savings and utility would be viewed monthly and quarterly. They also identified that the item would be discussed within a very small window of time during the management meetings.

    The Solution

    It was determined that the best style of reporting for the metric was an existing scorecard that was produced monthly, using some infographics to ensure that the information is clear at a glance to enable quick decision making.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    Photo of Valence Howden, Senior Manager, CIO Advisory, Info-Tech Research Group.
    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    2.1

    Sample of presentation format option slide 'Determine the right presentation format for your metrics'. Understand the different presentation options

    The onsite analyst will introduce the group to the communication vehicles of infographic, scorecard, formal report, and dashboard.

    2.1

    Sample of activity 2.1 'Determine your best presentation option'. Assess stakeholder needs for information

    For selected stakeholders, the analyst will facilitate a discussion on how stakeholders would like to view information and how the metrics can be presented to aid decision making.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    2.2

    Sample of activity 2.2 'Design your metric reports with these guidelines in mind'. Select and design the metric report

    Based on the discussion, the working group will select the most appropriate presentation format and create a rough draft of how the report should look.

    Develop Meaningful Service Metrics to Ensure Business and User Satisfaction

    PHASE 3

    Implement, Track, and Maintain Your Metrics

    Step (3): Implement, Track, and Maintain Your Metrics

    PHASE 1PHASE 2PHASE 3

    1.1

    Derive the Service Metrics

    1.2

    Validate the Metrics

    2.1

    Determine Reporting Format

    3.1

    Select Pilot Metrics

    3.2

    Activate and Maintain Metrics

    This step involves the following participants:

    • Service Level Manager
    • Business Relationship Manager
    • Service Metrics Program Manager

    Activities in this step

    • Determine the first batch of metrics to be implemented as part of the pilot program
    • Create a process to collect and validate data, determine initial targets, and integrate with SLM and BRM functions
    • Present the metric reports to the relevant stakeholders and incorporate the feedback into the metric design
    • Establish a standard process and roll out the implementation of metrics in batches
    • Establish a process to monitor and track the effectiveness of the service metrics program and make adjustments when necessary

    Phase 3 outline

    Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 3: Implement, Track, and Maintain Your Metrics

    Proposed Time to Completion (in weeks): 4 weeks
    Step 3.1: Select and Launch Pilot Metrics Step 3.2: Track and Maintain the Metrics
    Start with an analyst kick-off call:
    • Identify metrics that will be presented first to the stakeholders based on urgency or impact of the IT service
    • Determine the process to collect data, select initial targets, and integrate with SLM and BRM functions
    Review findings with analyst:
    • Review the success of metrics and discuss feedback from stakeholders
    • Roll out the metrics implementation to a broader audience
    • Establish roles and timelines for metrics maintenance
    Then complete these activities…
    • Document the first batch of metrics
    • Document the baseline, initial targets
    • Create a plan to integrate with SLM and BRM functions
    Then complete these activities…
    • Create a document that defines how the organization will track and maintain the success of the metrics program
    • Review the metrics program periodically
    With these tools & templates:
    • Metrics Tracking Tool
    With these tools & templates:
    • Metrics Tracking Tool

    Implement, Track, and Maintain the Metrics

    Figure representing 'SLM' and/or 'BRM'. Step 1
    Run your pilot

    Metrics Tracking Tool

    Figure representing 'SLM' and/or 'BRM'. Step 2
    Validate success

    Metrics Tracking Tool

    Figure representing 'SLM' and/or 'BRM'. Step 3
    Implement your metrics program in batches

    Metrics Tracking Tool

    A star.

    Active Service Metrics Program

    Once you have defined the way that you will present the metrics, you are ready to run a pilot with a smaller sample of defined service metrics.

    This allows you to validate your approach and make refinements to the implementation and maintenance processes where necessary, prior to activating all service metrics.

    Track the performance of your service metrics

    Supporting Tool icon 3.1

    The Metrics Tracking Tool will enable you to track goals and success metrics for your service metrics programs. It allows you to set long-term goals and track your results over time.

    There are three sections in this tool:
    1. Metrics Tracking Plan. Identify the metrics to be tracked and their purpose.
    2. Metrics Tracking Actuals. Monitor and track the actual performance of the metrics.
    3. Remediation Tracking. Determine and document the steps that need to be taken to correct a sub-performing metric.
    Sample of Info-Tech's Metrics Tracking Tool.

    Select pilot metrics

    Supporting Tool icon 3.1 30 Minutes

    INPUT: Identified services, Business feedback

    OUTPUT: Services with most urgent need or impact

    Materials: Service catalog or list of identified services

    Participants: BRM, SLM, Business representatives

    To start the implementation of your service metrics program and drive wider adoption, you need to run a pilot using a smaller subset of metrics.

    INSTRUCTIONS

    To determine the sample for the pilot, consider metrics that:

    • Are related to critical business services and functions
    • or
    • Address known/visible pain points for the business
    • or
    • Were designed for supportive or influential stakeholders

    Metrics that meet two or more criteria are ideal for the pilot

    Collect and validate data

    Supporting Tool icon 3.2 1 Hour

    INPUT: Identified metrics

    OUTPUT: A data collection mythology, Metrics tracking

    Materials: Metrics

    Participants: SLM, BRM, Service owner

    You will need to start collection and validation of your identified data in order to calculate the results for your pilot metrics.

    INSTRUCTIONS

    1. Initiate data collection
      • Use the data sources identified during the design phase and initiate the data collection process.
    2. Determine start date
      • If historical data can be retrieved and gathered, determine how far back you want your measurements to start.
    3. Compile data and validate
      • Ensure that the information is accurate and up to date. This will require some level of data validation and audit.
    4. Run the metric
      • Use the defined calculation and source data to generate the metrics result.
    5. Record metrics results
      • Use the metrics tracking sheet to track the actual results.

    Determine initial targets

    Supporting Tool icon 3.3 1 Hour

    INPUT: Historical data/baseline data

    OUTPUT: Realistic initial target for improvement

    Materials: Metrics Tracking Tool

    Participants: BRM, SLM, Service owner

    INSTRUCTIONS

    Identify an initial service objective based on one or more of the following options:

    1. Establish an initial target using historical data and trends of performance.
    2. Establish an initial target based on stakeholder-identified requirements and expectations.
    3. Run the metrics report over a defined period of time and use the baseline level of achievement to establish an initial target.

    The target may not always be a number - it could be a trend. The initial target will be changed after review with stakeholders

    Integrate with SLM and BRM processes

    Supporting Tool icon 3.4 1 Hour

    INPUT: SLM and BRM SOPs or responsibility documentations

    OUTPUT: Integrate service metrics into the SLM/BRM role

    Materials: SLM / BRM reports

    Participants: SLM, BRM, CIO, Program manager, Service manager

    The service metrics program is usually initiated, used, and maintained by the SLM and BRM functions.

    INSTRUCTIONS

    Ensure that the metrics pilot is integrated with those functions by:

    1. Engaging with SLM and BRM functions/resources
      • Identify SLM and BRM resources associated with or working on the services where the metrics are being piloted
      • Obtain their feedback on the metrics/reporting
    2. Integrating with the existing reporting and meeting cycles
      • Ensure the metrics will be calculated and available for discussion at standing meetings and with existing reports
    3. Establishing the metrics review and validation cycle for these metrics
      • Confirm the review and validation period for the metrics in order to ensure they remain valuable and actionable

    Generate reports and present to stakeholders

    Supporting Tool icon 3.5 1 Hour

    INPUT: Identified metrics, Selected presentation format

    OUTPUT: Metrics reports that are ready for distribution

    Materials: Metrics Presentation Format Selection Guide

    Participants: BRM, SLM, CIO, Business representatives

    INSTRUCTIONS

    Once you have completed the calculation for the pilot metrics:

    1. Confirm the report style for the selected metrics (as defined in Phase 2)
    2. Generate the reporting for the pilot metrics
    3. Present the pilot metric reports to the identified BRM and SLM resources who will present the reporting to the stakeholders
    4. Gather feedback from Stakeholders on metrics - results and process
    5. Create and execute remediation plans for any actions identified from the metrics
    6. Initiate the review cycle for metrics (to ensure they retain value)

    Plan the rollout and implementation of the metrics reporting program

    Supporting Tool icon 3.6 1 Hour

    INPUT: Feedback from pilot, Services in batch

    OUTPUT: Systematic implementation of metrics

    Materials: Metrics Tracking Tool

    Participants: BRM, SLM, Program manager

    Upon completion of the pilot, move to start the broader implementation of metrics across the organization:

    INSTRUCTIONS

    1. Identify the service metrics that you will implement. They can be selected based on multiple criteria, including:
      • Organizational area/business unit
      • Service criticality
      • Pain points
      • Stakeholder engagement (detractors, supporters)
    2. Create a rollout plan for implementation in batches, identifying expected launch timelines, owners, targeted stakeholders, and communications plans
    3. Use the implementation plan from the pilot to roll out each batch of service metrics:
      • Collect and validate data
      • Determine target(s)
      • Integrate with BRM and SLM
      • Generate and communicate reports to stakeholders

    Maintain the service metrics

    Supporting Tool icon 3.7 1.5 Hour

    INPUT: Feedback from business stakeholders

    OUTPUT: Modification to individual metrics or to the process

    Materials: Metrics Tracking Tool, Metrics Development Workbook

    Participants: CIO, BRM, SLM, Program manager, Service owner

    Once service metrics and reporting become active, it is necessary to determine the review time frame for your metrics to ensure they remain useful.

    INSTRUCTIONS

    1. Confirm and establish a review time frame with stakeholders (e.g. annually, bi-annually, after organizational or strategic changes).
    2. Meet with stakeholders by the review date to discuss the value of existing metrics and validate:
      • Whether the goals associated with the metrics are still valid
      • If the metric is still necessary
      • If there is a more effective way to present the metrics
    3. Track actions based on review outcomes and update the remediation tracking sheet.
    4. Update tracking sheet with last complete review date.

    Maintain the metrics

    Supporting Tool icon 3.7

    Based on the outcome of the review meeting, decide what needs to be done for each metric, using the following options:

    Add

    A new metric is required or an existing metric needs large-scale changes (example: calculation method or scope).
    Triggers metrics design as shown in phases 1 and 2.

    Change

    A minor change is required to the presentation format or data. Note: a major change in a metric would be performed through the Add option.

    Remove

    The metric is no longer required, and it needs to be removed from reporting and data gathering. A final report date for that metric should be determined.

    Maintain

    The metric is still useful and no changes are required to the metric, its measurement, or how it’s reported.

    Ensuring metrics remain valuable

    VC CASE STUDY
    Industry: Manufacturing | Source: CIO Interview

    Reviewing the value of active metrics

    When the video conferencing service was initially implemented, it was performed as a pilot with a group of executives, and then expanded for use throughout the company. It was understood that prior to seeing the full benefit in cost reduction and increased efficiency and effectiveness, the rate of use and adoption had to be understood.

    The primary service metrics created for the service were based on tracking the number of requests for video conference meetings that were received by the IT organization. This identified the growth in use and could be used in conjunction with financial metrics related to travel to help identify the impact of the service through its growth phase.

    Once the service was adopted, this metric continued to be tracked but no longer showed growth or expanded adoption.

    The service manager was no longer sure this needed to be tracked.

    Key Activity

    The metrics around requests for video conference meetings were reviewed at the annual metrics review meeting with the business. The service manager asked if the need for the metric, the goal of tracking adoption, was still important for the business.

    The discussion identified that the adoption rate was over 80%, higher than anticipated, and that there was no value in continuing to track this metric.

    Based on the discussion, the adoption metrics were discontinued and removed from data gathering and reporting, while a success rate metric was added (how many meetings ran successfully and without issue) to ensure the ongoing value of the video conferencing service.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    Photo of Valence Howden, Senior Manager, CIO Advisory, Info-Tech Research Group.
    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    3.1

    Sample of activity 3.1 'Select pilot metrics'. Select the pilot metrics

    The onsite analyst will help the workshop group select the metrics that should be first implemented based on the urgency and impact of these metrics.

    3.2

    Sample of activity 3.2 'Collect and validate data'. Gather data and set initial targets

    The analyst will help the group create a process to gather data, measure baselines, and set initial targets.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    3.5

    Sample of activity 3.5 'Generate reports and present to stakeholders'. Generate the reports and validate with stakeholders

    The Info-Tech analyst will help the group establish a process to receive feedback from the business stakeholders once the report is generated.

    3.6

    Sample of activity 3.6 'Plan the rollout and implementation of the metrics reporting program'. Implement the service metrics program

    The analyst will facilitate a discussion on how to implement the metrics program across the organization.

    3.7

    Sample of activity 3.7 'Maintain the service metrics'. Track and maintain the metrics program

    Set up a mechanism to ensure the success of the metrics program by assessing process adherence and process validity.

    Insight breakdown

    Insight 1

    Service metrics are critical to ensuring alignment of IT service performance and business service value achievement.

    Insight 2

    Service metrics reinforce positive business and end-user relationships by providing user-centric information that drives responsiveness and consistent service improvement.

    Insight 3

    Poorly designed metrics drive unintended and unproductive behaviors that have negative impacts on IT and produce negative service outcomes.

    Summary of accomplishment

    Knowledge Gained

    • Follow a methodology to identify metrics that are derived from business objectives.
    • Understand the proper presentation format based on stakeholder needs for information.
    • Establish a process to ensure the metrics provided will continue to provide value and aid decision making.

    Processes Optimized

    • Metrics presentation to business stakeholders
    • Metrics maintenance and tracking

    Deliverables Completed

    • Metrics Development Workbook
    • Metrics Presentation Format Selection Guide
    • Metrics Tracking Tool

    Research contributors and experts

    Name Organization
    Joe Evers Joe Evers Consulting
    Glen Notman Associate Partner, Citihub
    David Parker Client Program Manager, eHealth Ontario
    Marianne Doran Collins CIO, The CIO-Suite, LLC
    Chris Kalbfleisch Manager, Service Management, eHealth Ontario
    Joshua Klingenberg BHP Billiton Canada Inc.

    Related Info-Tech research

    Stock image of a menu. Design & Build a User-Facing Service Catalog
    The user-facing service catalog is the go-to place for IT service-related information.
    Stock image of a laptop keyboard. Unleash the True Value of IT by Transforming Into a Service Provider
    Earn your seat at the table and influence business strategy by becoming an IT service provider.

    Bibliography

    Pollock, Bill. “Service Benchmarking and Measurement: Using Metrics to Drive Customer Satisfaction and Profits.” Aberdeen Group. June 2009. http://722consulting.com/ServiceBenchmarkingandMeasurement.pdf

    PwC. “Mega-Trends and Implications.” RMI Discussion. LinkedIn SlideShare. September 2015. http://www.slideshare.net/AnandRaoPwC/mega-trends-and-implications-to-retirement

    PwC. “Healthcare’s new entrants: Who will be the industry’s Amazon.com?” Health Research Institute. April 2014. https://www.pwc.com/us/en/health-industries/healthcare-new-entrants/assets/pwc-hri-new-entrant-chart-pack-v3.pdf

    PwC. “Northern Lights: Where are we now?” PwC Blogs. 2012. http://pwc.blogs.com/files/12.09.06---northern-lights-2--summary.pdf

    PwC. “PwC’s key performance indicators

    Terms and Conditions for consulting to businesses

    By signing an agreement with Gert Taeymans bvba, Client declares that he agrees with the Terms and Conditions referred to hereafter. Terms and conditions on Client's order form or any other similar document shall not be binding upon Gert Taeymans bvba.

    The prices, quantities and delivery time stated in any quotation are not binding upon Gert Taeymans bvba. They are commercial estimates only which Gert Taeymans bvba will make reasonable efforts to achieve. Prices quoted in final offers will be valid only for 30 days. All prices are VAT excluded and do not cover expenses, unless otherwise agreed in writing. Gert Taeymans bvba reserves the right to increase a quoted fee in the event that Client requests a variation to the work agreed.

    The delivery times stated in any quotation are of an indicative nature and not binding upon Gert Taeymans bvba, unless otherwise agreed in writing. Delivery times will be formulated in working days. In no event shall any delay in delivery be neither cause for cancellation of an order nor entitle Client to any damages.

    Amendments or variations of the initial agreement between Client and Gert Taeymans bvba will only be valid when accepted by both parties in writing.

    Any complaints concerning the performance of services must be addressed to Gert Taeymans bvba in writing and by registered mail within 7 working days of the date of the performance of the services.

    In no event shall any complaint be just cause for non-payment or deferred payment of invoices. Any invoice and the services described therein will be deemed irrevocably accepted by Client if no official protest of non-payment has been sent by Client within 7 working days from the date of the mailing of the invoice.

    Client shall pay all invoices of Gert Taeymans bvba within thirty (30) calendar days of the date of invoice unless otherwise agreed in writing by Gert Taeymans bvba. In the event of late payment, Gert Taeymans bvba may charge a monthly interest on the amount outstanding at the rate of two (2) percent with no prior notice of default being required, in which case each commenced month will count as a full month. Any late payment will entitle Gert Taeymans bvba to charge Client a fixed handling fee of 300 EUR. All costs related to the legal enforcement of the payment obligation, including lawyer fees, will be charged to Client.

    In no event will Gert Taeymans bvba be liable for damages of any kind, including without limitation, direct, incidental or consequential damages (including, but not limited to, damages for lost profits, business interruption and loss of programs or information) arising out of the use of Gert Taeymans bvba services.

    Gert Taeymans bvba collects personal data from Client for the performance of its services and the execution of its contracts. Such personal data can also be used for direct marketing, allowing Gert Taeymans bvba to inform Client of its activities on a regular basis. If Client objects to the employment of its personal data for direct marketing, Client must inform Gert Taeymans bvba on the following address: gert@gerttaeymans.consulting.

    Client can consult, correct or amend its personal data by addressing such request to Gert Taeymans bvba by registered mail. Personal data shall in no event be sold, rented or made available to other firms or third parties where not needed for the execution of the contract. Gert Taeymans bvba reserves the right to update and amend its privacy policy from time to time to remain consistent with applicable privacy legislation.

    The logo of the Client will be displayed on the Gert Taeymans bvba website, together with a short description of the project/services.

    Any changes to Client’s contact information such as addresses, phone numbers or e-mail addresses must be communicated to Gert Taeymans bvba as soon as possible during the project.

    Both parties shall maintain strict confidence and shall not disclose to any third party any information or material relating to the other or the other's business, which comes into that party's possession and shall not use such information and material. This provision shall not, however, apply to information or material, which is or becomes public knowledge other than by breach by a party of this clause.

    Gert Taeymans bvba has the right at any time to change or modify these terms and conditions at any time without notice.

    The agreement shall be exclusively governed by and construed in accordance with the laws of Belgium. The competent courts of Antwerp, Belgium will finally settle any dispute about the validity, the interpretation or the execution of this agreement.

    These Terms and Conditions are the only terms and conditions applicable to both parties.

    If any provision or provisions of these Terms and Conditions shall be held to be invalid, illegal or unenforceable, such provision shall be enforced to the fullest extent permitted by applicable law, and the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired thereby.

    Determine Your Zero Trust Readiness

    • Buy Link or Shortcode: {j2store}249|cart{/j2store}
    • member rating overall impact: 9.8/10 Overall Impact
    • member rating average dollars saved: $24,574 Average $ Saved
    • member rating average days saved: 12 Average Days Saved
    • Parent Category Name: Security Strategy & Budgeting
    • Parent Category Link: /security-strategy-and-budgeting

    CISOs pushing for zero trust as their security strategy face several challenges including:

    • Understanding and clarifying the benefits of zero trust for the organization.
    • The inability to verify all business operations are maintaining security best practices.
    • Convincing business units to add more security controls that go against the grain of reducing friction in workflows while still demonstrating these controls support the business.

    Our Advice

    Critical Insight

    • Zero trust must benefit the business and security. Because the road to zero trust is an iterative process, IT security will need to constantly determine how different areas of zero trust will affect core business processes.
    • Zero trust reduces reliance on perimeter security. Zero trust is a strategy that solves how to move beyond the reliance on perimeter security and move controls to where the user accesses resources.
    • Not everyone can achieve zero trust, but everyone can adopt it. Zero trust will be different for every organization and may not be applicable in every control area. This means that zero trust is not a one-size-fits-all approach to IT security. Zero trust is the goal, but some organizations can only get so close to the ideal.

    Impact and Result

    Zero trust is a journey that uses multiple capabilities and requires multiple parties to contribute to an organization’s security. Use Info-Tech’s approach to:

    • Understand zero trust as a strategic platform for building your security roadmap.
    • Assess your current state and determine the benefits of adopting zero trust to help plan your roadmap.
    • Separate vendors from the hype surrounding zero trust to adopt a vendor-agnostic approach to your zero trust planning.

    Determine Your Zero Trust Readiness Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should determine your zero trust readiness, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Understand zero trust

    Recognize the zero trust ideal and understand the different zero trust schools of thought.

    2. Assess your zero trust readiness

    Assess and determine the benefits of zero trust and identify and evaluate vendors in the zero trust market.

    • Zero Trust Security Benefit Assessment Tool
    [infographic]

    Agile Readiness Assessment Survey

    • Buy Link or Shortcode: {j2store}160|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Development
    • Parent Category Link: /development
    • Today’s realities are driving organizations to digitize faster and become more Agile.
    • Agile transformations are difficult and frequently fail for a variety of reasons.
    • To achieve the benefits of Agile, organizations need to be ready for the significant changes that Agile demands.
    • Challenges to your Agile transformation can come from a variety of sources.

    Our Advice

    Critical Insight

    • Use Info-Tech’s CLAIM+G model to examine potential roadblocks to Agile on six different organizational dimensions.
    • Use survey results to identify and address the issues that are most likely to derail your Agile transformation.

    Impact and Result

    • Better understand where and how your organization needs to change to support your Agile transformation.
    • Focus your attention on your organization’s biggest roadblocks to Agile.
    • Improve your organization’s chances of a successful Agile transformation.

    Agile Readiness Assessment Survey Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Agile Readiness Assessment Deck – A guide to help your organization survey its Agile readiness.

    Read this deck to see how an Agile Readiness Assessment can help your organization understand its readiness for Agile transformation. The storyboard guides you through how to collect, consolidate, and examine survey responses and create an actionable list of improvements to make your organization more Agile ready.

    • Agile Readiness Assessment Storyboard

    2. Survey Templates (Excel or MS Forms, available in English and French) – Use these templates to create and distribute the survey broadly within your organization.

    The Agile Readiness Assessment template is available in either Excel or Microsoft Forms (both English and French versions are available). Download the Excel templates here or use the links in the above deck to access the online versions of the survey.

    • Agile Readiness Survey – English
    • Agile Readiness Survey – French

    3. Agile Readiness Assessment Consolidated Results Tool – Use this tool to consolidate and analyze survey responses.

    The Agile Readiness Assessment Consolidated Results Tool allows you to consolidate survey responses by team/role and produces your heatmap for analysis.

    • Agile Readiness Assessment Consolidated Results Tool
    [infographic]

    Further reading

    Agile Readiness Assessment

    Understand how ready your organization is for an Agile transformation.

    Info-Tech Research Group Inc. is a global leader in providing IT research and advice. Info-Tech’s products and services combine actionable insight and relevant advice with ready-to-use tools and templates that cover the full spectrum of IT concerns.

    Analyst Perspective

    Use the wisdom of crowds to understand how ready you are for Agile transformation.

    Photo of Alex Ciraco, Principal Research Director, Application Delivery and Management, Info-Tech Research Group

    Agile transformations can be difficult and complex to implement. That’s because they require fundamental changes in the way an organization thinks and behaves (and many organizations are not ready for these changes).

    Use Info-Tech’s Agile Readiness Assessment to broadly survey the organization’s readiness for Agile along six dimensions:

    • Culture
    • Learning
    • Automation
    • Integrated teams
    • Metrics
    • Governance

    The survey results will help you to examine and address those areas that are most likely to hinder your move to Agile.

    Alex Ciraco
    Principal Research Director, Application Delivery and Management
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    • Your organization wants to shorten delivery time and improve quality by adopting Agile practices.
    • Your organization has not yet used Agile successfully.
    • You know that Agile transformations are complex and difficult to implement.
    • You want to maximize your Agile transformation’s chances of success.

    Common Obstacles

    • Risks to your Agile transformation can come from a variety of sources, including:
      • Organizational culture
      • Learning practices
      • Use of automation
      • Ability to create integrated teams
      • Use of metrics
      • Governance practices

    Info-Tech’s Approach

    • Use Info-Tech’s Agile Readiness Assessment to broadly survey your organization’s readiness for Agile.
    • Examine the consolidated results of this survey to identify challenges that are most likely to hinder Agile success.
    • Discuss and address these challenges to increase your chances of success.

    Info-Tech Insight

    By first understanding the numerous challenges to Agile transformations and then broadly surveying your organization to identify and address the challenges that are at play, you are more likely to have a successful Agile transformation.

    Info-Tech’s methodology

    1. Distribute Survey 2. Consolidate Survey Results 3. Examine Results and Problem Solve
    Phase Steps

    1.1 Identify the teams/roles you will survey.

    1.2 Configure the survey to reflect your teams/roles.

    1.3 Distribute the Agile Readiness Assessment Survey broadly in the organization.

    2.1 Collect survey responses from all participants.

    2.2 Consolidate the results using the template provided.

    3.1 Examine the consolidated results (both OVERALL and DETAILED Heatmaps)

    3.2 Identify key challenge areas (those which are most “red”) and discuss these challenges with participants

    3.3 Brainstorm, select and refine potential solutions to these challenges

    Phase Outcomes An appreciation for the numerous challenges associated with Agile transformations Identified challenges to Agile within your organization (both team-specific and organization-wide challenges) An actionable list of solutions/actions to address your organization’s Agile challenges.

    Blueprint deliverables

    Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals.

    Agile Readiness Assessment Survey

    Survey the organization to understand your readiness for an Agile transformation on six dimensions.

    Sample of the Agile Readiness Assessment Survey blueprint deliverable.

    Agile Readiness Assessment Consolidated Results

    Examine your readiness for Agile and identify team-specific and organization-wide challenges.

    Sample of the Agile Readiness Assessment Consolidated Results blueprint deliverable.

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    Guided Implementation

    Workshop

    Consulting

    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks used throughout all four options

    Guided Implementation

    A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

    A typical GI is between 6 to 8 calls over the course of 1 to 2 months.

    What does a typical GI on this topic look like?

      Phase 1: Distribute Survey

    • Call #1: Scope requirements, objectives, and your specific challenges (identify potential participants).
    • Call #2: First call with participants (introduce Phase 1 and assign survey for completion).
    • Call #3: Gather survey responses (prep for Phase 2 calls).
    • Phase 2: Consolidate Survey Results

    • Call #4: Consolidate all survey responses using the template.
    • Call #5: Conduct initial review of consolidated results (prep for Phase 3 calls).
    • Phase 3: Examine Results and Problem Solve

    • Call #6: Present consolidated results to participants and agree on most pressing challenges.
    • Call #7: Brainstorm, identify, and refine potential solutions to most pressing challenges.
    • Call #8: Conduct closing and communication call.

    Phase 1 — Phase 1 of 3, 'Distribute Survey'.

    Customize and distribute the survey

    Decide which teams/roles will participate in the survey.

    Decide which format and language(s) you will use for your Agile Readiness Assessment Survey.

    Configure the survey templates to reflect your selected teams/roles.

    Distribute the survey for participants to complete.

    • 1.1 The Agile Readiness Assessment Survey will help you to identify both team-specific and organization-wide challenges to your Agile transformation. It is best to distribute the survey broadly across the organization and include several teams and roles. Identify and make note of the teams/roles that will be participating in the survey.
    • 1.2 Select which format of survey you will be using (Excel or online), along with the language(s) you will use (links to the survey templates can be found in the table below). Then configure the survey templates to reflect your list of teams/roles from Step 1.1.
    • Format Language Download Survey Template
      Excel English Agile Readiness Assessment Excel Survey Template – EN and FR
      Excel French
      Online English Agile Readiness Assessment Online Survey Template – EN
      Online French Agile Readiness Assessment Online Survey Template – FR

    • 1.3 Distribute your Agile Readiness Assessment Survey broadly in the organization. Give all participants a deadline date for completion of the survey.

    Phase 2 — Phase 2 of 3, 'Consolidate Results'.

    Consolidate Survey Results

    Collect and consolidate all survey responses using the template provided.

    Review the OVERALL and DETAILED Heatmaps generated by the template.

    • 2.1 Collect the survey responses from all participants. All responses completed using the online form will be anonymous (for responses returned using the Excel form, assign each a unique identifier so that anonymity of responses is maintained).
    • 2.2 Consolidate the survey responses using the template below. Follow the instructions in the template to incorporate all survey responses.
    • Download the Agile Readiness Assessment Consolidated Results Tool

      Sample of the Agile Readiness Assessment Consolidated Results Tool, ranking maturity scores in 'Culture', 'Learning', 'Automation', 'Integrated Teams', 'Metrics', and 'Governance'.

    Phase 3 — Phase 3 of 3, 'Examine Results'.

    Examine Survey Results and Problem Solve

    Review the consolidated survey results as a team.

    Identify the challenges that need the most attention.

    Brainstorm potential solutions. Decide which are most promising and create a plan to implement them.

    • 3.1 Examine the consolidated results (both OVERALL and DETAILED Heatmaps) and look at both team-specific and organization-wide challenge areas.
    • 3.2 Identify which challenge areas need the most attention (typically those that are most red in the heatmap) and discuss these challenges with survey participants.
    • 3.3 As a team, brainstorm potential solutions to these challenges. Select from and refine the solutions that are most promising, then create a plan to implement them.

    3.1 Exercise: Collaborative Problem Solving — Phase 3 of 3, 'Examine Results'.

    60 Mins

    Input: Consolidated survey results

    Output: List of actions to address your most pressing challenges along with a timeline to implement them

    Materials: Agile Readiness Assessment Consolidated Results Tool, Whiteboard and markers

    Participants: Survey participants, Other interested parties

    This exercise will create a plan for addressing your most pressing Agile-related challenges.

    • As a team, agree on which survey challenges are most important to address (typically the most red in the heatmap).
    • Brainstorm potential solutions/actions to address these challenges.
    • Assign solutions/actions to individuals and set a timeline for completion.
    Challenge Proposed Solution Owner Timeline
    Enrichment
    lack of a CoE
    Establish a service-oriented Agile Center of Excellence (CoE) staffed with experienced Agile practitioners who can directly help new-to-Agile teams be successful. Bill W. 6 Months
    Tool Chain
    (lack of Agile tools)
    Select a standard Agile work management tool (e.g. Jira, Rally, ADO) that will be used by all Agile teams. Cindy K. 2 Months

    Related Info-Tech Research

    Sample of an Info-Tech blueprint. Modernize Your SDLC
    • Strategically adopt today’s SDLC good practices to streamline value delivery.
    Sample of an Info-Tech blueprint. Implement Agile Practices That Work
    • Guide your organization through its Agile transformation journey.
    Sample of an Info-Tech blueprint. Implement DevOps Practices That Work
    • Streamline business value delivery through the strategic adoption of DevOps practices.
    Sample of an Info-Tech blueprint. Mentoring for Agile Teams
    • Leverage an experience Agile Mentor to give your in-flight Agile project a helping hand.

    Research Contributors and Experts

    • Columbus Brown, Senior Principal – Practice Lead – Business Alignment, Daugherty Business Solutions
    • Saeed Khan, Founder, Transformation Labs
    • Brenda Peshak, Product Owner/Scrum Master/Program Manager, John Deere/Source Allies/Widget Industries LLC
    • Vincent Mirabelli, Principal, Global Project Synergy Group
    • Len O'Neill, Sr. Vice President and Chief Information Officer, The Suddath Companies
    • Shameka A. Jones, MPM, CSM, Lead Business Management Consultant, Mainspring Business Group, LLC
    • Ryland Leyton, Lead Business Analyst, Aptos Retail
    • Ashish Nangia, Lead Business System Analyst, Ashley Furniture Industries
    • Barbara Carkenord, CBAP, IIBA-AAC, PMI-PBA, PMP, SAFe POPM, President, Carkenord Consulting
    • Danelkis Serra, CBAP, Chapter Operations Manager, Regions & Chapters, IIBA (International Institute of Business Analysis)
    • Lorrie Staples-Ellis, CyberSecurity Integration Strategist, Wealth Management, Truist Bank
    • Ginger Sundberg, Independent Consultant
    • Kham Raven, Project Manager, Fraud Strategy & Execution, Truist Bank
    • Sarah Vollett, PMP, Business Analyst, Operations, College of Physicians and Surgeons of British Columbia
    • Nicole J Coyle, ICP-ACC, CEAC, SPC4, SASM, POPM, CSM, ECM, CCMP, CAPM, Team Agile Coach and Team Facilitator, HCQIS Foundational Components
    • Joe Glower, IT Director, Jet Support Services, Inc. (JSSI)
    • Harsh Daharwal, Senior Director, Application Delivery, J.R. Simplot
    • Hans Eckman, Principal Research Director, Info-Tech Research Group
    • Valence Howden, Principal Research Director, Info-Tech Research Group

    Manage Third-Party Service Security Outsourcing

    • Buy Link or Shortcode: {j2store}539|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Security Processes & Operations
    • Parent Category Link: /security-processes-and-operations
    • A lack of high-skill labor increases the cost of internal security, making outsourcing more appealing.
    • It is unclear what processes could or should be outsourced versus what functions should remain in-house.
    • It is not feasible to have 24/7/365 monitoring in-house for most firms.

    Our Advice

    Critical Insight

    • You are outsourcing support, not accountability, unless you preface that with your customer.
    • For most of you, you won’t have a choice – you’ll have to outsource high-end security skills to meet future needs.
    • Third-party service providers may be able to more effectively remediate threats because of their large, disparate customer base and wider scope.

    Impact and Result

    • Documented obligations and processes. This will allow you to determine which solution (outsourcing vs. insourcing) allows for the best use of resources, and maintains your brand reputation.
    • A list of variables and features to rank potential third-party providers vs. internal delivery to find which solution provides the best fit for your organization.
    • Current limitations of your environment and the limitations of third parties identified for the environments you are looking to mature.
    • Security responsibilities determined that can be outsourced, and which should be outsourced in order to gain resource allocation and effectiveness, and to improve your overall security posture.
    • The limitations or restrictions for third-party usage understood.

    Manage Third-Party Service Security Outsourcing Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to understand how to avoid common mistakes when it comes to outsourcing security, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. What to outsource

    Identify different responsibilities/functions in your organization and determine which ones can be outsourced. Complete a cost analysis.

    • Manage Third-Party Service Security Outsourcing – Phase 1: What to Outsource
    • Insourcing vs. Outsourcing Costing Tool

    2. How to outsource

    Identify a list of features for your third-party provider and analyze.

    • Manage Third-Party Service Security Outsourcing – Phase 2: How to Outsource
    • MSSP Selection Tool
    • Checklist for Third-Party Providers

    3. Manage your third-party provider

    Understand how to align third-party providers to your organization.

    • Manage Third-Party Service Security Outsourcing – Phase 3: Manage Your Third-Party Provider
    • Security Operations Policy for Third-Party Outsourcing
    • Third-Party Security Policy Charter Template
    [infographic]

    Build a Service Desk Consolidation Strategy

    • Buy Link or Shortcode: {j2store}479|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
    • member rating average days saved: Read what our members are saying
    • Parent Category Name: Service Desk
    • Parent Category Link: /service-desk
    • Incompatible technologies. Organizations with more than one service desk are likely to have many legacy IT service management (ITSM) solutions. These come with a higher support cost, costly skill-set maintenance, and the inability to negotiate volume licensing discounts.
    • Inconsistent processes. Organizations with more than one service desk often have incompatible processes, which can lead to inconsistent service support across departments, less staffing flexibility, and higher support costs.
    • Lack of data integration. Without a single system and consistent processes, IT leaders often have only a partial view of service support activities. This can lead to rigid IT silos, limit the ability to troubleshoot problems, and streamline process workflows.

    Our Advice

    Critical Insight

    • Every step should put people first. It’s tempting to focus the strategy on designing processes and technologies for the target architecture. However, the most common barrier to success is workforce resistance to change.
    • A consolidated service desk is an investment, not a cost-reduction program. Focus on efficiency, customer service, and end-user satisfaction. There will be many cost savings, but viewing them as an indirect consequence of the pursuit of efficiency and customer service is the best approach.

    Impact and Result

    • Conduct a comprehensive assessment of existing service desk people, processes, and technology.
    • Identify and retire resources and processes that are no longer meeting business needs, and consolidate and modernize resources and processes that are worth keeping.
    • Identify logistic and cost considerations and create a roadmap of consolidation initiatives.
    • Communicate the change and garner support for the consolidation initiative.

    Build a Service Desk Consolidation Strategy Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should build a service desk consolidation strategy, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Develop a shared vision

    Engage stakeholders to develop a vision for the project and perform a comprehensive assessment of existing service desks.

    • Build a Service Desk Consolidation Strategy – Phase 1: Develop a Shared Vision
    • Stakeholder Engagement Workbook
    • Consolidate Service Desk Executive Presentation
    • Consolidate Service Desk Assessment Tool
    • IT Skills Inventory and Gap Assessment Tool

    2. Design the consolidated service desk

    Outline the target state of the consolidated service desk and assess logistics and cost of consolidation.

    • Build a Service Desk Consolidation Strategy – Phase 2: Design the Consolidated Service Desk
    • Consolidate Service Desk Scorecard Tool
    • Consolidated Service Desk SOP Template
    • Service Desk Efficiency Calculator
    • Service Desk Consolidation TCO Comparison Tool

    3. Plan the transition

    Build a project roadmap and communication plan.

    • Build a Service Desk Consolidation Strategy – Phase 3: Plan the Transition
    • Service Desk Consolidation Roadmap
    • Service Desk Consolidation Communications and Training Plan Template
    • Service Desk Consolidation News Bulletin & FAQ Template
    [infographic]

    Workshop: Build a Service Desk Consolidation Strategy

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Engage Stakeholders to Develop a Vision for the Service Desk

    The Purpose

    Identify and engage key stakeholders.

    Conduct an executive visioning session to define the scope and goals of the consolidation.

    Key Benefits Achieved

    A list of key stakeholders and an engagement plan to identify needs and garner support for the change.

    A common vision for the consolidation initiative with clearly defined goals and objectives.

    Activities

    1.1 Identify key stakeholders and develop an engagement plan.

    1.2 Brainstorm desired service desk attributes.

    1.3 Conduct an executive visioning session to craft a vision for the consolidated service desk.

    1.4 Define project goals, principles, and KPIs.

    Outputs

    Stakeholder Engagement Workbook

    Executive Presentation

    2 Conduct a Full Assessment of Each Service Desk

    The Purpose

    Assess the overall maturity, structure, organizational design, and performance of each service desk.

    Assess current ITSM tools and how well they are meeting needs.

    Key Benefits Achieved

    A robust current state assessment of each service desk.

    An understanding of agent skills, satisfaction, roles, and responsibilities.

    An evaluation of existing ITSM tools and technology.

    Activities

    2.1 Review the results of diagnostics programs.

    2.2 Map organizational structure and roles for each service desk.

    2.3 Assess overall maturity and environment of each service desk.

    2.4 Assess current information system environment.

    Outputs

    Consolidate Service Desk Assessment Tool

    3 Design Target Consolidated Service Desk

    The Purpose

    Define the target state for consolidated service desk.

    Identify requirements for the service desk and a supporting solution.

    Key Benefits Achieved

    Detailed requirements and vision for the consolidated service desk.

    Gap analysis of current vs. target state.

    Documented standardized processes and procedures.

    Activities

    3.1 Identify requirements for target consolidated service desk.

    3.2 Build requirements document and shortlist for ITSM tool.

    3.3 Use the scorecard comparison tool to assess the gap between existing service desks and target state.

    3.4 Document standardized processes for new service desk.

    Outputs

    Consolidate Service Desk Scorecard Tool

    Consolidated Service Desk SOP

    4 Plan for the Transition

    The Purpose

    Break down the consolidation project into specific initiatives with a detailed timeline and assigned responsibilities.

    Plan the logistics and cost of the consolidation for process, technology, and facilities.

    Develop a communications plan.

    Key Benefits Achieved

    Initial analysis of the logistics and cost considerations to achieve the target.

    A detailed project roadmap to migrate to a consolidated service desk.

    A communications plan with responses to anticipated questions and objections.

    Activities

    4.1 Plan the logistics of the transition.

    4.2 Assess the cost and savings of consolidation to refine business case.

    4.3 Identify initiatives and develop a project roadmap.

    4.4 Plan communications for each stakeholder group.

    Outputs

    Consolidation TCO Tool

    Consolidation Roadmap

    Executive Presentation

    Communications Plan

    News Bulletin & FAQ Template

    Further reading

    Build a Service Desk Consolidation Strategy

    Manage the dark side of growth.

    ANALYST PERSPECTIVE

    A successful service desk consolidation begins and ends with people.

    "It’s tempting to focus strategic planning on the processes and technology that will underpin the consolidated service desk. Consistent processes and a reliable tool will cement the consolidation, but they are not what will hold you back.

    The most common barrier to a successful consolidation is workforce resistance to change. Cultural difference, perceived risks, and organizational inertia can hinder data gathering, deter collaboration, and impede progress from the start.

    Building a consolidated service desk is first and foremost an exercise in organizational change. Garner executive support for the project, enlist a team of volunteers to lead the change, and communicate with key stakeholders early and often. The key is to create a shared vision for the project and engage those who will be most affected."

    Sandi Conrad

    Senior Director, Infrastructure Practice

    Info-Tech Research Group

    Our understanding of the problem

    This Research is Designed For:

    • CIOs who need to reduce support costs and improve customer service.
    • IT leaders tasked with the merger of two or more IT organizations.
    • Service managers implementing a shared service desk tool.
    • Organizations rationalizing IT service management (ITSM) processes.

    This Research Will Help You:

    • Develop a shared vision for the consolidated service desk.
    • Assess key metrics and report on existing service desk architecture.
    • Design a target service desk architecture and assess how to meet the new requirements.
    • Deploy a strategic roadmap to build the consolidated service desk architecture.

    Executive summary

    Situation

    Every organization must grow to survive. Good growth makes an organization more agile, responsive, and competitive, which leads to further growth.

    The proliferation of service desks is a hallmark of good growth when it empowers the service of diverse end users, geographies, or technologies.

    Complication

    Growth has its dark side. Bad growth within a business can hinder agility, responsiveness, and competitiveness, leading to stagnation.

    Supporting a large number of service desks can be costly and inefficient, and produce poor or inconsistent customer service, especially when each service desk uses different ITSM processes and technologies.

    Resolution

    Manage the dark side of growth. Consolidating service desks can help standardize ITSM processes, improve customer service, improve service desk efficiency, and reduce total support costs. A consolidation is a highly visible and mission critical project, and one that will change the public face of IT. Organizations need to get it right.

    Building a consolidated service desk is an exercise in organizational change. The success of the project will hinge on how well the organization engages those who will be most affected by the change. Build a guiding coalition for the project, create a shared vision, enlist a team of volunteers to lead the change, and communicate with key stakeholders early and often.

    Use a structured approach to facilitate the development of a shared strategic vision, design a detailed consolidated architecture, and anticipate resistance to change to ensure the organization reaps project benefits.

    Info-Tech Insight

    1. Every step should put people first. It’s tempting to focus the strategy on designing processes and technologies for the target architecture. However, the most common barrier to success is workforce resistance to change.
    2. A consolidated service desk is an investment, not a cost-reduction program. Focus on efficiency, customer service, and end-user satisfaction. Cost savings, and there will be many, should be seen as an indirect consequence of the pursuit of efficiency and customer service.

    Focus the service desk consolidation project on improving customer service to overcome resistance to change

    Emphasizing cost reduction as the most important motivation for the consolidation project is risky.

    End-user satisfaction is a more reliable measure of a successful consolidation.

    • Too many variables affect the impact of the consolidation on the operating costs of the service desk to predict the outcome reliably.
    • Potential reductions in costs are unlikely to overcome organizational resistance to change.
    • Successful service desk consolidations can increase ticket volume as agents capture tickets more consistently and increase customer service.

    The project will generate many cost savings, but they will take time to manifest, and are best seen as an indirect consequence of the pursuit of customer service.

    Info-Tech Insight

    Business units facing a service desk consolidation are often concerned that the project will lead to a loss of access to IT resources. Focus on building a customer-focused consolidated service desk to assuage those fears and earn their support.

    End users, IT leaders, and process owners recognize the importance of the service desk.

    2nd out of 45

    On average, IT leaders and process owners rank the service desk 2nd in terms of importance out of 45 core IT processes. Source: Info-Tech Research Group, Management and Governance Diagnostic (2015, n = 486)

    42.1%

    On average, end users who were satisfied with service desk effectiveness rated all other IT services 42.1% higher than dissatisfied end users. Source: Info-Tech Research Group, End-User Satisfaction Survey 2015, n = 133)

    38.0%

    On average, end users who were satisfied with service desk timeliness rated all other IT services 38.0% higher than dissatisfied end users. Source: Info-Tech Research Group, End-User Satisfaction Survey (2015, n = 133)

    Overcome the perceived barriers from differing service unit cultures to pursue a consolidated service desk (CSD)

    In most organizations, the greatest hurdles that consolidation projects face are related to people rather than process or technology.

    In a survey of 168 service delivery organizations without a consolidated service desk, the Service Desk Institute found that the largest internal barrier to putting in place a consolidated service desk was organizational resistance to change.

    Specifically, more than 56% of respondents reported that the different cultures of each service unit would hinder the level of collaboration such an initiative would require.

    The image is a graph titled Island cultures are the largest barrier to consolidation. The graph lists Perceived Internal Barriers to CSD by percentage. The greatest % barrier is Island cultures, with executive resistance the next highest.

    Service Desk Institute (n = 168, 2007)

    Info-Tech Insight

    Use a phased approach to overcome resistance to change. Focus on quick-win implementations that bring two or three service desks together in a short time frame and add additional service desks over time.

    Avoid the costly proliferation of service desks that can come with organizational growth

    Good and bad growth

    Every organization must grow to survive, and relies heavily on its IT infrastructure to do that. Good growth makes an organization more agile, responsive, and competitive, and leads to further growth.

    However, growth has its dark side. Bad growth hobbles agility, responsiveness, and competitiveness, and leads to stagnation.

    As organizations grow organically and through mergers, their IT functions create multiple service desks across the enterprise to support:

    • Large, diverse user constituencies.
    • Rapidly increasing call volumes.
    • Broader geographic coverage.
    • A growing range of products and services.

    A hallmark of bad growth is the proliferation of redundant and often incompatible ITSM services and processes.

    Project triggers:

    • Organizational mergers
    • ITSM tool purchase
    • Service quality or cost-reduction initiatives
    Challenges arising from service desk proliferation:
    Challenge Impact
    Incompatible Technologies
    • Inability to negotiate volume discounts.
    • Costly skill set maintenance.
    • Increased support costs.
    • Increased shadow IT.
    Inconsistent Processes
    • Low efficiency.
    • High support costs.
    • Inconsistent support quality.
    • Less staffing flexibility.
    Lack of Data Integration
    • Only partial view of IT.
    • Inefficient workflows.
    • Limited troubleshooting ability.
    Low Customer Satisfaction
    • Fewer IT supporters.
    • Lack of organizational support.

    Consolidate service desks to integrate the resources, processes, and technology of your support ecosystem

    What project benefits can you anticipate?

    • Consolidated Service Desk
      • End-user group #1
      • End-user group #2
      • End-user group #3
      • End-user group #4

    A successful consolidation can significantly reduce cost per transaction, speed up service delivery, and improve the customer experience through:

    • Single point of contact for end users.
    • Integrated ITSM solution where it makes sense.
    • Standardized processes.
    • Staffing integration.
    Project Outcome

    Expected Benefit

    Integrated information The capacity to produce quick, accurate, and segmented reports of service levels across the organization.
    Integrated staffing Flexible management of resources that better responds to organizational needs.
    Integrated technology Reduced tool procurement costs, improved data integration, and increased information security.
    Standardized processes Efficient and timely customer service and a more consistent customer experience.

    Standardized and consolidated service desks will optimize infrastructure, services, and resources benefits

    • To set up a functioning service desk, the organization will need to invest resources to build and integrate tier 1, tier 2, and tier 3 capabilities to manage incidents and requests.
    • The typical service desk (Figure 1) can address a certain number of tickets from all three tiers. If your tickets in a given tier are less than that number, you are paying for 100% of service costs but consuming only a portion of it.
    • The consolidated model (Figure 2) reduces the service cost by reducing unused capacity.
    • Benefits of consolidation include a single service desk solution, a single point of contact for the business, data integration, process standardization, and consolidated administration, reporting, and management.

    The image is a graphic showing 2 figures. The first shows ring graphs labelled Service Desk 1 and Service Desk 2, with the caption Service provisioning with distinct service desks. Figure 2 shows one graphic, captioned Service provisioning with Consolidated service providers. At the bottom of the image, there is a legend.

    Info-Tech’s approach to service desk consolidation draws on key metrics to establish a baseline and a target state

    The foundation of a successful service desk consolidation initiative is a robust current state assessment. Given the project’s complexity, however, determining the right level of detail to include in the evaluation of existing service desks can be challenging.

    The Info-Tech approach to service desk consolidation includes:

    • Envisioning exercises to set project scope and garner executive support.
    • Surveys and interviews to identify the current state of people, processes, technologies, and service level agreements (SLAs) in each service desk, and to establish a baseline for the consolidated service desk.
    • Service desk comparison tools to gather the results of the current state assessment for analysis and identify current best practices for migration to the consolidated service desk.
    • Case studies to illustrate the full scope of the project and identify how different organizations deal with key challenges.

    The project blueprint walks through a method that helps identify which processes and technologies from each service desk work best, and it draws on them to build a target state for the consolidated service desk.

    Inspiring your target state from internal tools and best practices is much more efficient than developing new tools and processes from scratch.

    Info-Tech Insight

    The two key hurdles that a successful service desk consolidation must overcome are organizational complexity and resistance to change.

    Effective planning during the current state assessment can overcome these challenges.

    Identify existing best practices for migration to the consolidated service desk to foster agent engagement and get the consolidated service desk up quickly.

    A consolidation project should include the following steps and may involve multiple transition phases to complete

    Phase 1: Develop a Shared Vision

    • Identify stakeholders
    • Develop vision
    • Measure baseline

    Phase 2: Design the Consolidation

    • Design target state
    • Assess gaps to reach target
    • Assess logistics and cost

    Phase 3: Plan the Transition

    • Develop project plan and roadmap
    • Communicate changes
    • Make the transition
      • Evaluate and prepare for next transition phase (if applicable)
      • Evaluate and stabilize
        • CSI

    Whether or not your project requires multiple transition waves to complete the consolidation depends on the complexity of the environment.

    For a more detailed breakdown of this project’s steps and deliverables, see the next section.

    Follow Info-Tech’s methodology to develop a service desk consolidation strategy

    Phases Phase 1: Develop a Shared Vision Phase 2: Design the Consolidated Service Desk Phase 3: Plan the Transition
    Steps 1.1 - Identify and engage key stakeholders 2.1 - Design target consolidated service desk 3.1 - Build the project roadmap
    1.2 - Develop a vision to give the project direction
    1.3 - Conduct a full assessment of each service desk 2.2 - Assess logistics and cost of consolidation 3.2 - Communicate the change
    Tools & Templates Executive Presentation Consolidate Service Desk Scorecard Tool Service Desk Consolidation Roadmap
    Consolidate Service Desk Assessment Tool Consolidated Service Desk SOP Communications and Training Plan Template
    Service Desk Efficiency Calculator News Bulletin & FAQ Template
    Service Desk Consolidation TCO Comparison Tool

    Service desk consolidation is the first of several optimization projects focused on building essential best practices

    Info-Tech’s Service Desk Methodology aligns with the ITIL framework

    Extend

    Facilitate the extension of service management best practices to other business functions to improve productivity and position IT as a strategic partner.

    Standardize

    Build essential incident, service request, and knowledge management processes to create a sustainable service desk that meets business needs.

    Improve

    Build a continual improvement plan for the service desk to review and evaluate key processes and services, and manage the progress of improvement initiatives.

    Adopt Lean

    Build essential incident, service request, and knowledge management processes to create a sustainable service desk that boosts business value.

    Select and Implement

    Review mid-market and enterprise service desk tools, select an ITSM solution, and build an implementation plan to ensure your investment meets your needs.

    Consolidate

    Build a strategic roadmap to consolidate service desks to reduce end-user support costs and sustain end-user satisfaction.

    Our Approach to the Service Desk

    Service desk optimization goes beyond the blind adoption of best practices.

    Info-Tech’s approach focuses on controlling support costs and making the most of IT’s service management expertise to improve productivity.

    Complete the projects sequentially or in any order.

    Info-Tech draws on the COBIT framework, which focuses on consistent delivery of IT services across the organization

    The image shows Info-Tech's IT Management & Governance Framework. It is a grid of boxes, which are colour-coded by category. The framework includes multiple connected categories of research, including Infrastructure & Operations, where Service Desk is highlighted.

    Oxford University IT Service Desk successfully undertook a consolidation project to merge five help desks into one

    CASE STUDY

    Industry: Higher Education

    Source: Oxford University, IT Services

    Background

    Until 2011, three disparate information technology organizations offered IT services, while each college had local IT officers responsible for purchasing and IT management.

    ITS Service Desk Consolidation Project

    Oxford merged the administration of these three IT organizations into IT Services (ITS) in 2012, and began planning for the consolidation of five independent help desks into a single robust service desk.

    Complication

    The relative autonomy of the five service desks had led to the proliferation of different tools and processes, licensing headaches, and confusion from end users about where to acquire IT service.

    Oxford University IT at a Glance

    • One of the world’s oldest and most prestigious universities.
    • 36 colleges with 100+ departments.
    • Over 40,000 IT end users.
    • Roughly 350 ITS staff in 40 teams.
    • 300 more distributed IT staff.
    • Offers more than 80 services.

    Help Desks:

    • Processes → Business Services & Projects
    • Processes → Computing Services
    • Processes → ICT Support Team

    "IT Services are aiming to provide a consolidated service which provides a unified and coherent experience for users. The aim is to deliver a ‘joined-up’ customer experience when users are asking for any form of help from IT Services. It will be easier for users to obtain support for their IT – whatever the need, service or system." – Oxford University, IT Services

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

    Guided Implementation

    “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

    Workshop

    “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

    Consulting

    “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

    Diagnostics and consistent frameworks used throughout all four options

    Build a Service Desk Consolidation Strategy – project overview

    1. Develop shared vision 2. Design consolidation 3. Plan transition
    Best-Practice Toolkit

    1.1 Identify and engage key stakeholders

    1.2 Develop a vision to give the project direction

    1.3 Conduct a full assessment of each service desk

    2.1 Design target consolidated service desk

    2.2 Assess logistics and cost of consolidation

    3.1 Build project roadmap

    3.2 Communicate the change

    Guided Implementations
    • Build the project team and define their roles and responsibilities, then identify key stakeholders and formulate an engagement plan
    • Develop an executive visioning session plan to formulate and get buy-in for the goals and vision of the consolidation
    • Use diagnostics results and the service desk assessment tool to evaluate the maturity and environment of each service desk
    • Define the target state of the consolidated service desk in detail
    • Identify requirements for the consolidation, broken down by people, process, technology and by short- vs. long-term needs
    • Plan the logistics of the consolidation for process, technology, and facilities, and evaluate the cost and cost savings of consolidation with a TCO tool
    • Identify specific initiatives for the consolidation project and evaluate the risks and dependencies for each, then plot initiatives on a detailed project roadmap
    • Brainstorm potential objections and questions and develop a communications plan with targeted messaging for each stakeholder group
    Onsite Workshop

    Module 1: Engage stakeholders to develop a vision for the service desk

    Module 2: Conduct a full assessment of each service desk

    Module 3: Design target consolidated service desk Module 4: Plan for the transition

    Phase 1 Outcomes:

    • Stakeholder engagement and executive buy-in
    • Vision for the consolidation
    • Comprehensive assessment of each service desk’s performance

    Phase 2 Outcomes:

    • Defined requirements, logistics plan, and target state for the consolidated service desk
    • TCO comparison

    Phase 3 Outcomes:

    • Detailed consolidation project roadmap
    • Communications plan and FAQs

    Info-Tech delivers: Use our tools and templates to accelerate your project to completion

    • Service Desk Assessment Tool (Excel)
    • Executive Presentation (PowerPoint)
    • Service Desk Scorecard Comparison Tool (Excel)
    • Service Desk Efficiency Calculator (Excel)
    • Service Desk Consolidation Roadmap (Excel)
    • Service Desk Consolidation TCO Tool (Excel)
    • Communications and Training Plan (Word)
    • Consolidation News Bulletin & FAQ Template (PowerPoint)

    Measured value for Guided Implementations (GIs)

    Engaging in GIs doesn’t just offer valuable project advice, it also results in significant cost savings.

    GI Measured Value
    Phase 1:
    • Time, value, and resources saved by using Info-Tech’s methodology to engage stakeholders, develop a project vision, and assess your current state.
    • For example, 2 FTEs * 10 days * $80,000/year = $6,200
    Phase 2:
    • Time, value, and resources saved by using Info-Tech’s tools and templates to design the consolidated service desk and evaluate cost and logistics.
    • For example, 2 FTEs * 5 days * $80,000/year = $3,100
    Phase 3:
    • Time, value, and resources saved by following Info-Tech’s tools and methodology to build a project roadmap and communications plan.
    • For example, 1 FTE * 5 days * $80,000/year = $1,500
    Total savings $10,800

    Workshop overview

    Contact your account representative or email Workshops@InfoTech.com for more information.

    Pre-Workshop Workshop Day 1 Workshop Day 2 Workshop Day 3 Workshop Day 4
    Activities

    Module 0: Gather relevant data

    0.1 Conduct CIO Business Vision Survey

    0.2 Conduct End-User Satisfaction Survey

    0.3 Measure Agent Satisfaction

    Module 1: Engage stakeholders to develop a vision for the service desk

    1.1 Identify key stakeholders and develop an engagement plan

    1.2 Brainstorm desired service desk attributes

    1.3 Conduct an executive visioning session to craft a vision for the consolidated service desk

    1.4 Define project goals, principles, and KPIs

    Module 2: Conduct a full assessment of each service desk

    2.1 Review the results of diagnostic programs

    2.2 Map organizational structure and roles for each service desk

    2.3 Assess overall maturity and environment of each service desk

    2.4 Assess current information system environment

    Module 3: Design target consolidated service desk

    3.1 Identify requirements for target consolidated service desk

    3.2 Build requirements document and shortlist for ITSM tool

    3.3 Use the scorecard comparison tool to assess the gap between existing service desks and target state

    3.4 Document standardized processes for new service desk

    Module 4: Plan for the transition

    4.1 Plan the logistics of the transition

    4.2 Assess the cost and savings of consolidation to refine business case

    4.3 Identify initiatives and develop a project roadmap

    4.4 Plan communications for each stakeholder group

    Deliverables
    1. CIO Business Vision Survey Diagnostic Results
    2. End-User Satisfaction Survey Diagnostic Results
    1. Stakeholder Engagement Workbook
    2. Executive Presentation
    1. Consolidate Service Desk Assessment Tool
    1. Consolidate Service Desk Scorecard Tool
    2. Consolidated Service Desk SOP
    1. Consolidation TCO Tool
    2. Executive Presentation
    3. Consolidation Roadmap
    4. Communications Plan
    5. News Bulletin & FAQ Template

    Insight breakdown

    Phase 1 Insight

    Don’t get bogged down in the details. A detailed current state assessment is a necessary first step for a consolidation project, but determining the right level of detail to include in the evaluation can be challenging. Gather enough data to establish a baseline and make an informed decision about how to consolidate, but don’t waste time collecting and evaluating unnecessary information that will only distract and slow down the project, losing management interest and buy-in.

    How we can help

    Leverage the Consolidate Service Desk Assessment Tool to gather the data you need to evaluate your existing service desks.

    Phase 2 Insight

    Select the target state that is right for your organization. Don’t feel pressured to move to a complete consolidation with a single point of contact if it wouldn’t be compatible with your organization’s needs and abilities, or if it wouldn’t be adopted by your end users. Design an appropriate level of standardization and centralization for the service desk and reinforce and improve processes moving forward.

    How we can help

    Leverage the Consolidate Service Desk Scorecard Tool to analyze the gap between your existing processes and your target state.

    Phase 3 Insight

    Getting people on board is key to the success of the consolidation, and a communication plan is essential to do so. Develop targeted messaging for each stakeholder group, keeping in mind that your end users are just as critical to success as your staff. Know your audience, communicate to them often and openly, and ensure that every communication has a purpose.

    How we can help

    Leverage the Communications Plan and Consolidation News Bulletin & FAQ Template to plan your communications.

    Phase 1

    Develop a Shared Vision

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 1: Develop shared vision

    Proposed Time to Completion (in weeks): 4-8

    Step 1.1: Identify and engage key stakeholders

    Discuss with an analyst:

    • Build the project team and define their roles and responsibilities
    • Identify key stakeholders and formulate an engagement plan

    Then complete these activities…

    • Assign project roles and responsibilities
    • Identify key stakeholders
    • Formalize an engagement plan and conduct interviews

    With these tools & templates:

    Stakeholder Engagement Workbook

    Step 1.2: Develop a vision to give the project direction

    Discuss with an analyst:

    • Develop an executive visioning session plan to formulate and get buy-in for the goals and vision of the consolidation

    Then complete these activities…

    • Host an executive visioning exercise to define the scope and goals of the consolidation

    With these tools & templates:

    Consolidate Service Desk Executive Presentation

    Step 1.3: Conduct a full assessment of each service desk

    Discuss with an analyst:

    • Use diagnostics results and the service desk assessment tool to evaluate the maturity and environment of each service desk
    • Assess agent skills, satisfaction, roles and responsibilities

    Then complete these activities…

    • Analyze organizational structure
    • Assess maturity and environment of each service desk
    • Assess agent skills and satisfaction

    With these tools & templates:

    Consolidate Service Desk Assessment Tool

    IT Skills Inventory and Gap Assessment Tool

    Phase 1 Outcome:

    • A common vision for the consolidation initiative, an analysis of existing service desk architectures, and an inventory of existing best practices.

    Step 1.1: Get buy-in from key stakeholders

    Phase 1

    Develop a shared vision

    1.1 Identify and engage key stakeholders

    1.2 Develop a vision to give the project direction

    1.3 Conduct a full assessment of each service desk

    This step will walk you through the following activities:
    • 1.1.1 Assign roles and responsibilities
    • 1.1.2 Identify key stakeholders for the consolidation
    • 1.1.3 Conduct stakeholder interviews to understand needs in more depth, if necessary
    This step involves the following participants:
    • Project Sponsor
    • CIO or IT Director
    • Project Manager
    • IT Managers and Service Desk Manager(s)
    Step Outcomes:
    • A project team with clearly defined roles and responsibilities
    • A list of key stakeholders and an engagement plan to identify needs and garner support for the change

    Oxford consulted with people at all levels to ensure continuous improvement and new insights

    CASE STUDY

    Industry: Higher Education

    Source: Oxford University, IT Services

    Motivation

    The merging of Oxford’s disparate IT organizations was motivated primarily to improve end-user service and efficiency.

    Similarly, ITS positioned the SDCP as an “operational change,” not to save costs, but to provide better service to their customers.

    "The University is quite unique in the current climate in that reduction in costs was not one of the key drivers behind the project. The goal was to deliver improved efficiencies and offer a single point of contact for their user base." – Peter Hubbard, ITSM Consultant Pink Elephant

    Development

    Oxford recognized early that they needed an open and collaborative environment to succeed.

    Key IT and business personnel participated in a “vision workshop” to determine long- and short-term objectives, and to decide priorities for the consolidated service desk.

    "Without key support at this stage many projects fail to deliver the expected outcomes. The workshop involved the key stakeholders of the project and was deemed a successful and positive exercise, delivering value to this stage of the project by clarifying the future desired state of the Service Desk." – John Ireland, Director of Customer Service & Project Sponsor

    Deployment

    IT Services introduced a Service Desk Consolidation Project Blog very early into the project, to keep everyone up-to-date and maintain key stakeholder buy-in.

    Constant consultation with people at all levels led to continuous improvement and new insights.

    "We also became aware that staff are facing different changes depending on the nature of their work and which toolset they use (i.e. RT, Altiris, ITSM). Everyone will have to change the way they do things at least a little – but the changes depend on where you are starting from!" – Jonathan Marks, Project Manager

    Understand and validate the consolidation before embarking on the project

    Define what consolidation would mean in the context of your organization to help validate and frame the scope of the project before proceeding.

    What is service desk consolidation?

    Service desk consolidation means combining multiple service desks into one centralized, single point of contact.

    • Physical consolidation = personnel and assets are combined into a single location
    • Virtual consolidation = service desks are combined electronically

    Consolidation must include people, process, and technology:

    1. Consolidation of some or all staff into one location
    2. Consolidation of processes into a single set of standardized processes
    3. One consolidated technology platform or ITSM tool

    Consolidation can take the form of:

    1. Merging multiple desks into one
    2. Collapsing multiple desks into one
    3. Connecting multiple desks into a virtual desk
    4. Moving all desks to one connected platform

    Service Desk 1 - Service Desk 2 - Service Desk 3

    Consolidated Service Desk

    Info-Tech Insight

    Consolidation isn’t for everyone.

    Before you embark on the project, think about unique requirements for your organization that may necessitate more than one service desk, such as location-specific language. Ask yourself if consolidation makes sense for your organization and would achieve a benefit for the organization, before proceeding.

    1.1 Organize and build the project team to launch the project

    Solidify strong support for the consolidation and get the right individuals involved from the beginning to give the project the commitment and direction it requires.

    Project Sponsor
    • Has direct accountability to the executive team and provides leadership to the project team.
    • Legitimatizes the consolidation and provides necessary resources to implement the project.
    • Is credible, enthusiastic, and understands the organization’s culture and values.
    Steering Committee
    • Oversees the effort.
    • Ensures there is proper support from the organization and provides resources where required.
    • Resolves any conflicts.
    Core Project Team
    • Full-time employees drawn from roles that are critical to the service desk, and who would have a strong understanding of the consolidation goals and requirements.
    • Ideal size: 6-10 full-time employees.
    • May include roles defined in the next section.

    Involve the right people to drive and facilitate the consolidation

    Service desk consolidations require broad support and capabilities beyond only those affected in order to deal with unforeseen risks and barriers.

    • Project manager: Has primary accountability for the success of the consolidation project.
    • Senior executive project sponsor: Needed to “open doors” and signal organization’s commitment to the consolidation.
    • Technology SMEs and architects: Responsible for determining and communicating requirements and risks of the technology being implemented or changed, especially the ITSM tool.
    • Business unit leads: Responsible for identifying and communicating impact on business functions, approving changes, and helping champion change.
    • Product/process owners: Responsible for identifying and communicating impact on business functions, approving changes, and helping champion change.
    • HR specialists: Most valuable when roles and organizational design are affected, i.e. the consolidation requires staff redeployment or substantial training (not just using a new system or tool but acquiring new skills and responsibilities) or termination.
    • Training specialists: If you have full-time training staff in the organization, you will eventually need them to develop training courses and material. Consulting them early will help with scoping, scheduling, and identifying the best resources and channels to deliver the training.
    • Communications specialists (internal): Valuable in crafting communications plan, required if communications function owns internal communications.

    Use a RACI table (e.g. in the following section) to clarify who is to be accountable, responsible, consulted, and informed.

    Info-Tech Insight

    The more transformational the change, the more it will affect the organizational chart – not just after the implementation but through the transition.

    Take time early in the project to define the reporting structure for the project/transition team, as well as any teams and roles supporting the transition.

    Assign roles and responsibilities

    1.1.1 Use a RACI chart to assign overarching project responsibilities

    Participants
    • Project Sponsor
    • IT Director, CIO
    • Project Manager
    • IT Managers and Service Desk Manager(s)
    What You'll Need
    • RACI chart

    RACI = Responsible, Accountable, Consulted, Informed

    The RACI chart will provide clarity for overarching roles and responsibilities during the consolidation.

    1. Confirm and modify the columns to match the stakeholders in your organization.
    2. Confirm and modify the roles listed as rows if there are obvious gaps or opportunities to consolidate rows.
    3. Carefully analyze and document the roles as a group.
    Task Project Sponsor Project Manager Sr. Executives SMEs Business Lead Service Desk Managers HR Trainers Communications
    Meeting project objectives A R A R R
    Identifying risks and opportunities R A A C C C C I I
    Assessing current state I A I R C R
    Defining target state I A I C C R
    Planning logistics I A I R R C R
    Building the action plan I A C R R R R R R
    Planning and delivering communications I A C C C C R R A
    Planning and delivering training I A C C C C R R C
    Gathering and analyzing feedback and KPIs I A C C C C C R R

    Identify key stakeholders to gather input from the business, get buy-in for the project, and plan communications

    Identify the key stakeholders for the consolidation to identify the impact consolidation will have on them and ensure their concerns don’t get lost.

    1. Use a stakeholder analysis to identify the people that can help ensure the success of your project.
    2. Identify an Executive Sponsor
      • A senior-level project sponsor is someone who will champion the consolidation project and help sell the concept to other stakeholders. They can also ensure that necessary financial and human resources will be made available to help secure the success of the project. This leader should be someone who is credible, tactful, and accessible, and one who will not only confirm the project direction but also advocate for the project.

    Why is a stakeholder analysis essential?

    • Ignoring key stakeholders is an important cause of failed consolidations.
    • You can use the opinions of the most influential stakeholders to shape the project at an early stage.
    • Their support will secure resources for the project and improve the quality of the consolidation.
    • Communicating with key stakeholders early and often will ensure they fully understand the benefits of your project.
    • You can anticipate the reaction of key stakeholders to your project and plan steps to win their support.

    Info-Tech Insight

    Be diverse and aware. When identifying key stakeholders for the project, make sure to include a rich diversity of stakeholder expertise, geography, and tactics. Also, step back and add silent members to your list. The loudest voices and heaviest campaigners are not necessarily your key stakeholders.

    Identify key stakeholders for the consolidation

    1.1.2 Identify project stakeholders, particularly project champions

    Participants
    • CIO/IT Director
    • Project Sponsor
    • Project Manager
    • IT Managers
    What You’ll Need
    • Whiteboard or flip chart and markers

    Goal: Create a prioritized list of people who are affected or can affect your project so you can plan stakeholder engagement and communication.

    • Use an influence/commitment matrix to determine where your stakeholders lie.
    • High influence, high commitment individuals should be used in conjunction with your efforts to help bring others on board. Identify these individuals and engage with them immediately.
    • Beware of the high influence, low commitment individuals. They should be the first priority for engagement.
    • High commitment, low influence individuals can be used to help influence the low influence, low commitment individuals. Designate a few of these individuals as “champions” to help drive engagement on the front lines.

    Outcome: A list of key stakeholders to include on your steering committee and your project team, and to communicate with throughout the project.

    The image is a matrix, with Influence on the Y-axis and Commitment to change on the X-axis. It is a blank template.

    Overcome the value gap by gathering stakeholder concerns

    Simply identifying and engaging your stakeholders is not enough. There needs to be feedback: talk to your end users to ensure their concerns are heard and determine the impact that consolidation will have on them. Otherwise, you risk leaving value on the table.

    • Talk to the business end users who will be supported by the consolidated service desk.
    • What are their concerns about consolidation?
    • Which functions and services are most important to them? You need to make sure these won't get lost.
    • Try to determine what impact consolidation will have on them.

    According to the Project Management Institute, only 25% of individuals fully commit to change. The remaining 75% either resist or simply accept the change. Gathering stakeholder concerns is a powerful way to gain buy-in.

    The image is a graph with Business Value on the Y-Axis and Time on the X-Axis. Inside the graph, there is a line moving horizontally, separated into segments: Installation, Implementation, and Target Value. The line inclines during the first two segments, and is flat during the last. Emerging from the space between Installation and Implementation is a second line marked Actual realized value. The space between the target value line and the actual realized value line is labelled: Value gap.

    Collect relevant quantitative and qualitative data to assess key stakeholders’ perceptions of IT across the organization

    Don’t base your consolidation on a hunch. Gather reliable data to assess the current state of IT.

    Solicit direct feedback from the organization to gain critical insights into their perceptions of IT.

    • CIO Business Vision: Understanding the needs of your stakeholders is the first and most important step in building a consolidation strategy. Use the results of this survey to assess the satisfaction and importance of different IT services.
    • End-User Satisfaction: Solicit targeted department feedback on core IT service capabilities, IT communications, and business enablement. Use the results to assess the satisfaction of end users with each service broken down by department and seniority level.

    We recommend completing at least the End-User Satisfaction survey as part of your service desk consolidation assessment and planning. An analyst will help you set up the diagnostic and walk through the report with you.

    To book a diagnostic, or get a copy of our questions to inform your own survey, visit Info-Tech’s Benchmarking Tools, contact your account manager, or call toll-free 1-888-670-8889 (US) or 1-844-618-3192 (CAN).

    Data-Driven Diagnostics:

    End-User Satisfaction Survey

    CIO Business Vision

    Review the results of your diagnostics in step 1.3

    Formalize an engagement plan to cultivate support for the change from key stakeholders

    Use Info-Tech’s Stakeholder Engagement Workbook to formalize an engagement strategy

    If a more formal engagement plan is required for this project, use Info-Tech’s Stakeholder Engagement Workbook to document an engagement strategy to ensure buy-in for the consolidation.

    The engagement plan is a structured and documented approach for gathering requirements by eliciting input and validating plans for change and cultivating sponsorship and support from key stakeholders early in the project lifecycle.

    The Stakeholder Engagement Workbook situates stakeholders on a grid that identifies which ones have the most interest in and influence on your project, to assist you in developing a tailored engagement strategy.

    You can also use this analysis to help develop a communications plan for each type of stakeholder in step 3.2.

    Conduct stakeholder interviews to understand needs in more depth, if necessary

    1.1.3 Interview key stakeholders to identify needs

    • If the consolidation will be a large and complex project and there is a need to understand requirements in more depth, conduct stakeholder interviews with “high-value targets” who can help generate requirements and promote communication around requirements at a later point.
    • Choose the interview method that is most appropriate based on available resources.
    Method Description Assessment and Best Practices Stakeholder Effort Business Analyst Effort
    Structured One-on-One Interview In a structured one-on-one interview, the business analyst has a fixed list of questions to ask the stakeholder and follows up where necessary. Structured interviews provide the opportunity to quickly hone in on areas of concern that were identified during process mapping or group elicitation techniques. They should be employed with purpose – to receive specific stakeholder feedback on proposed requirements or help identify systemic constraints. Generally speaking, they should be 30 minutes or less. Low

    Medium

    Unstructured One-on-One Interview In an unstructured one-on-one interview, the business analyst allows the conversation to flow freely. The BA may have broad themes to touch on, but does not run down a specific question list. Unstructured interviews are most useful for initial elicitation, when brainstorming a draft list of potential requirements is paramount. Unstructured interviews work best with senior stakeholders (sponsors or power users), since they can be time consuming if they’re applied to a large sample size. It’s important for BAs not to stifle open dialog and allow the participants to speak openly. They should be 60 minutes or less. Medium Low

    Step 1.2: Develop a vision to give the project direction

    Phase 1

    Develop a shared vision

    1.1 Get buy-in from key stakeholders

    1.2 Develop a vision to give the project direction

    1.3 Conduct a full assessment of each service desk

    This step will walk you through the following activities:
    • 1.2.1 Brainstorm desired attributes for the consolidated service desk to start formulating a vision
    • 1.2.2 Develop a compelling vision and story of change
    • 1.2.3 Create a vision for the consolidated service desk
    • 1.2.4 Identify the purpose, goals, and guiding principles of the consolidation project
    • 1.2.5 Identify anticipated benefits and associated KPIs
    • 1.2.6 Conduct a SWOT analysis on the business
    This step involves the following participants:
    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    • Business Executives
    Step outcomes

    A shared vision for the consolidated service desk that:

    • Defines the scope of the consolidation
    • Encompasses the goals and guiding principles of the project
    • Identifies key attributes of the consolidated service desk and anticipated benefits it will bring
    • Is documented in an executive presentation

    Hold an executive visioning session to kick off the project

    A major change such as service desk consolidation requires a compelling vision to engage staff and motivate them to comprehend and support the change.

    After identifying key stakeholders, gather them in a visioning session or workshop to establish a clear direction for the project.

    An executive visioning session can take up to two days of focused effort and activities with the purpose of defining the short and long-term view, objectives, and priorities for the new consolidated service desk.

    The session should include the following participants:

    • Key stakeholders identified in step 1.1, including:
      • IT management and CIO
      • Project sponsor
      • Business executives interested in the project

    The session should include the following tasks:

    • Identify and prioritize the desired outcome for the project
    • Detail the scope and definition of the consolidation
    • Identify and assess key problems and opportunities
    • Surface and challenge project assumptions
    • Clarify the future desired state of the service desk
    • Determine how processes, functions, and systems are to be included in a consolidation analysis
    • Establish a degree of ownership by senior management

    The activities throughout this step are designed to be included as part of the visioning session

    Choose the attributes of your desired consolidated service desk

    Understand what a model consolidated service desk should look like before envisioning your target consolidated service desk.

    A consolidated service desk should include the following aspects:

    • Handles all customer contacts – including internal and external users – across all locations and business units
    • Provides a single point of contact for end users to submit requests for help
    • Handles both incidents and service requests, as well as any additional relevant ITIL modules such as problem, change, or asset management
    • Consistent, standardized processes and workflows
    • Single ITSM tool with workflows for ticket handling, prioritization, and escalations
    • Central data repository so that staff have access to all information needed to resolve issues quickly and deliver high-quality service, including:
      • IT infrastructure information (such as assets and support contracts)
      • End-user information (including central AD, assets and products owned, and prior interactions)
      • Knowledgebase containing known resolutions and workarounds

    Consolidated Service Desk

    • Service Desk 1
    • Service Desk 2
    • Service Desk 3
    • Consolidated staff
    • Consolidated ITSM tool
    • Consolidated data repository

    Brainstorm desired attributes for the consolidated service desk to start formulating a vision

    1.2.1 Identify the type of consolidation and desired service desk attributes

    Participants
    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    • Other interested business executives
    What You'll Need
    • Whiteboard or flip chart and markers
    Document

    Document in the Consolidate Service Desk Executive Presentation, slide 6.

    Brainstorm the model and attributes of the target consolidated service desk. You will use this to formulate a vision and define more specific requirements later on.
    1. Identify the type of consolidation: virtual, physical, or hybrid (both)
    2. Identify the level of consolidation: partial (some service desks consolidated) or complete (all service desks consolidated)
    Consolidated Service Desk Model Level of Consolidation
    Partial Complete
    Type of Consolidation Virtual
    Physical
    Hybrid

    3. As a group, brainstorm and document a list of attributes that the consolidated service desk should have.

    Examples:

    • Single point of contact for all users
    • One ITSM tool with consistent built-in automated workflows
    • Well-developed knowledgebase
    • Self-serve portal for end users with ability to submit and track tickets
    • Service catalog

    Develop a compelling vision and story of change

    1.2.2 Use a vision table to begin crafting the consolidation vision

    Participants
    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    • Other interested business executives
    What You'll Need
    • Whiteboard or flip chart and markers
    Document

    Document in the Consolidate Service Desk Executive Presentation, slide 7.

    Build desire for change.

    In addition to standard high-level scope elements, consolidation projects that require organizational change also need a compelling story or vision to influence groups of stakeholders.

    Use the vision table below to begin developing a compelling vision and story of change.

    Why is there a need to consolidate service desks?
    How will consolidation benefit the organization? The stakeholders?
    How did we determine this is the right change?
    What would happen if we didn’t consolidate?
    How will we measure success?

    Develop a vision to inspire and sustain leadership and commitment

    Vision can be powerful but is difficult to craft. As a result, vision statements often end up being ineffective (but harmless) platitudes.

    A service desk consolidation project requires a compelling vision to energize staff and stakeholders toward a unified goal over a sustained period of time.

    Great visions:

    • Tell a story. They describe a journey with a beginning (who we are and how we got here) and a destination (our goals and expected success in the future).
    • Convey an intuitive sense of direction (or “spirit of change”) that helps people act appropriately without being explicitly told what to do.
    • Appeal to both emotion and reason to make people want to be part of the change.
    • Balance abstract ideas with concrete facts. Without concrete images and facts, the vision will be meaninglessly vague. Without abstract ideas and principles, the vision will lack power to unite people and inspire broad support.
    • Are concise enough to be easy to communicate and remember in any situation.

    Info-Tech Insight

    Tell a story. Stories pack a lot of information into few words. They are easy to write, remember, and most importantly – share. It’s worth spending a little extra time to get the details right.

    Create a vision for the consolidated service desk

    1.2.3 Tell a story to describe the consolidated service desk vision

    Participants
    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    What You'll Need
    • Whiteboard or flip chart and markers
    • Document in the Executive Presentation, slide 8.

    Craft a vision of the future state of the service desk.

    Tell a story.

    Stories serve to give the consolidation real-world context by describing what the future state will mean for both staff and users of the service desk. The story should sum up the core of the experience of using the consolidated service desk and reflect how the service desk will fit into the life of the user.

    Stories should include:

    • Action describing the way things happen.
    • Contextual detail that helps readers relate to the person in the story.
    • Challenging ideas that contradict common belief and may be disruptive, but help suggest new directions.
    Example:

    Imagine if…

    … users could access one single online service that allows them to submit a ticket through a self-service portal and service catalog, view the status of their ticket, and receive updates about organization-wide outages and announcements. They never have to guess who to contact for help with a particular type of issue or how to contact them as there is only one point of contact for all types of incidents and service requests.

    … all users receive consistent service delivery regardless of their location, and never try to circumvent the help desk or go straight to a particular technician for help as there is only one way to get help by submitting a ticket through a single service desk.

    … tickets from any location could be easily tracked, prioritized, and escalated using standardized definitions and workflows to ensure consistent service delivery and allow for one set of SLAs to be defined and met across the organization.

    Discuss the drivers of the consolidation to identify the goals the project must achieve

    Identifying the reasons behind the consolidation will help formulate the vision for the consolidated service desk and the goals it should achieve.

    The image is a graph, titled Deployment Drivers for Those Planning a Consolidated Service Desk. From highest to lowest, they are: Improved Service Delivery/Increased Productivity; Drive on Operational Costs; and Perceived Best Practice.

    Service Desk Institute (n = 20, 2007)

    A survey of 233 service desks considering consolidation found that of the 20 organizations that were in the planning stages of consolidation, the biggest driver was to improve service delivery and/or increase productivity.

    This is in line with the recommendation that improved service quality should be the main consolidation driver over reducing costs.

    This image is a graph titled Drivers Among Those Who Have Implemented a Consolidated Service Desk. From highest to lowest, they are: Improved Service Delivery/Increased Productivity; Best Practice; Drive on Operational Costs; Internal vs Outsourcing; and Legacy.

    Service Desk Institute (n = 43, 2007)

    The drivers were similar among the 43 organizations that had already implemented a consolidated service desk, with improved service delivery and increased productivity again the primary driver.

    Aligning with best practice was the second most cited driver.

    Identify the purpose, goals, and guiding principles of the consolidation project

    1.2.4 Document goals of the project

    Participants
    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    What You'll Need
    • Whiteboard or flip chart and markers
    • Document in the Executive Presentation, slide 9.

    Use the results of your stakeholder analysis and interviews to facilitate a discussion among recommended participants and document the purpose of the consolidation project, the goals the project aims to achieve, and the guiding principles that must be followed.

    Use the following example to guide your discussion:

    Purpose The purpose of consolidating service desks is to improve service delivery to end users and free up more time and resources to achieve the organization’s core mission.
    Goals
    • Align IT resources with business strategies and priorities
    • Provide uniform quality and consistent levels of service across all locations
    • Improve the end-user experience by reducing confusion about where to get help
    • Standardize service desk processes to create efficiencies
    • Identify and eliminate redundant functions or processes
    • Combine existing resources to create economies of scale
    • Improve organizational structure, realign staff with appropriate job duties, and improve career paths
    Guiding Principles

    The consolidated service desk must:

    1. Provide benefit to the organization without interfering with the core mission of the business
    2. Balance cost savings with service quality
    3. Increase service efficiency without sacrificing service quality
    4. Not interfere with service delivery or the experience of end users
    5. Be designed with input from key stakeholders

    Identify the anticipated benefits of the consolidation to weigh them against risks and plan future communications

    The primary driver for consolidation of service desks is improved service delivery and increased productivity. This should relate to the primary benefits delivered by the consolidation, most importantly, improved end-user satisfaction.

    A survey of 43 organizations that have implemented a consolidated service desk identified the key benefits delivered by the consolidation (see chart at right).

    The image is a bar graph titled Benefits Delivered by Consolidated Service Desk. The benefits, from highest to lowest are: Increased Customer Satisfaction; Optimised Resourcing; Cost Reduction; Increased Productivity/Revenue; Team Visibility/Ownership; Reporting/Accountability.

    Source: Service Desk Institute (n = 43, 2007)

    Info-Tech Insight

    Cost reduction may be an important benefit delivered by the consolidation effort, but it should not be the most valuable benefit delivered. Focus communications on anticipated benefits for improved service delivery and end-user satisfaction to gain buy-in for the project.

    Identify anticipated outcomes and benefits of consolidation

    1.2.5 Use a “stop, start, continue” exercise to identify KPIs

    What You'll Need
    • Whiteboard or flip chart and markers
    Participants
    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    Document

    Document in the Executive Presentation, slide 10

    1. Divide the whiteboard into 3 columns: stop, start, and continue
    2. Identify components of your service desk that:
    • Are problematic and should be phased out (stop)
    • Provide value but are not in place yet (start)
    • Are effective and should be sustained, if not improved (continue)
  • For each category, identify initiatives or outcomes that will support the desired goals and anticipated benefits of consolidation.
  • Stop Start Continue
    • Escalating incidents without following proper protocol
    • Allowing shoulder taps
    • Focusing solely on FCR as a measure of success
    • Producing monthly ticket trend reports
    • Creating a self-serve portal
    • Communicating performance to the business
    • Writing knowledgebase articles
    • Improving average TTR
    • Holding weekly meetings with team members

    Use a SWOT analysis to assess the service desk

    • A SWOT analysis is a structured planning method that organizations can use to evaluate the strengths, weaknesses, opportunities, and threats involved in a project or business venture.
    • Use a SWOT analysis to identify the organization’s current IT capabilities and classify potential disruptive technologies as the first step toward preparing for them.
    Review these questions...
    Strengths (Internal) Weaknesses (Internal)
    • What Service Desk processes provide value?
    • How does the Service Desk align with corporate/IT strategy?
    • How does your Service Desk benefit end users?
    • Does the Service Desk produce reports or data that benefit the business?
    • Does your Service Desk culture offer an advantage?
    • What areas of your service desk require improvement?
    • Are there gaps in capabilities?
    • Do you have budgetary limitations?
    • Are there leadership gaps (succession, poor management, etc.)?
    • Are there reputational issues with the business?
    Opportunities (External) Threats (External)
    • Are end users adopting hardware or software that requires training and education for either themselves or the Service Desk staff?
    • Can efficiencies be gained by consolidating our Service Desks?
    • What is the most cost-effective way to solve the user's technology problems and get them back to work?
    • How can we automate Service Desk processes?
    • Are there obstacles that the Service Desk must face?
    • Are there issues with respect to sourcing of staff or technologies?
    • Could the existing Service Desk metrics be affected?
    • Will the management team need changes to their reporting?
    • Will SLAs need to be adjusted?

    …to help you conduct your SWOT analysis on the service desk.

    Strengths (Internal) Weaknesses (Internal)
    • End user satisfaction >80%
    • Comprehensive knowledgebase
    • Clearly defined tiers
    • TTR on tickets is <1 day
    • No defined critical incident workflow
    • High cost to solve issues
    • Separate toolsets create disjointed data
    • No root cause analysis
    • Ineffective demand planning
    • No clear ticket categories
    Opportunities (External) Threats (External)
    • Service catalog
    • Ticket Templates
    • Ticket trend analysis
    • Single POC through the use of one tool
    • Low stakeholder buy-in
    • Fear over potential job loss
    • Logistics of the move
    • End user alienation over process change

    Conduct a SWOT analysis on the business

    1.2.6 Conduct SWOT analysis

    Participants
    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    What You'll Need
    • Whiteboard or flip chart and markers
    Document
    • Document in the Executive Presentation, slide 11
    1. Break the group into two teams:
    • Assign team A strengths and weaknesses.
    • Assign team B opportunities and threats.
  • Have the teams brainstorm items that fit in their assigned areas.
    • Refer to the questions on the previous slide to help guide discussion
  • Choose someone from each group to fill in the grid on the whiteboard.
  • Conduct a group discussion about the items on the list.
  • Helpful to achieving the objective Harmful to achieving the objective
    Internal origin attributes of the organization Strengths Weaknesses

    External Origin attributes of the environment

    Opportunities Threats

    Frame your project in terms of people, process, technology

    A framework should be used to guide the consolidation effort and provide a standardized basis of comparison between the current and target state.

    Frame the project in terms of the change and impact it will have on:

    • People
    • Process
    • Technology

    Service desk consolidation will likely have a significant impact in all three categories by standardizing processes, implementing a single service management tool, and reallocating resources. Framing the project in this way will ensure that no aspect goes forgotten.

    For each of the three categories, you will identify:

    • Current state
    • Target state
    • Gap and actions required
    • Impact, risks, and benefits
    • Communication and training requirements
    • How to measure progress/success

    People

    • Tier 1 support
    • Tier 2 support
    • Tier 3 support
    • Vendors

    Process

    • Incident management
    • Service request management
    • SLAs

    Technology

    • ITSM tools
    • Knowledgebase
    • CMDB and other databases
    • Technology supported

    Complete the Consolidate Service Desk Executive Presentation

    Complete an executive presentation using the decisions made throughout this step

    Use the Consolidate Service Desk Executive Presentation to deliver the outputs of your project planning to the business and gain buy-in for the project.

    1. Use the results of the activities throughout step 1.2 to produce the key takeaways for your executive presentation.
    2. At the end of the presentation, include 1-2 slides summarizing any additional information specific to your organization.
    3. Once complete, pitch the consolidation project to the project sponsor and executive stakeholders.
      • This presentation needs to cement buy-in for the project before any other progress is made.

    Step 1.3: Conduct a full assessment of each service desk

    Phase 1

    Develop a shared vision

    1.1 Get buy-in from key stakeholders

    1.2 Develop a vision to give the project direction

    1.3 Conduct a full assessment of each service desk

    This step will walk you through the following activities:
    • 1.3.1 Review the results of your diagnostic programs
    • 1.3.2 Analyze the organizational structure of each service desk
    • 1.3.3 Assess the overall maturity of each service desk
    • 1.3.4 Map out roles and responsibilities of each service desk using organizational charts
    • 1.3.5 Assess and document current information system environment
    This step involves the following participants:
    • CIO
    • IT Directors
    • Service Desk Managers
    • Service Desk Technicians
    Step outcomes
    • A robust current state assessment of each service desk, including overall maturity, processes, organizational structure, agent skills, roles and responsibilities, agent satisfaction, technology and ITSM tools.

    Oxford saved time and effort by sticking with a tested process that works

    CASE STUDY

    Industry: Higher Education

    Source: Oxford University, IT Services

    Oxford ITS instigated the service desk consolidation project in the fall of 2012.

    A new ITSM solution was formally acquired in the spring 2014, and amalgamated workflows designed.

    Throughout this period, at least 3 detailed process analyses occurred in close consultation with the affected IT units.

    Responsibility for understanding each existing process (incident, services, change management, etc.) were assigned to members of the project team.

    They determined which of the existing processes were most effective, and these served as the baseline – saving time and effort in the long run by sticking with tested processes that work.

    Reach out early and often.

    Almost from day one, the Oxford consolidation team made sure to consult closely with each relevant ITS team about their processes and the tools they used to manage their workflows.

    This was done both in structured interviews during the visioning stage and informally at periodic points throughout the project.

    The result was the discovery of many underlying similarities. This information was then instrumental to determining a realistic baseline from which to design the new consolidated service desk.

    "We may give our activities different names or use different tools to manage our work but in all cases common sense has prevailed and it’s perhaps not so surprising that we have common challenges that we choose to tackle in similar ways." – Andrew Goff, Change Management at Oxford ITS

    Review the results of your diagnostic programs to inform your current state assessment

    1.3.1 Understand satisfaction with the service desk

    Participants
    • CIO/IT Director
    • IT Manager
    • Service Manager(s)
    Document
    1. Set up an analyst call through your account manager to review the results of your diagnostic.
    • Whatever survey you choose, ask the analyst to review the data and comments concerning:
      • Assessments of service desk timeliness/effectiveness
      • IT business enablement
      • IT innovation leadership
  • Book a meeting with recommended participants. Go over the results of your diagnostic survey.
  • Facilitate a discussion of the results. Focus on the first few summary slides and the overall department results slide.
    • What is the level of IT support?
    • What are stakeholders’ perceptions of IT performance?
    • How satisfied are stakeholders with IT?
    • Does the department understand and act on business needs?
    • What are the business priorities and how well are you doing in meeting these priorities?
    • How can the consolidation project assist the business in achieving goals?
    • How could the consolidation improve end-user satisfaction and business satisfaction?
  • A robust current state assessment is the foundation of a successful consolidation

    You can’t determine where you’re going without a clear idea of where you are now.

    Before you begin planning for the consolidation, make sure you have a clear picture of the magnitude of what you plan on consolidating.

    Evaluate the current state of each help desk being considered for consolidation. This should include an inventory of:

    • Process:
      • Processes and workflows
      • Metrics and SLAs
    • People:
      • Organizational structure
      • Agent workload and skills
      • Facility layout and design
    • Technology:
      • Technologies and end users supported
      • Technologies and tools used by the service desk

    Info-Tech Insight

    A detailed current state assessment is a necessary first step for a consolidation project, but determining the right level of detail to include in the evaluation can be challenging. Gather enough data to establish a baseline and make an informed decision about how to consolidate, but don’t waste time collecting unnecessary information that will only distract and slow down the project.

    Review ticket handling processes for each service desk to identify best practices

    Use documentation, reports, and metrics to evaluate existing processes followed by each service desk before working toward standardized processes.

    Poor Processes vs. Optimized Processes

    Inconsistent or poor processes affect the business through:

    • Low business satisfaction
    • Low end-user satisfaction
    • High cost to resolve
    • Delayed progress on project work
    • Lack of data for reporting due to ineffective ticket categorization, tools, and logged tickets
    • No root cause analysis leads to a reactive vs. proactive service desk
    • Lack of cross-training and knowledge sharing result in time wasted troubleshooting recurring issues
    • Lack of trend analysis limits the effectiveness of demand planning

    Standardized service desk processes increase user and technician satisfaction and lower costs to support through:

    • Improved business satisfaction Improved end-user satisfaction Incidents prioritized and escalated accurately and efficiently
    • Decreased recurring issues due to root cause analysis and trends
    • Increased self-sufficiency of end users
    • Strengthened team and consistent delivery through cross-training and knowledge sharing
    • Enhanced demand planning through trend analysis and reporting

    The image is a graphic of a pyramid, with categories as follows (from bottom): FAQ/Knowledgebase; Users; Tier 1-75-80%; Tier 2-15%; Tier 3 - 5%. On the right side of the pyramid is written Resolution, with arrows extending from each of the higher sections down to Users. On the left is written Escalation, with arrows from each lower category up to the next highest. Inside the pyramid are arrows extending from the bottom to each level and vice versa.

    Analyze the organizational structure of each service desk

    1.3.2 Discuss the structure of each service desk

    Participants
    • CIO
    • Service Desk Manager(s)
    • Service Desk Technicians
    What You'll Need
    • Consolidate Service Desk Assessment Tool

    1. Facilitate a discussion among recommended participants to discuss the structure of each service desk. Decide which model best describes each service desk:

    • The Gatekeeper Model: All calls are routed through a central call group whose sole responsibility is to link the customer to the right individual or group.
    • The Call Sorting Model: All calls are sorted into categories using technology and forwarded to the right 2nd level specialist group.
    • Tiered Structure (Specialist Model): All calls are sorted through a single specialist group, such as desktop support. Their job is to log the interaction, attempt resolution, and escalate when the problem is beyond their ability to resolve.
    • Tiered Structure (Generalist Model): All calls are sorted through a single generalist group, whose responsibility is to log the interaction, attempt a first resolution, and escalate when the problem is beyond their ability to resolve.

    2. Use a flip chart or whiteboard to draw the architecture of each service desk, using the example on the right as a guide.

    The image is a graphic depicting the organizational structure of a service desk, from Users to Vendor. The graphic shows how a user request can move through tiers of service, and the ways that Tiers 2 and 3 of the service desk are broken down into areas of specialization.

    Assess the current state of each service desk using the Consolidate Service Desk Assessment Tool

    Assess the current state of each service desk

    The Consolidate Service Desk Assessment Tool will provide insight into the overall health of each existing service desk along two vectors:

    1. Process Maturity (calculated on the basis of a comprehensive survey)
    2. Metrics (calculated on the basis of entered ticket and demographic data)

    Together these answers offer a snapshot of the health, efficiency, performance, and perceived value of each service desk under evaluation.

    This tool will assist you through the current state assessment process, which should follow these steps:

    1. Send a copy of this tool to the Service Desk Manager (or other designated party) of each service desk that may be considered as part of the consolidation effort.
      • This will collect key metrics and landscape data and assess process maturity
    2. Analyze the data and discuss as a group
    3. Ask follow-up questions
    4. Use the information to compare the health of each service desk using the scorecard tool

    These activities will be described in more detail throughout this step of the project.

    Gather relevant data to assess the environment of each service desk

    Assess each service desk’s environment using the assessment tool

    Send a copy of the Consolidate Service Desk Assessment Tool to the Service Desk Manager (or other designated party) of each service desk that will be considered as part of the consolidation.

    Instruct them to complete tab 2 of the tool, the Environment Survey:

    • Enter Profile, Demographic, Satisfaction, Technology, and Ticket data into the appropriate fields as accurately as possible. Satisfaction data should be entered as percentages.
    • Notes can be entered next to each field to indicate the source of the data, to note missing or inaccurate data, or to explain odd or otherwise confusing data.

    This assessment will provide an overview of key metrics to assess the performance of each service desk, including:

    • Service desk staffing for each tier
    • Average ticket volume and distribution per month
    • # staff in IT
    • # service desk staff
    • # supported devices (PC, laptops, mobiles, etc.)
    • # desktop images

    Assess the overall maturity of each service desk

    1.3.3 Use the assessment tool to measure the maturity of each service desk

    Participants
    • CIO
    • Service Desk Manager(s)
    • Service Desk Technicians
    What You'll Need
    • Consolidate Service Desk Assessment Tool
    1. Assemble the relevant team for each service desk: process owners, functional managers, service desk manager, and relevant staff and technicians who work with the processes to be assessed. Each service desk team should meet to complete the maturity assessment together as a group.
    2. Go to tab 3 (Service Desk Maturity Survey) of the Consolidate Service Desk Assessment Tool and respond to the questions in the following categories:
    • Prerequisites (general questions)
    • People
    • Process
    • Technology
    • SLAs
  • Rate each element. Be honest. The goal is to end up with as close a representation as possible to what really exists. Only then can you identify realistic improvement opportunities. Use the maturity definitions as guides.
  • Evaluate resource utilization and satisfaction to allocate resources effectively

    Include people as part of your current state assessment to evaluate whether your resources are appropriately allocated to maximize effectiveness and agent satisfaction.

    Skills Inventory

    Use the IT Skills Inventory and Gap Assessment Tool to assess agent skills and identify gaps or overlaps.

    Agent Satisfaction

    Measure employee satisfaction and engagement to identify strong teams.

    Roles and Responsibilities

    Gather a clear picture of each service desk’s organizational hierarchy, roles, and responsibilities.

    Agent Utilization

    Obtain a snapshot of service desk productivity by calculating the average amount of time an agent is handling calls, divided by the average amount of time an agent is at work.

    Conduct a skills inventory for each service desk

    Evaluate agent skills across service desks

    After evaluating processes, evaluate the skill sets of the agents tasked with following these processes to identify gaps or overlap.

    Send the Skills Coverage Tool tab to each Service Desk Manager, who will either send it to the individuals who make up their service desk with instructions to rate themselves, or complete the assessment together with individuals as part of one-on-one meetings for discussing development plans.

    IT Skills Inventory and Gap Assessment Tool will enable you to:

    • List skills required to support the organization.
    • Document and rate the skills of the existing IT staffing contingent.
    • Assess the gaps to help determine hiring or training needs, or even where to pare back.
    • Build a strategy for knowledge sharing, transfer, and training through the consolidation project.

    Map out roles and responsibilities of each service desk using organizational charts

    1.3.4 Obtain or draw organizational charts for each location

    Clearly document service desk roles and responsibilities to rationalize service desk architecture.
    Participants
    • CIO, IT Director
    • Service Desk Manager(s)
    • Tier/Specialist Manager(s)
    What You’ll Need
    • Org. charts
    • Flip chart or whiteboard and markers
    1. Obtain or draw (on a whiteboard or flip chart) the organizational chart for each service desk to get a clear picture of the roles that fulfill each service desk. If there is any uncertainty or disagreement, discuss as a group to come to a resolution.
    2. Discuss the roles and reporting relationships within the service desk and across the organization to establish if/where inefficiencies exist and how these might be addressed through consolidation.
    3. If an up-to-date organizational chart is not in place, use this time to define the organizational structure as-is and consider future state.
    IT Director
    Service Desk Manager
    Tier 1 Help Desk Lead Tier 2 Help Desk Lead Tier 2 Apps Support Lead Tier 3 Specialist Support Lead
    Tier 1 Specialist Name Title Name Title Name Title
    Tier 1 Specialist Name Title Name Title Name Title
    Name Title Name Title Name Title
    Name Title Name Title

    Conduct an agent satisfaction survey to compare employee engagement across locations

    Evaluate agent satisfaction

    End-user satisfaction isn’t the only important satisfaction metric.

    Agent satisfaction forms a key metric within the Consolidate Service Desk Assessment Tool, and it can be evaluated in a variety of ways. Choose the approach that best suits your organization and time restraints for the project.

    Determine agent satisfaction on the basis of a robust (and anonymous) survey of service desk agents. Like the end-user satisfaction score, this measure is ideally computed as a percentage.

    There are several ways to measure agent satisfaction:

    1. If your organization runs an employee engagement survey, use the most recent survey results, separating them by location and converting them to a percentage.
    2. If your organization does not currently measure employee engagement or satisfaction, consider one of Info-Tech and McLean & Company’s two engagement diagnostics:
      • Full Engagement Diagnostic – 81 questions that provide a comprehensive view into your organization's engagement levels
      • McLean & Company’s Pulse Survey – 15 questions designed to give a high-level view of employee engagement
    3. For smaller organizations, a survey may not be feasible or make sense. In this case, consider gathering informal engagement data through one-on-one meetings.
    4. Be sure to discuss and document any reasons for dissatisfaction, including pain points with the current tools or processes.
    Document
    • Document on tab 2 of the Consolidate Service Desk Assessment Tool

    Assess the service management tools supporting your service desks

    Identify the different tools being used to support each service desk in order to assess whether and how they can be consolidated into one service management tool.

    Ideally, your service desks are already on the same ITSM platform, but if not, a comprehensive assessment of current tools is the first step toward a single, consolidated solution.

    Include the following in your tools assessment:

    • All automated ITSM solutions being used to log and track incidents and service requests
    • Any manual or other methods of tracking tickets (e.g. Excel spreadsheets)
    • Configurations and any customizations that have been made to the tools
    • How configuration items are maintained and how mature the configuration management databases (CMDB) are
    • Pricing and licensing agreements for tools
    • Any unique functions or limitations of the tools

    Info-Tech Insight

    Document not only the service management tools that are used but also any of their unique and necessary functions and configurations that users may have come to rely upon, such as remote support, self-serve, or chat support, in order to inform requirements in the next phase.

    Assess the IT environment your service desks support

    Even if you don’t do any formal asset management, take this opportunity for discovery and inventory to gain a complete understanding of your IT environment and the range of devices your service desks support.

    Inventory your IT environment, including:

    User Devices

    • Device counts by category Equipment/resources by user

    Servers

    • Server hardware, CPU, memory
    • Applications residing on servers

    Data centers

    • Including location and setup

    In addition to identifying the range of devices you currently support, assess:

    • Any future devices, hardware, or software that the service desk will need to support (e.g. BYOD, mobile)
    • How well each service desk is currently able to support these devices
    • Any unique or location-specific technology or devices that could limit a consolidation

    Info-Tech Insight

    The capabilities and configuration of your existing infrastructure and applications could limit your consolidation plans. A comprehensive technology assessment of not only the service desk tools but also the range of devices and applications your service desks supports will help you to prepare for any potential limitations or obstacles a consolidated service desk may present.

    Assess and document current information system environment

    1.3.5 Identify specific technology and tool requirements

    Participants
    • CIO
    • Service Desk Manager(s)
    • Service Desk Technicians
    What You'll Need
    • Consolidate Service Desk Assessment Tool, tab 2.
    Document

    Document information on number of devices supported and number of desktop images associated with each service desk in the section on “Technology Data” of the Consolidate Service Desk Assessment Tool.

    1. Identify and document the service management tools that are used by each service desk.
    2. For each tool, identify and document any of the following that apply:
    • Integrations
    • Configurations that were made during implementation
    • Customizations that were made during implementation
    • Version, licenses, cost
  • For each service desk, document any location-specific or unique technology requirements or differences that could impact consolidation, including:
    • Devices and technology supported
    • Databases and configuration items
    • Differing applications or hardware needs
  • If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    1.1.1 Assign roles and responsibilities

    Use a RACI chart to assign overarching responsibilities for the consolidation project.

    1.3.2 Analyze the organizational structure of each service desk

    Map out the organizational structure and flow of each service desk and discuss the model that best describes each.

    Phase 2

    Design the Consolidated Service Desk

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 2: Design consolidated service desk

    Proposed Time to Completion (in weeks): 2-4

    Step 2.1: Model target consolidated service desk

    Start with an analyst kick-off call:

    • Define the target state of the consolidated service desk in detail
    • Identify requirements for the consolidation, broken down by people, process, technology and by short- vs. long-term needs

    Then complete these activities…

    • Set project metrics to measure success of the consolidation
    • Brainstorm people, process, technology requirements for the service desk
    • Build requirements documents and RFP for a new tool
    • Review results of the scorecard comparison tool

    With these tools & templates:

    Consolidate Service Desk Scorecard Tool

    Step 2.2: Assess logistics and cost of consolidation

    Review findings with analyst:

    • Plan the logistics of the consolidation for process, technology, and facilities
    • Evaluate the cost and cost savings of consolidation using a TCO tool

    Then complete these activities…

    • Plan logistics for process, technology, facilities, and resource allocation
    • Review the results of the Service Desk Efficiency Calculator to refine the business case for the consolidation project

    With these tools & templates:

    Service Desk Efficiency Calculator

    Service Desk Consolidation TCO Comparison Tool

    Phase 2 Results:

    • Detailed requirements and vision for the consolidated service desk, gap analysis of current vs. target state, and an initial analysis of the logistical considerations to achieve target.

    Step 2.1: Model target consolidated state

    Phase 2

    Design consolidation

    2.1 Design target consolidated service desk

    2.2 Assess logistics and cost of consolidation

    This step will walk you through the following activities:
    • 2.1.1 Determine metrics to measure the value of the project
    • 2.1.2 Set targets for each metric to measure progress and success of the consolidation
    • 2.1.3 Brainstorm process requirements for consolidated service desk
    • 2.1.4 Brainstorm people requirements for consolidated service desk
    • 2.1.5 Brainstorm technology requirements for consolidated service desk
    • 2.1.6 Build a requirements document for the service desk tool
    • 2.1.7 Evaluate alternative tools, build a shortlist for RFPs, and arrange web demonstrations or evaluation copies
    • 2.1.8 Set targets for key metrics to identify high performing service desks
    • 2.1.9 Review the results of the scorecard to identify best practices
    This step involves the following participants:
    • CIO
    • IT Director
    • Service Desk Managers
    • Service Desk Technicians
    Step Outcomes
    • A list of people, process, and technology requirements for the new consolidated service desk
    • A clear vision of the target state
    • An analysis of the gaps between existing and target service desks

    Ensure the right people and methods are in place to anticipate implementation hurdles

    CASE STUDY

    Industry: Higher Education

    Source: Oxford University, IT Services

    "Since our last update, a review and re-planning exercise has reassessed the project approach, milestones, and time scales. This has highlighted some significant hurdles to transition which needed to be addressed, resulting primarily from the size of the project and the importance to the department of a smooth and well-planned transition to the new processes and toolset." – John Ireland, Director of Customer Service & Project Sponsor

    Initial hurdles led to a partial reorganization of the project in Fall 2014

    Despite careful planning and its ultimate success, Oxford’s consolidation effort still encountered some significant hurdles along the way – deadlines were sometimes missed and important processes overlooked.

    These bumps can be mitigated by building flexibility into your plan:

    • Adopt an Agile methodology – review and revise groups of tasks as the project progresses, rather than waiting until near the end of the project to get approval for the complete implementation.
    • Your Tiger Team or Project Steering Group must include the right people – the project team should not just include senior or high-level management; members of each affected IT group should be consulted, and junior-level employees can provide valuable insight into existing and potential processes and workflows.

    Info-Tech Insight

    Ensure that the project lead is someone conversant in ITSM, so that they are equipped to understand and react to the unique challenges and expectations of a consolidation and can easily communicate with process owners.

    Use the consolidation vision to define the target service desk in more detail

    Use your baseline assessment and your consolidation vision as a guide to figure out exactly where you’re going before planning how to get there.

    With approval for the project established and a clear idea of the current state of each service desk, narrow down the vision for the consolidated service desk into a specific picture of the target state.

    The target state should provide answers to the following types of questions:

    Process:

    • Will there be one set of SLAs across the organization?
    • What are the target SLAs?
    • How will ticket categories be defined?
    • How will users submit and track their tickets?
    • How will tickets be prioritized and escalated?
    • Will a knowledgebase be maintained and accessible by both service desk and end users?

    People:

    • How will staff be reorganized?
    • What will the roles and responsibilities look like?
    • How will tiers be structured?
    • What will the career path look like within the service desk?

    Technology:

    • Will there be one single ITSM tool to support the service desk?
    • Will an existing tool be used or will a new tool be selected?
    • If a new tool is needed, what are the requirements?

    Info-Tech Insight

    Select the target state that is right for your organization. Don’t feel pressured to select the highest target state or a complete consolidation. Instead select the target state that is most compatible with your organization’s current needs and capabilities.

    Determine metrics to measure the value of the project

    2.1.1 Identify KPIs to measure the success of the consolidation

    Participants
    • CIO
    • Service Desk Manager(s)
    • Service Desk Technicians
    What You’ll Need
    • Whiteboard or flip chart and markers

    Identify three primary categories where the consolidation project is expected to yield benefits to the business. Use the example on the right to guide your discussion.

    Efficiency and effectiveness are standard benefits for this project, but the third category may depend on your organization.

    • Examples include: improved resourcing, security, asset management, strategic alignment, end-user experience, employee experience

    Identify 1-3 key performance indicators (KPIs) associated with each benefit category, which will be used to measure the success of the consolidation project. Ensure that each has a baseline measure that can be reassessed after the consolidation.

    Efficiency

    Streamlined processes to reduce duplication of efforts

    • Reduced IT spend and cost of delivery
    • One ITSM tool Improved reliability of service
    • Improved response time

    Resourcing

    Improved allocation of human and financial resources

    • Improved resource sharing
    • Improved organizational structure of service desk

    Effectiveness

    Service delivery will be more accessible and standardized

    • Improved responsive-ness to incidents and service requests
    • Improved resolution time
    • Single point of contact for end users
    • Improved reporting

    Set targets for each metric to measure progress and success of the consolidation

    2.1.2 Identify specific metrics for each KPI and targets for each

    Participants
    • IT Director
    • Service Desk Manager(s)
    • Service Desk Technicians
    What You’ll Need
    • KPIs from previous step
    • Whiteboard or flip chart and markers
    1. Select one core KPI for each critical success factor, which will be used to measure progress and success of the consolidation effort down the road.
    2. For each KPI, document the average baseline metric the organization is achieving (averaged across all service desks).
    3. Discuss and document a target metric that the project will aim to reach through the single consolidated service desk.
    4. Set a short and long-term target for each metric to encourage continuous improvement. Examples:
    Efficiency
    Business Value KPI Current Metric Short-Term (6 month) Target Long-Term (1 year) Target
    Streamlined processes to reduce duplication of efforts Improved response time 2 hours 1 hour 30 minutes
    Effectiveness
    Business Value KPI Current Metric Short-Term (6 month) Target Long-Term (1 year) Target
    Service delivery will be more accessible and standardized Improved first call resolution (% resolved at Tier 1) 50% 60% 70%

    If poor processes were in place, take the opportunity to start fresh with the consolidation

    If each service desk’s existing processes were subpar, it may be easier to build a new service desk from the basics rather than trying to adapt existing processes.

    You should have these service management essentials in place:

    Service Requests:

    • Standardize process to verify, approve, and fulfill service requests.
    • Assign priority according to business criticality and service agreements.
    • Think about ways to manage service requests to better serve the business long term.

    Incident Management:

    • Set standards to define and record incidents.
    • Define incident response actions and communications.

    Knowledgebase:

    • Define standards for knowledgebase.
    • Introduce creation of knowledgebase articles.
    • Create a knowledge-sharing and cross-training culture.

    Reporting:

    • Select appropriate metrics.
    • Generate relevant insights that shed light on the value that IT creates for the organization.

    The image is a circle comprised of 3 concentric circles. At the centre is a circle labelled Standardized Service Desk. The ring outside of it is split into 4 sections: Incident Management; Service Requests; Structure and Reporting; and Knowledgebase. The outer circle is split into 3 sections: People, Process, Technologies.

    Evaluate how your processes compare with the best practices defined here. If you need further guidance on how to standardize these processes after planning the consolidation, follow Info-Tech’s blueprint, Standardize the Service Desk.

    Even optimized processes will need to be redefined for the target consolidated state

    Your target state doesn’t have to be perfect. Model a short-term, achievable target state that can demonstrate immediate value.

    Consider the following elements when designing service desk processes:
    • Ticket input (i.e. how can tickets be submitted?)
    • Ticket classification (i.e. how will tickets be categorized?)
    • Ticket prioritization (i.e. how will critical incidents be defined?)
    • Ticket escalation (i.e. how and at what point will tickets be assigned to a more specialized resource?)
    • Ticket resolution (i.e. how will resolution be defined and how will users be notified?)
    • Communication with end users (i.e. how and how often will users be notified about the status of their ticket or of other incidents and outages?)

    Consider the following unique process considerations for consolidation:

    • How will knowledge sharing be enabled in order for all technicians to quickly access known errors and resolve problems?
    • How can first contact resolution levels be maintained through the transition?
    • How will procedures be clearly documented so that tickets are escalated properly?
    • Will ticket classification and prioritization schemes need to change?
    • Will new services such as self-serve be introduced to end users and how will this be communicated?

    Info-Tech Insight

    Don’t do it all at once. Consolidation will lead to some level of standardization. It will be reinforced and improved later through ongoing reengineering and process improvement efforts (continual improvement management).

    Brainstorm process requirements for consolidated service desk

    2.1.3 Identify process-related requirements for short and long term

    Participants
    • CIO
    • Service Desk Manager(s)
    • Service Desk Technicians
    What You'll Need
    • Whiteboard, sticky notes, markers
    • Vision and goals for the consolidation from step 1.2
    Document
    • Document internally, or leave on a whiteboard for workshop participants to return to when documenting tasks in the roadmap tool.
    1. Review the questions in the previous section to frame a discussion on process considerations and best practices for the target consolidated service desk.
    2. Use your responses to the questions to brainstorm a list of process requirements or desired characteristics for the target state, particularly around incident management and service request management.
    3. Write each requirement onto a sticky note and categorize it as one of the following:
      1. Immediate requirement for consolidated service desk
      2. Implement within 6 months
      3. Implement within 1 year

    Example:

    Whiteboard:

    • Immediate
      • Clearly defined ticket prioritization scheme
      • Critical incident process workflow
    • 6 months
      • Clearly defined SOP, policies, and procedures
      • Transactional end-user satisfaction surveys
    • 1 year
      • Change mgmt.
      • Problem mgmt.

    Define the target resource distribution and utilization for the consolidated service desk

    Consolidation can sound scary to staff wondering if there will be layoffs. Reduce that by repurposing local staff and maximizing resource utilization in your organizational design.

    Consider the following people-related elements when designing your target state:

    • How will roles and responsibilities be defined for service desk staff?
    • How many agents will be required to deal with ticket demand?
    • What is the target agent utilization rate?
    • How will staff be distributed among tiers?
    • What will responsibilities be at each tier?
    • Will performance goals and rewards be established or standardized?

    Consider the following unique people considerations for consolidation:

    • Will staffing levels change?
    • Will job titles or roles change for certain individuals?
    • How will staff be reorganized?
    • Will staff need to be relocated to one location?
    • Will reporting relationships change?
    • How will this be managed?
    • How will performance measurements be consolidated across teams and departments to focus on the business goals?
    • Will there be a change to career paths?
    • What will consolidation do to morale, job interest, job opportunities?

    Info-Tech Insight

    Identify SMEs and individuals who are knowledgeable about a particular location, end-user base, technology, or service offering. They may be able to take on a different, greater role due to the reorganization that would make better use of their skills and capabilities and improve morale.

    Brainstorm people requirements for consolidated service desk

    2.1.4 Identify people-related requirements for short and long term

    Participants
    • CIO
    • Service Desk Manager(s)
    • Service Desk Technicians
    What You'll Need
    • Whiteboard, sticky notes, markers
    • Vision and goals for the consolidation from step 1.2
    Document

    Document internally, or leave on a whiteboard for workshop participants to return to when documenting tasks in the roadmap tool.

    1. Review the questions in the previous section to frame a discussion on people considerations and best practices for the target consolidated service desk.
    2. Use your responses to the questions to brainstorm a list of requirements for the allocation and distribution of resources, including roles, responsibilities, and organizational structure.
    3. When thinking about people, consider requirements for both your staff and your end users.
    4. Write each requirement onto a sticky note and categorize it as one of the following:
      1. Immediate requirement for consolidated service desk
      2. Implement within 6 months
      3. Implement within 1 year

    Example:

    Whiteboard:

    • Immediate
      • Three tier structure with SMEs at Tier 2 and 3
      • All staff working together in one visible location
    • 6 months
      • Roles and responsibilities well defined and documented
      • Appropriate training and certifications available to staff
    • 1 year
      • Agent satisfaction above 80%
      • End-user satisfaction above 75%

    Identify the tools that will support the service desk and those the service desk will support

    One of the biggest technology-related decisions you need to make is whether you need a new ITSM tool. Consider how it will be used by a single service desk to support the entire organization.

    Consider the following technology elements when designing your target state:
    • What tool will be used to support the service desk?
    • What processes or ITIL modules can the tool support?
    • How will reports be produced? What types of reports will be needed for particular audiences?
    • Will a self-service tool be in place for end users to allow for password resets or searches for solutions?
    • Will the tool integrate with tools for change, configuration, problem, and asset management?
    • Will the majority of manual processes be automated?
    Consider the following unique technology considerations for consolidation:
    • Is an existing service management tool extensible?
    • If so, can it integrate with essential non-IT systems?
    • Can the tool support a wider user base?
    • Can the tool support all areas, departments, and technologies it will need to after consolidation?
    • How will data from existing tools be migrated to the new tool?
    • What implementation or configuration needs and costs must be considered?
    • What training will be required for the tool?
    • What other new tools and technologies will be required to support the consolidated service desk?

    Info-Tech Insight

    Talk to staff at each service desk to ask about their tool needs and requirements to support their work. Invite them to demonstrate how they use their tools to learn about customization, configuration, and functionality in place and to help inform requirements. Engaging staff in the process will ensure that the new consolidated tool will be supported and adopted by staff.

    Brainstorm technology requirements for consolidated service desk

    2.1.5 Identify technology-related requirements for short and long term

    Participants
    • CIO
    • Service Desk Manager(s)
    • Service Desk Technicians
    What You’ll Need
    • Whiteboard, sticky notes, markers
    • Vision and goals for the consolidation from step 1.2
    Document

    Document internally, or leave on a whiteboard for workshop participants to return to when documenting tasks in the roadmap tool.

    1. Review the questions in the previous section to frame a discussion on technology considerations and best practices for the target consolidated service desk.
    2. Use your responses to the questions to brainstorm a list of requirements for the tools to support the consolidated service desk, along with any other technology requirements for the target state.
    3. Write each requirement onto a sticky note and categorize it as one of the following:
      1. Immediate requirement for consolidated service desk
      2. Implement within 6 months
      3. Implement within 1 year

    Example:

    Whiteboard:

    • Immediate
      • Single ITSM tool
      • Remote desktop support
    • 6 months
      • Self-service portal
      • Regular reports are produced accurately
    • 1 year
      • Mobile portal
      • Chat integration

    Identify specific requirements for a tool if you will be selecting a new ITSM solution

    Service desk software needs to address both business and technological needs. Assess these needs to identify core capabilities required from the solution.

    Features Description
    Modules
    • Do workflows integrate seamlessly between functions such as incident management, change management, asset management, desktop and network management?

    Self-Serve

    • Does the existing tool support self-serve in the form of web forms for incident reporting, forms for service requests, as well as FAQs for self-solve?
    • Is a service catalog available or can one be integrated painlessly?
    Enterprise Service Management Needs
    • Integration of solution to all of IT, Human Resources, Finance, and Facilities for workflows and financial data can yield great benefits but comes at a higher cost and greater complexity. Weigh the costs and benefits.
    Workflow Automation
    • If IT has advanced beyond simple workflows, or if extending these workflows beyond the department, more power may be necessary.
    • Full business process management (BPM) is part of a number of more advanced service desk/service management solutions.
    License Maintenance Costs
    • Are license and maintenance costs still reasonable and appropriate for the value of the tool?
    • Will the vendor renegotiate?
    • Are there better tools out there for the same or better price?
    Configuration Costs
    • Templates, forms, workflows, and reports all take time and skills but bring big benefits. Can these changes be done in-house? How much does it cost to maintain and improve?
    Speed / Performance
    • Data growth and volume may have reached levels beyond the current solution’s ability to cope, despite database tuning.
    Vendor Support
    • Is the vendor still supporting the solution and developing the roadmap? Has it been acquired? Is the level of support still meeting your needs?

    Build a requirements document for the service desk tool

    2.1.6 Create a requirements list and demo script for an ITSM tool (optional)

    Participants
    • CIO/IT Director
    • Service Desk Manager(s)
    • Service Desk Technicians
    What You'll Need
    • Flip charts and markers
    • Templates:
      • IT Service Management Demo Script Template
      • Service Desk Software and RFP Evaluation Tool

    Create a requirements list for the service desk tool.

    1. Break the group into smaller functional groups.
    2. Brainstorm features that would be important to improving efficiencies, services to users, and visibility to data.
    3. Document on flip chart paper, labelling each page with the functional group name.
    4. Prioritize into must-have and nice-to-have items.
    5. Reconvene and discuss each list with the group.
    6. Info-Tech’s Service Desk Software and RFP Evaluation Tool can also be used to document requirements for an RFI.

    Create a demo script:

    Using information from the requirements list, determine which features will be important for the team to see during a demo. Focus on areas where usability is a concern, for example:

    • End-user experience
    • Workflow creation and modification
    • Creating templates
    • Creating service catalog items
    • Knowledgebase

    Evaluate alternative tools, build a shortlist for RFPs, and arrange web demonstrations or evaluation copies

    2.1.7 Identify an alternative tool and build an RFP (optional)

    Participants
    • CIO (optional)
    • Service Desk Manager
    • Service Desk Technician(s)
    • Service Desk Tool Administrator
    What You'll Need
    • Whiteboard or flip chart and markers
    • Service Desk RFP Template

    Evaluate current tool:

    • Investigate to determine if these features are present and just not in use.
    • Contact the vendor if necessary.
    • If enough features are present, determine if additional training is required.
    • If tool is proven to be inadequate, investigate options.

    Consider alternatives:

    Use Info-Tech’s blueprints for further guidance on selecting and implementing an ITSM tool

    1. Select a tool

    Info-Tech regularly evaluates ITSM solution providers and ranks each in terms of functionality and affordability. The results are published in the Enterprise and Mid-Market Service Desk Software Vendor Landscapes.

    2. Implement the tool

    After selecting a solution, follow the Build an ITSM Tool Implementation Plan project to develop an implementation plan to ensure the tool is appropriately designed, installed, and tested and that technicians are sufficiently trained to ensure successful deployment and adoption of the tool.

    Compare your existing service desks with the Consolidate Service Desk Scorecard Tool

    Complete the scorecard tool along with the activities of the next step

    The Consolidate Service Desk Scorecard Tool will allow you to compare metrics and maturity results across your service desks to identify weak and poor performers and processes.

    The purpose of this tool is to organize the data from up to six service desks that are part of a service desk consolidation initiative. Displaying this data in an organized fashion, while offering a robust comparative analysis, should facilitate the process of establishing a new baseline for the consolidated service desk.

    Use the results on tab 4 of the Consolidate Service Desk Assessment Tool. Enter the data from each service desk into tab “2. InfoCards” of the Consolidate Service Desk Scorecard Tool.

    Data from up to six service desks (up to six copies of the assessment tool) can be entered into this tool for comparison.

    Set targets for key metrics to identify high performing service desks

    2.1.8 Use the scorecard tool to set target metrics against which to compare service desks

    Participants
    • CIO or IT Director
    • Service Desk Manager(s)
    What You’ll Need
    • Consolidate Service Desk Scorecard Tool
    1. Review the explanations of the six core metrics identified from the service desk assessment tool. These are detailed on tab 3 of the Consolidate Service Desk Scorecard Tool.
      1. End-user satisfaction
      2. Agent satisfaction
      3. Cost per ticket
      4. Agent utilization rate
      5. First contact resolution rate
      6. First tier resolution rate
    2. For each metric (except agent utilization), define a “worst” and “best” target number. These numbers should be realistic and determined only after some consideration.
    • Service desks scoring at or above the “best” threshold for a particular metric will receive 100% on that metric; while service desks scoring at or below the “worst” threshold for a particular metric will receive 0% on that metric.
    • For agent utilization, only a “best” target number is entered. Service desks hitting this target number exactly will receive 100%, with scores decreasing as a service desk’s agent utilization gets further away from this target.
  • Identify the importance of each metric and vary the values in the “weighting” column accordingly.
  • The values entered on this tab will be used in calculating the overall metric score for each service desk, allowing you to compare the performance of existing service desks against each other and against your target state.

    Review the results of the scorecard to identify best practices

    2.1.9 Discuss the results of the scorecard tool

    Participants
    • CIO or IT Director (optional)
    • Service Desk Manager(s)
    What You'll Need
    • Consolidate Service Desk Scorecard Tool
    1. Facilitate a discussion on the results of the scorecard tool on tabs 4 (Overall Results), 5 (Maturity Results), and 6 (Metrics Results).
    2. Identify the top performing service desks(s) (SD Champions) as identified by the average of their metric and maturity scores.
    3. Identify the top performing service desk by maturity level (tab 5; Level 3 – Integrated or Optimized), paying particular attention to high scorers on process maturity and maturity in incident & service request management.
    4. Identify the top performing service desk by metric score (tab 6), paying particular attention to the metrics that tie into your KPIs.
    5. For those service desks, review their processes and identify what they are doing well to glean best practices.
      1. Incorporate best practices from existing high performing service desks into your target state.
      2. If one service desk is already performing well in all areas, you may choose to model your consolidated service desk after it.

    Document processes and procedures in an SOP

    Define the standard operating procedures for the consolidated service desk

    Develop one set of standard operating procedures to ensure consistent service delivery across locations.

    One set of standard operating procedures for the new service desk is essential for a successful consolidation.

    Info-Tech’s Consolidated Service Desk SOP Template provides a detailed example of documenting procedures for service delivery, roles and responsibilities, escalation and prioritization rules, workflows for incidents and service requests, and resolution targets to help ensure consistent service expectations across locations.

    Use this template as a guide to develop or refine your SOP and define the processes for the consolidated service desk.

    Step 2.2: Assess logistics and cost of consolidation

    Phase 2

    Design consolidation

    2.1 Design target consolidated state

    2.2 Assess logistics and cost

    This step will walk you through the following activities:
    • 2.2.1 Plan logistics for process, technology, and facilities
    • 2.2.2 Plan logistics around resource allocation
    • 2.2.3 Review the results of the Service Desk Efficiency Calculator to refine the business case for the consolidation project
    This step involves the following participants:
    • CIO or IT Director
    • Project Manager
    • Service Desk Manager(s)
    Step outcomes
    • An understanding and list of tasks to accomplish to ensure all logistical considerations for the consolidation are accounted for
    • An analysis of the impact on staffing and service levels using the Service Desk Efficiency Calculator
    • An assessment of the cost of consolidation and the cost savings of a consolidated service desk using a TCO tool

    The United States Coast Guard’s consolidation saved $20 million in infrastructure and support costs

    CASE STUDY

    Industry: US Coast Guard

    Source: CIO Rear Adm. Robert E. Day, Jr. (retired)

    Challenges

    The US Coast Guard was providing internal IT support for 42,000 members on active duty from 11 distinct regional IT service centers around the US.

    Pain Points

    1. Maintaining 11 disparate IT architectures was costly and time consuming.
    2. Staffing inefficiencies limited the USCG’s global IT service operations to providing IT support from 8am to 4pm.
    3. Individual sites were unable to offload peak volume during heavier call loads to other facilities.
    4. Enforcing adherence to standard delivery processes, procedures, and methods was nearly impossible.
    5. Personnel didn’t have a single point of contact for IT support.
    6. Leadership has limited access to consolidated analytics.

    Outcomes

    • Significant reduction in infrastructure, maintenance, and support costs.
    • Reduced risk through comprehensive disaster recovery.
    • Streamlined processes and procedures improved speed of incident resolution.
    • Increased staffing efficiencies.
    • Deeper analytical insight into service desk performance.

    Admiral Day was the CIO from 2009 to 2014. In 2011, he lead an initiative to consolidate USCG service desks.

    Selecting a new location communicated the national mandate of the consolidated service desk

    Site Selection - Decision Procedures

    • Determine location criteria, including:
      • Access to airports, trains, and highways
      • Workforce availability and education
      • Cost of land, real estate, taxes
      • Building availability Financial incentives
    • Review space requirements (i.e. amount and type of space).
    • Identify potential locations and analyze with defined criteria.
    • Develop cost models for various alternatives.
    • Narrow selection to 2-3 sites. Analyze for fit and costs.
    • Conduct site visits to evaluate each option.
    • Make a choice and arrange for securing the site.
    • Remember to compare the cost to retrofit existing space with the cost of creating a space for the consolidated service desk.

    Key Decision

    Relocating to a new location involved potentially higher implementation costs, which was a significant disadvantage.

    Ultimately, the relocation reinforced the national mandate of the consolidated service desk. The new organization would act as a single point of contact for the support of all 42,000 members of the US Coast Guard.

    "Before our regional desks tended to take on different flavors and processes. Today, users get the same experience whether they’re in Alaska or Maryland by calling one number: (855) CG-FIX IT." – Rear Adm. Robert E. Day, Jr. (retired)

    Plan the logistics of the consolidation to inform the project roadmap and cost assessment

    Before proceeding, validate that the target state is achievable by evaluating the logistics of the consolidation itself.

    A detailed project roadmap will help break down the project into manageable tasks to reach the target state, but there is no value to this if the target state is not achievable or realistic.

    Don’t forget to assess the logistics of the consolidation that can be overlooked during the planning phase:

    • Service desk size
    • Location of the service desk
    • Proximity to company management and facilities
    • Unique applications, platforms, or configurations in each location/region
    • Distribution of end-user population and varying end-user needs
    • Load balancing
    • Call routing across locations
    • Special ergonomic or accessibility requirements by location
    • Language requirements

    Info-Tech Insight

    Language barriers can form significant hurdles or even roadblocks for the consolidation project. Don’t overlook the importance of unique language requirements and ensure the consolidated service desk will be able to support end-user needs.

    Plan logistics for process, technology, and facilities

    2.2.1 Assess logistical and cost considerations around processes, technology, and facilities

    Participants
    • CIO or IT Director
    • Project Manager
    • Service Desk Manager(s)
    What You'll Need
    • Whiteboard or flip chart and markers
    • Consolidate roadmap
    Document

    Identify tasks that should form part of the roadmap and document in the roadmap tool.

    Identify costs that should be included in the TCO assessment and document in the TCO tool.

    Discuss and identify any logistic and cost considerations that will need to form part of the consolidation plan and roadmap. Examples are highlighted below.

    Logistic considerations

    • Impact of ticket intake process changes on end users
    • Process change impact on SLAs and productivity standards
    • Call routing changes and improvements
    • Workstations and workspace – is there enough and what will it look like for each agent?
    • Physical access to the service desk – will walk-ups be permitted? Is it accessible?
    • Security or authorization requirements for specific agents that may be impacted by relocation
    • Layout and design of new location, if applicable
    • Hardware, platform, network, and server implications
    • Licensing and contract limitations of the service desk tool

    Cost considerations

    • Cost savings from ITSM tool consolidation
    • Cost of new ITSM tool purchase, if applicable
    • Efficiencies gained from process simplification
    • New hardware or software purchases
    • Cost per square foot of new physical location, if applicable

    Develop a staffing plan that leverages the strengths you currently have and supplement where your needs require

    Your staff are your greatest assets; be sensitive to their concerns as you plan the consolidation.

    Keep in mind that if your target state involves reorganization of resources and the creation of resources, there will be additional staffing tasks that should form part of the consolidation plan. These include:

    • Develop job descriptions and reporting relationships
    • Evaluate current competencies Identify training and hiring needs
    • Develop migration strategy (including severance and migration packages)

    If new positions will be created, follow these steps to mitigate risks:

    1. Conduct skills assessments (a skills inventory should have been completed in phase 1)
    2. Re-interview existing staff for open positions before considering hiring outside staff
    3. Hire staff from outside if necessary

    For more guidance on hiring help desk staff, see Info-Tech’s blueprint, Manage Help Desk Staffing.

    Be sensitive to employee concerns.

    Develop guiding principles for the consolidation to ensure that employee satisfaction remains a priority throughout the consolidation.

    Examples include:

    1. Reconcile existing silos and avoid creating new silos
    2. Keep current systems where it makes sense to avoid staff having to learn multiple new systems to do their jobs and to reduce costs
    3. Repurpose staff and allocate according to their knowledge and expertise as much as possible
    4. Remain open and transparent about all changes and communicate change regularly

    Info-Tech Insight

    The most talented employees can be lost in the migration to a consolidated service desk, resulting in organizational loss of core knowledge. Mitigate this risk using measurement strategies, competency modeling, and knowledge sharing to reduce ambiguity and discomfort of affected employees.

    Plan logistics around resource allocation

    2.2.2 Assess logistical and cost considerations around people

    Participants
    • CIO or IT Director
    • Project Manager
    • Service Desk Manager(s)
    What You’ll Need
    • Whiteboard or flip chart and markers
    • Consolidate roadmap
    Document

    Identify tasks that should form part of the roadmap and document in the roadmap tool.

    Identify costs that should be included in the TCO assessment and document in the TCO tool.

    Discuss and identify any logistic and cost considerations surrounding resources and staffing that will need to form part of the consolidation plan and roadmap. Examples are highlighted below.

    Logistic considerations

    • Specialized training requirements for staff moving to new roles
    • Enablement of knowledge sharing across agents
    • Potential attrition of staff who do not wish to relocate or be reallocated
    • Relocation of staff – will staff have to move and will there be incentives for moving?
    • Skills requirements, recruitment needs, job descriptions, and postings for hiring

    Cost considerations

    • Existing and future salaries for employees
    • Potential attrition of employees
    • Retention costs and salary increases to keep employees
    • Hiring costs
    • Training needs and costs

    Assess impact on staffing with the Service Desk Efficiency Calculator

    How do organizations calculate the staffing implications of a service desk consolidation?

    The Service Desk Efficiency Calculator uses the ITIL Gross Staffing Model to think through the impact of consolidating service desk processes.

    To estimate the impact of the consolidation on staffing levels, estimate what will happen to three variables:

    • Ticket volume
    • Average call resolution
    • Spare capacity

    All things being equal, a reduction in ticket volume (through outsourcing or the implementation of self-serve options, for example), will reduce your staffing requirements (all things being equal). The same goes for a reduction in the average call resolution rate.

    Constraints:

    Spare capacity: Many organizations are motivated to consolidate service desks by potential reductions in staffing costs. However, this is only true if your service desk agents have spare capacity to take on the consolidated ticket volume. If they don’t, you will still need the same number of agents to do the work at the consolidated service desk.

    Agent capabilities: If your agents have specialised skills that you need to maintain the same level of service, you won’t be able to reduce staffing until agents are cross-trained.

    Review the results of the Service Desk Efficiency Calculator to refine the business case for the consolidation project

    2.2.3 Discuss the results of the efficiency calculator in the context of consolidation

    Participants
    • CIO or IT Director
    • Service Desk Manager(s)
    What You’ll Need
    • Completed Service Desk Efficiency Calculator

    The third tab of the Service Desk Efficiency Calculator will quantify:

    • Service Desk Staffing: The impact of different ticket distribution on service desk staffing levels.
    • Service Desk Ticket Resolution Cost: The impact of different ticket distributions on ticket resolution costs.
    • Service Management Efficiency: The business impact of service management initiatives, specifically, the time lost or captured in service management processes relative to an average full-time employee equivalent.

    Facilitate a discussion around the results.

    Evaluate where you are now and where you hope to be. Focus on the efficiency gains expected from the outsourcing project. Review the expected gains in average resolution time, the expected impact on service desk ticket volume, and the associated productivity gains.

    Use this information to refine the business case and project plan for the consolidation, if needed.

    Assess consolidation costs and cost savings to refine the business case

    While cost savings should not be the primary driver of consolidation, they should be a key outcome of the project in order to deliver value.

    Typical cost savings for a service desk consolidation are highlighted below:

    People 10-20% savings (through resource pooling and reallocation)

    Process 5-10% savings (through process simplification and efficiencies gained)

    Technology 10-15% savings (through improved call routing and ITSM tool consolidation)

    Facilities 5-10% savings (through site selection and redesign)

    Cost savings should be balanced against the costs of the consolidation itself (including hiring for consolidation project managers or consultants, moving expenses, legal fees, etc.)

    Evaluate consolidation costs using the TCO Comparison Tool described in the next section.

    Analyze resourcing and budgeting to create a realistic TCO and evaluate the benefits of consolidation

    Use the TCO tool to assess the cost and cost savings of consolidation

    • The tool compares the cost of operating two service desks vs. one consolidated service desk, along with the cost of consolidation.
    • If your consolidation effort involves more than two facilities, then use multiple copies of the tool.
      • E.g. If you are consolidating four service desks (A, B, C, and D) into one service desk (X), then use two copies of the tool. We encourage you to book an analyst call to help you get the most out of this tool and process.

    Service Desk Consolidation TCO Comparison Tool

    Refine the business case and update the executive presentation

    Check in with executives and project sponsor before moving forward with the transition

    Since completing the executive visioning session in step 1.2, you should have completed the following activities:

    • Current state assessment
    • Detailed target state and metrics
    • Gap analysis between current and target state
    • Assessment of logistics and cost of consolidation

    The next step will be to develop a project roadmap to achieve the consolidation vision.

    Before doing this, check back in with the project sponsor and business executives to refine the business case, obtain necessary approvals, and secure buy-in.

    If necessary, add to the executive presentation you completed in step 1.2, copying results of the deliverables you have completed since:

    • Consolidate Service Desk Assessment Tool (current state assessment)
    • Consolidate Service Desk Scorecard Tool
    • Service Desk Consolidation TCO Comparison Tool

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    2.1.3 Brainstorm process requirements for consolidated service desk

    Identify process requirements and desired characteristics for the target consolidated service desk.

    2.1.9 Review the results of the scorecard to identify best practices

    Review the results of the Consolidate Service Desk Scorecard Tool to identify top performing service desks and glean best practices.

    Phase 3

    Plan the Transition

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 3: Plan the transition

    Proposed Time to Completion (in weeks): 2-4

    Step 3.1: Build project roadmap

    Discuss with an analyst:

    • Identify specific initiatives for the consolidation project and evaluate the risks and dependencies for each
    • Plot initiatives on a detailed project roadmap with assigned responsibilities

    Then complete these activities…

    • Break the consolidation project down into specific initiatives
    • Identify and document risks and dependencies
    • Plot your initiatives onto a detailed project roadmap
    • Select transition date for consolidation

    With these tools & templates:

    Service Desk Consolidation Roadmap

    Step 3.2: Communicate the change

    Discuss with an analyst:

    • Identify the goals of communication, then develop a communications plan with targeted messaging for each stakeholder group to achieve those goals
    • Brainstorm potential objections and questions as well as responses to each

    Then complete these activities…

    • Build the communications delivery plan
    • Brainstorm potential objections and questions and prepare responses
    • Complete the news bulletin to distribute to your end users

    With these tools & templates:

    Service Desk Consolidation Communications and Training Plan Template

    Service Desk Consolidation News Bulletin & FAQ Template

    Phase 3 Results:
    • A detailed project roadmap toward consolidation and a communications plan to ensure stakeholders are on board

    Step 3.1: Build the project roadmap

    Phase 3

    Plan the consolidation

    3.1 Build the project roadmap

    3.2 Communicate the change

    This step will walk you through the following activities:
    • 3.1.1 Break the consolidation project down into a series of specific initiatives
    • 3.1.2 Identify and document risks and dependencies
    • 3.1.3 Plot your initiatives onto a detailed project roadmap
    • 3.1.4 Select transition date based on business cycles
    This step involves the following participants:
    • CIO
    • IT Directors
    • Service Desk Managers
    • Consolidation Project Manager
    • Service Desk Technicians
    Step outcomes

    A detailed roadmap to migrate to a single, consolidated service desk, including:

    • A breakdown of specific tasks groups by people, process, and technology
    • Identified risks and dependencies for each task
    • A timeline for completion of each task and the overall consolidation
    • Assigned responsibility for task completion

    Failure to engage stakeholders led to the failure of a large healthcare organization’s consolidation

    CASE STUDY

    Industry: Healthcare

    Source: Organizational insider

    A large US healthcare facilities organization implemented a service desk consolidation initiative in early 2013. Only 18 months later, they reluctantly decided to return to their previous service desk model.

    Why did this consolidation effort fail?

    1. Management failed to communicate the changes to service-level staff, leading to agent confusion and pushback. Initially, each desk became part of the other’s overflow queue with no mention of the consolidation effort. Next, the independent desks began to share a basic request queue. Finally, there was a complete virtual consolidation – which came as a shock to service agents.
    2. The processes and workflows of the original service desks were not integrated, requiring service agents to consult different processes and use different workflows when engaging with end users from different facilities, even though all calls were part of the same queue.
    3. Staff at the different service centers did not have a consistent level of expertise or technical ability, even though they all became part of the same queue. This led to a perceived drop in end-user satisfaction – end users were used to getting a certain level of service and were suddenly confronted with less experienced agents.

    Before Consolidation

    Two disparate service desks:

    • With distinct geographic locations.
    • Servicing several healthcare facilities in their respective regions.
    • With distinct staff, end users, processes, and workflows.

    After Consolidation

    One virtually-consolidated service desk servicing many facilities spread geographically over two distinct locations.

    The main feature of the new virtual service desk was a single, pooled ticket queue drawn from all the end users and facilities in the new geographic regions.

    Break the consolidation project down into a series of specific initiatives

    3.1.1 Create a list of specific tasks that will form the consolidation project

    Participants
    • CIO or IT Director
    • Project Manager
    • Service Desk Manager(s)
    What You’ll Need
    • Whiteboard and markers
    • List of prioritized target state requirements
    • Consolidation roadmap
    Document

    Document the list of initiatives in the Service Desk Consolidation Roadmap.

    In order to translate your newly made decisions regarding the target state and logistical considerations into a successful consolidation strategy, create an exhaustive list of all the steps and sub-steps that will lead you from your current state to your target state.

    Use the next few steps to finish brainstorming the initiative list, identify risks and dependencies, and construct a detailed timeline populated with specific project steps.

    Instructions

    Start with the list you have been curating throughout the current and future state assessments. If you are completing this project as a workshop, add to the initiative list you have been developing on the whiteboard.

    Try to organize your initiatives into groups of related tasks. Begin arranging your initiatives into people, process, technology, or other categories.

    Whiteboard People Process Technology Other

    Evaluate the impact of potential risks and develop a backup plan for high risk initiatives

    A service desk consolidation has a high potential for risks. Have a backup plan prepared for when events don’t go as planned.

    • A consolidation project requires careful planning as it is high risk and not performed often.
    • Apply the same due diligence to the consolidation plan as you do in preparing your disaster recovery plan. Establish predetermined resolutions to realistic risks so that the team can think of solutions quickly during the consolidation.

    Potential Sources of Risk

    • Service desk tool or phone line downtime prevents ability to submit tickets
    • Unable to meet SLAs through the transition
    • Equipment failure or damage through the physical move
    • Lost data through tool migration
    • Lost knowledge from employee attrition
    Risk - degree of impact if activities do not go as planned High

    A – High Risk, Low Frequency

    Tasks that are rarely done and are high risk. Focus attention here with careful planning (e.g. consolidation)

    B – High Risk, High Frequency

    Tasks that are performed regularly and must be watched closely each time (e.g. security authorizations)

    C – Low Risk, Low Frequency

    Tasks that are performed regularly with limited impact or risk (e.g. server upgrades)

    D – Low Risk, High Frequency

    Tasks that are done all the time and are not risky (e.g. password resets)

    Low High
    Frequency - how often the activity has been performed

    Service desk consolidations fit in category A

    Identify risks for people, processes, tools, or data to ensure the project plan will include appropriate mitigations

    Each element of the consolidation has an inherent risk associated with it as the daily service flow is interrupted. Prepare in advance by anticipating these risks.

    The project manager, service desk managers, and subject matter experts (SMEs) of different areas, departments, or locations should identify risks for each of the processes, tools, resource groups (people), and any data exchanges and moves that will be part of the project or impacted by the project.

    Process - For each process, validate that workflows can remain intact throughout the consolidation project. If any gaps may occur in the process flows, develop a plan to be implemented in parallel with the consolidation to ensure service isn’t interrupted.

    Technology - For a tool consolidation, upgrade, or replacement, verify that there is a plan in place to ensure continuation of service delivery processes throughout the change.

    Make a plan for if and how data from the old tool(s) will be migrated to the new tool, and how the new tool will be installed and configured.

    People - For movement of staff, particularly with termination, identify any risks that may occur and involve your HR and legal departments to ensure all movement is compliant with larger processes within the organization.

    Info-Tech Insight

    Don’t overlook the little things. Sometimes the most minor-seeming components of the consolidation can cause the greatest difficulty. For example, don’t assume that the service desk phone number can simply roll over to a new location and support the call load of a combined service desk. Verify it.

    Identify and document risks and dependencies

    3.1.2 Risks, challenges, and dependencies exercise - Estimated Time: 60 minutes

    Participants
    • CIO or IT Director
    • Project Manager
    • Service Desk Manager(s)
    • SMEs
    What You'll Need
    • Whiteboard and markers
    • List of initiatives identified in previous activities
    • Consolidation roadmap
    Document

    Use the outcome of this activity to complete your consolidation roadmap.

    Instructions
    • Document risks and challenges, as well as dependencies associated with the initiatives identified earlier, using a different color sticky note from your initiatives.
    • See example below.
    Combine Related Initiatives
    • Look for initiatives that are highly similar, dependent on each other, or occurring at the same time. Consolidate these initiatives into a single initiative with several sub-steps in order to better organize your roadmap and reduce redundancy.
    • Create hierarchies for dependent initiatives that could affect the scheduling of initiatives on a roadmap, and reorganize the whiteboard where necessary.
    Optional:
    • Use a scoring method to categorize risks. E.g.:
      • High: will stop or delay operations, radically increase cost, or significantly reduce consolidation benefits
      • Medium: would cause some delay, cost increase, or performance shortfall, but would not threaten project viability
      • Low: could impact the project to a limited extent, causing minor delays or cost increases
    • Develop contingency plans for high risks or adjust to avoid the problem entirely
    Implement new ISTM tool:
    • Need to transition from existing tools
    • Users must be trained
    • Data and open tickets must be migrated

    Plot your initiatives onto a detailed project roadmap

    3.1.3 Estimated Time: 45 minutes

    Participants
    • CIO or IT Director
    • Project Manager
    • Service Desk Manager(s)
    Document

    Document your initiatives on tab 2 of the Service Desk Consolidation Roadmap or map it out on a whiteboard.

    Determine the sequence of initiatives, identify milestones, and assign dates.
    • The purpose of this exercise is to define a timeline and commit to initiatives to reach your goals.
    • Determine the order in which previously identified consolidation initiatives will be implemented, document previously identified risks and dependencies, assign ownership for each task, and assign dates for pilots and launch.

    Select transition date based on business cycles

    3.1.4

    Participants
    • CIO or IT Director
    • Project Manager
    • Service Desk Manager(s)
    What You'll Need
    • Consolidation roadmap
    Document

    Adjust initiatives in the consolidation roadmap if necessary.

    The transition date will be used in communications in the next step.

    1. Review the initiatives in the roadmap and the resulting sunshine diagram on tab 3.
    2. Verify that the initiatives will be possible within the determined time frame and adjust if necessary.
    3. Based on the results of the roadmap, select a target transition date for the consolidation by determining:
      1. Whether there are dates when a major effort of this kind should not be scheduled.
      2. Whether there are merger and acquisition requirements that dictate a specific date for the service desk merger.
    4. Select multiple measurable checkpoints to alert the team that something is awry and mitigate risks.
    5. Verify that stakeholders are aware of the risks and the proposed steps necessary to mitigate them, and assign the necessary resources to them.
    6. Document or adjust the target transition date in the roadmap.

    Info-Tech Insight

    Consolidating service desks doesn’t have to be done in one shot, replacing all your help desks, tools, and moving staff all at the same time. You can take a phased approach to consolidating, moving one location, department, or tool at a time to ease the transition.

    Step 3.2: Communicate the change

    Phase 3

    Design consolidation

    3.1 Build the project roadmap

    3.2 Communicate the change

    This step will walk you through the following activities:
    • 3.2.1 Build the communications delivery plan
    • 3.2.2 Brainstorm potential objections and questions and prepare responses
    This step involves the following participants:
    • IT Director
    • Project Manager
    • Service Desk Manager(s)
    • Service Desk Agents
    Step outcomes
    • A detailed communications plan with key messages, delivery timeline, and spokesperson responsibility for each key stakeholder audience
    • A set of agreed-upon responses to anticipated objections and questions to ensure consistent message delivery
    • A news bulletin and list of FAQs to distribute to end users to prepare them for the change

    Create your communication plan with everyone in mind, from the CIO to end users

    CASE STUDY

    Industry: Higher Education

    Source: Oxford University, IT Services

    Oxford implemented extremely innovative initiatives as part of its robust communications plan.

    ITS ran a one-day ITSM “business simulation” for the CIO and direct reports, increasing executive buy-in.

    The business simulation was incredibly effective as a way of getting management buy-in – it really showed what we are driving at. It’s a way of making it real, bringing people on board. ” – John Ireland, Director of Customer Service

    Detailed use cases were envisioned referencing particular ITIL processes as the backbone of the process framework.

    The use cases were very helpful, they were used […] in getting a broad engagement from teams across our department and getting buy-in from the distributed IT staff who we work with across the wider University. ” – John Ireland, Director of Customer Service

    The Oxford ITS SDCP blog was accessible to everyone.

    • Oxford’s SDCP blog acted as a project touchstone not only to communicate updates quickly, but also to collect feedback, enable collaboration, and set a project tone.
    • An informal tone and accessible format facilitated the difficult cultural shifts required of the consolidation effort.

    We in the project team would love to hear your view on this project and service management in general, so please feel free to comment on this blog post, contact us using the project email address […] or, for further information visit the project SharePoint site […] ” – Oxford ITS SDCP blog post

    Plan for targeted and timely communications to all stakeholders

    Develop a plan to keep all affected stakeholders informed about the changes consolidation will bring, and more importantly, how they will affect them.

    All stakeholders must be kept informed of the project plan and status as the consolidation progresses.
    • Management requires frequent communication with the core project group to evaluate the success of the project in meeting its goals.
    • End users should be informed about changes that are happening and how these changes will affect them.

    A communications plan should address three elements:

    1. The audience and their communication needs
    2. The most effective means of communicating with this audience
    3. Who should deliver the message

    Goals of communication:

    1. Create awareness and understanding of the consolidation and what it means for each role, department, or user group
    2. Gain commitment to the change from all stakeholders
    3. Reduce and address any concerns about the consolidation and be transparent in responding to any questions
    4. Communicate potential risks and mitigation plan
    5. Set expectations for service levels throughout and after the consolidation

    Plan the method of delivery for your communications carefully

    Plan the message, test it with a small audience, then deliver to your employees and stakeholders in person to avoid message avoidance or confusion.

    Message Format

    Email and Newsletters

    Email and newsletters are convenient and can be transmitted to large audiences easily, but most users are inundated with email already and may not notice or read the message.

    • Use email to make large announcements or invite people to meetings but not as the sole medium of communication.

    Face-to-Face Communication

    Face-to-face communication helps to ensure that users are receiving and understanding a clear message, and allows them to voice their concerns and clarify any confusion or questions.

    • Use one-on-ones for key stakeholders and team meetings for groups.

    Internal Website/Drive

    Internal sites help sustain change by making knowledge available after the consolidation, but won’t be retained beforehand.

    • Use for storing policies, how-to-guides, and SOPs.
    Message Delivery
    1. Plan your message
      1. Emphasize what the audience really needs to know, that is, how the change will impact them.
    2. Test your message
      1. Run focus groups or test your communications with a small audience (2-3 people) first to get feedback and adjust messages before delivering them more broadly.
    3. Deliver and repeat your message
      1. “Tell them what you’re going to tell them, then tell them, then tell them what you told them.”
    4. Gather feedback and evaluate communications
      1. Evaluate the effectiveness of the communications (through surveys, focus groups, stakeholder interviews, or metrics) to ensure the message was delivered and received successfully and communication goals were met.

    Address the specific concerns of the business vs. employees

    Focus on alleviating concerns from both sides of the communication equation: the business units and employees.

    Business units:

    Be attentive to the concerns of business unit management about loss of power. Appease worries about the potential risk of reduced service quality and support responsiveness that may have been experienced in prior corporate consolidation efforts.

    Make the value of the consolidation clear, and involve business unit management in the organizational change process.

    Focus on producing a customer-focused consolidated service desk. It will assuage fears over the loss of control and influence. Business units may be relinquishing control of their service desk, but they should retain the same level of influence.

    Employees:

    Employees are often fearful of the impact of a consolidation on their jobs. These fears should be addressed and alleviated as soon as possible.

    Design a communication plan outlining the changes and the reasons motivating it.

    Put support programs in place for displaced and surviving employees.

    Motivate employees during the transition and increase employee involvement in the change.

    Educate and train employees who make the transition to the new structure and new job demands.

    Info-Tech Insight

    Know your audience. Be wary of using technical jargon or acronyms that may seem like common knowledge within your department but would not be part of the vocabulary of non-technical audiences. Ensure your communications are suitable for the audience. If you need to use jargon or acronyms, explain what you mean.

    Build the communications delivery plan

    3.2.1 Develop a plan to deliver targeted messages to key stakeholder groups

    Participants
    • CIO or IT Director
    • Project Manager
    • Service Desk Manager(s)
    What You'll Need
    • Communications plan template
    • Whiteboard and markers
    Document

    Document your decisions in the communications plan template

    1. Define the goals of the communications in section 1 of the Service Desk Consolidation Communications and Training Plan Template.
    2. Determine when communication milestones/activities need to be delivered by completing the Communications Schedule in section 2.
    3. Determine the key stakeholder groups or audiences to whom you will need to deliver communications.
    4. Identify the content of the key messages that need to be delivered and select the most appropriate delivery method for each (i.e. email, team meeting, individual meetings). Designate who will be responsible for delivering the messages.
    5. Document a plan for gathering feedback and evaluating the effectiveness of the communications in section 5 (i.e. stakeholder interviews and surveys).

    Section 4 of the communications plan on objections and question handling will be completed in activity 3.2.2.

    Optional Activity

    If you completed the Stakeholder Engagement Workbook in step 1.1, you may also complete the Communications tab in that workbook to further develop your plan to engage stakeholders.

    Effectively manage the consolidation by implementing change management processes

    Implement change management processes to ensure that the consolidation runs smoothly with limited impact on IT infrastructure.

    Communicate and track changes: Identify and communicate changes to all stakeholders affected by the change to ensure they are aware of any downtime and can plan their own activities accordingly.

    Isolate testing: Test changes within a safe non-production environment to eliminate the risk of system outages that result from defects discovered during testing.

    Document back-out plans: Documented back-out/backup plans enable quick recovery in the event that the change fails.

    The image is a horizontal bar graph, titled Unplanned downtime due to change versus change management maturity. The graph shows that for a Change Management Maturity that is Informal, the % Experiencing Unplanned Downtime due to Failed Change is 41%; for Defined, it is 25%; and for Optimized, it is 19%.

    Organizations that have more mature and defined change management processes experience less unplanned downtime when implementing change across the organization.

    Sustain changes by adapting people, processes, and technologies to accept the transition

    Verify that people, process, and technologies are prepared for the consolidation before going live with the transition.

    What?

    1. Adapt people to the change

    • Add/change roles and responsibilities.
    • Move people to different roles/teams.
    • Change compensation and incentive structures to reinforce new goals, if applicable.

    2. Adapt processes to the change

    • Add/change supporting processes.
    • Eliminate or consolidate legacy processes.
    • Add/change standard operating procedures.

    3. Adapt technologies to the change

    • Add/change/update supporting technologies.
    • Eliminate or consolidate legacy technologies
    How? Work with HR on any changes involving job design, personnel changes, or compensation. Work with enterprise architects or business analysts to manage significant changes to processes that may impact the business and service levels.

    See Info-Tech’s Optimize the Change Management Processblueprint to use a disciplined change control process for technology changes.

    Info-Tech Insight

    Organizational change management (OCM) is widely recognized as a key component of project success, yet many organizations struggle to get adoption for new tools, policies, and procedures. Use Info-Tech’s blueprint on driving organizational change to develop a strategy and toolkit to achieve project success.

    Manage people by addressing their specific concerns based on their attitude toward change

    Avoid high turnover and resistance to change by engaging both the enthusiasts and the skeptics with targeted messaging.

    • Clearly articulate and strongly champion the changes that will result from the consolidation for those willing to adapt to the change.
    • Make change management practices integral to the entire project.
    • Provide training workshops on new processes, new goals or metrics, new technologies and tools, and teamwork as early as possible after consolidation.
    1. Enthusiasts - Empower them to stay motivated and promote the change
    2. Fence-Sitters/Indifferent - Continually motivate them by example but give them time to adapt to the change
    3. Skeptics - Engage them early and address their concerns and doubts to convert them to enthusiasts
    4. Saboteurs - Prevent them from spreading dissent and rumors, thus undermining the project, by counteracting negative claims early

    Leverage the Stakeholder Engagement Workbook from step 1.1 as well as Info-Tech’s blueprint on driving organizational change for more tactics on change management, particularly managing and engaging various personas.

    Prepare ahead of time for questions that various stakeholder groups may have

    Anticipate questions that will arise about the consolidation so you can prepare and distribute responses to frequently asked questions. Sample questions from various stakeholders are provided below.

    General
    1. Why is the organization moving to a consolidated service desk?
    2. Where is the consolidated service desk going to be located?
    3. Are all or only some service desks consolidating?
    4. When is the consolidation happening?
    5. What are the anticipated benefits of consolidation?

    Business

    1. What is the budget for the project?
    2. What are the anticipated cost savings and return on investment?
    3. When will the proposed savings be realized?
    4. Will there be job losses from the consolidation and when will these occur?
    5. Will the organization subsidize moving costs?

    Employees

    1. Will my job function be changing?
    2. Will my job location be changing?
    3. What will happen if I can’t relocate?
    4. Will my pay and benefits be the same?
    5. Will reporting relationships change?
    6. Will performance expectations and metrics change?

    End Users

    1. How do I get help with IT issues?
    2. How do I submit a ticket?
    3. How will I be notified of ticket status, outages?
    4. Where will the physical service desk be located?
    5. Will I be able to get help in my language?
    6. Will there be changes for levels of service?

    Brainstorm likely objections/questions to prepare responses

    3.2.2 Prepare responses to likely questions to ensure consistent messaging

    Participants
    • IT Director
    • Project Manager
    • Service Desk Manager(s)
    • Service Desk Agents
    Document

    Document your questions and responses in section 4 of the communications plan template. This should be continually updated.

    1. Brainstorm anticipated objections and questions you may hear from various stakeholder groups: service desk employees, end users, and management or executives.
    2. For each objection or question, prepare a response that will be delivered to ensure consistent messaging. Use a table like the example below.
    Group Objection/Question Response
    Service desk staff I’m comfortable with the service desk tool we’ve been using here and won’t know how to use the new one. We carefully evaluated the new solution against our requirements and selected it as the one that will provide the best service to our users and be user friendly. We tested the solution through user-acceptance testing to ensure staff will be comfortable using it, and we will provide comprehensive training to all users of the tool before launching it.
    End user I’m used to going to my favorite technician for help. How will I get service now? We are initiating a single point of contact so that you will know exactly where to go to get help quickly and easily, so that we can more quickly escalate your issue to the appropriate technician, and so that we can resolve it and notify you as soon as possible. This will make our service more effective and efficient than you having to find one individual who may be tied up with other work or unavailable.

    Keep the following in mind when formulating your responses:

    • Lead with the benefits
    • Be transparent and honest
    • Avoid acronyms, jargon, and technical terms
    • Appeal to both emotion and reason
    • Be concise and straightforward
    • Don’t be afraid to be repetitive; people need repetition to remember the message
    • Use concrete facts and images wherever possible

    Complete the Service Desk Consolidation News Bulletin & FAQ Template to distribute to your end users

    Customize the template or use as a guide to develop your own

    The Service Desk Consolidation News Bulletin & FAQ Template is intended to be an example that you can follow or modify for your own organization. It provides a summary of how the consolidation project will change how end users interact with the service desk.

    1. What the change means to end users
    2. When they should contact the service desk (examples)
    3. How to contact the service desk (include all means of contact and ticket submission)
    4. Answers to questions they may have
    5. Links to more information

    The bulletin is targeted for mass distribution to end users. A similar letter may be developed for service desk staff, though face-to-face communication is recommended.

    Instructions:

    1. Use the template as a guide to develop your own FAQ news bulletin and adjust any sections or wording as you see fit.
    2. You may wish to develop separate letters for each location, referring more specifically to their location and where the new service desk will be located.
    3. Save the file as a PDF for print or email distribution at the time determined in your communications plan.

    Keeping people a priority throughout the project ensured success

    CASE STUDY

    Industry: Higher Education

    Source: Oxford University, IT Services

    Oxford’s new consolidated service desk went live April 20, 2015.

    They moved from 3 distinct tools and 5 disparate help desks to a single service desk with one robust ITSM solution, all grounded by a unified set of processes and an integrated workflow.

    The success of this project hinged upon:

    • A bold vision, formulated early and in collaboration with all stakeholders.
    • Willingness to take time to understand the unique perspective of each role and help desk, then carefully studying existing processes and workflows to build upon what works.
    • Constant collaboration, communication, and the desire to listen to feedback from all interested parties.

    "We have had a few teething issues to deal with, but overall this has been a very smooth transition given the scale of it." – ICTF Trinity Term 2015 IT Services Report

    Beyond the initial consolidation.
    • Over the summer of 2015, ITS moved to full 24/7 support coverage.
    • Oxford’s ongoing proposition with regard to support services is to extend the new consolidated service desk beyond its current IT role:
      • Academic Admissions
      • Case Management
      • IT Purchasing
    • To gradually integrate those IT departments/colleges/faculties that remain independent at the present time.
    • Info-Tech can facilitate these goals in your organization with our research blueprint, Extend the Service Desk to Enterprise.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    3.1.1 Break the consolidation project down into a series of specific initiatives

    Create a list of specific tasks that will form the consolidation project on sticky notes and organize into people, process, technology, and other categories to inform the roadmap.

    3.2.2 Brainstorm likely objections/questions to prepare responses

    Brainstorm anticipated questions and objections that will arise from various stakeholder groups and prepare consistent responses to each.

    Related Info-Tech research

    Standardize the Service Desk - Provide timely and effective responses to user requests and resolutions of all incidents.

    Extend the Service Desk to the Enterprise - Position IT as an innovator.

    Build a Continual Improvement Plan for the Service Desk - Teach your old service desk new tricks.

    Adopt Lean IT to Streamline the Service Desk - Turn your service desk into a Lean, keen, value-creating machine.

    Vendor Landscape: Enterprise Service Desk Software - Move past tickets to proactive, integrated service.

    Vendor Landscape: Mid-Market Service Desk Software - Ensure the productivity of the help desk with the right platform.

    Build an ITSM Tool Implementation Plan - Nail your ITSM tool implementation from the outset.

    Drive Organizational Change from the PMO - Don’t let bad change happen to good projects.

    Research contributors and experts

    Stacey Keener - IT Manager for the Human Health and Performance Directorate, Johnson Space Center, NASA

    Umar Reed - Director of IT Support Services US Denton US LLP

    Maurice Pryce - IT Manager City of Roswell, Georgia

    Ian Goodhart - Senior Business Analyst Allegis Group

    Gerry Veugelaers - Service Delivery Manager New Zealand Defence Force

    Alisa Salley Rogers - Senior Service Desk Analyst HCA IT&S Central/West Texas Division

    Eddie Vidal - IS Service Desk Managers University of Miami

    John Conklin - Chief Information Officer Helen of Troy LP

    Russ Coles - Senior Manager, Computer Applications York Region District Schoolboard

    John Seddon - Principal Vanguard Consulting

    Ryan van Biljon - Director, Technical Services Samanage

    Rear Admiral Robert E. Day Jr. (ret.) - Chief Information Officer United States Coast Guard

    George Bartha - Manager of Information Technology Unifrax

    Peter Hubbard - IT Service Management Consultant Pink Elephant

    Andre Gaudreau - Manager of School Technology Operations York Region District School Board

    Craig Nekola - Manager, Information Technology Anoka County

    Bibliography and Further Reading

    Hoen, Jim. “The Single Point of Contact: Driving Support Process Improvements with a Consolidated IT Help-Desk Approach.” TechTeam Global Inc. September 2005.

    Hubbard, Peter. “Leading University embarks on IT transformation programme to deliver improved levels of service excellence.” Pink Elephant. http://pinkelephant.co.uk/about/case-studies/service-management-case-study/

    IBM Global Services. “Service Desk: Consolidation, Relocation, Status Quo.” IBM. June 2005.

    Keener, Stacey. “Help Desks: a Problem of Astronomical Proportions.” Government CIO Magazine. 1 February 2015.

    McKaughan, Jeff. “Efficiency Driver.” U.S. Coast Guard Forum Jul. 2013. Web. http://www.intergraphgovsolutions.com/documents/CoastGuardForumJuly2013.pdf

    Numara Footprints. “The Top 10 Reasons for Implementing a Consolidated Service Desk.” Numara Software.

    Roy, Gerry, and Frederieke Winkler Prins. “How to Improve Service Quality through Service Desk Consolidation.” BMC Software.

    Smith, Andrew. “The Consolidated Service Desk – An Achievable Goal?” The Service Desk Institute.

    Wolfe, Brandon. “Is it Time for IT Service Desk Consolidation?” Samanage. 4 August 2015.

    Reduce Manual Repetitive Work With IT Automation

    • Buy Link or Shortcode: {j2store}458|cart{/j2store}
    • member rating overall impact: 9.5/10 Overall Impact
    • member rating average dollars saved: $34,099 Average $ Saved
    • member rating average days saved: 2 Average Days Saved
    • Parent Category Name: Operations Management
    • Parent Category Link: /i-and-o-process-management
    • IT staff are overwhelmed with manual repetitive work.
    • You have little time for projects.
    • You cannot move as fast as the business wants.

    Our Advice

    Critical Insight

    • Optimize before you automate.
    • Foster an engineering mindset.
    • Build a process to iterate.

    Impact and Result

    • Begin by automating a few tasks with the highest value to score quick wins.
    • Define a process for rolling out automation, leveraging SDLC best practices.
    • Determine metrics and continually track the success of the automation program.

    Reduce Manual Repetitive Work With IT Automation Research & Tools

    Start here – read the Executive Brief

    Read this Executive Brief to understand why you should reduce manual repetitive work with IT automation.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Identify automation candidates

    Select the top automation candidates to score some quick wins.

    • Reduce Manual Repetitive Work With IT Automation – Phase 1: Identify Automation Candidates
    • IT Automation Presentation
    • IT Automation Worksheet

    2. Map and optimize process flows

    Map and optimize process flows for each task you wish to automate.

    • Reduce Manual Repetitive Work With IT Automation – Phase 2: Map & Optimize Process Flows

    3. Build a process for managing automation

    Build a process around managing IT automation to drive value over the long term.

    • Reduce Manual Repetitive Work With IT Automation – Phase 3: Build a Process for Managing Automation

    4. Build automation roadmap

    Build a long-term roadmap to enhance your organization's automation capabilities.

    • Reduce Manual Repetitive Work With IT Automation – Phase 4: Build Automation Roadmap
    • IT Automation Roadmap
    [infographic]

    Workshop: Reduce Manual Repetitive Work With IT Automation

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Identify Automation Candidates

    The Purpose

    Identify top candidates for automation.

    Key Benefits Achieved

    Plan to achieve quick wins with automation for early value.

    Activities

    1.1 Identify MRW pain points.

    1.2 Drill down pain points into tasks.

    1.3 Estimate the MRW involved in each task.

    1.4 Rank the tasks based on value and ease.

    1.5 Select top candidates and define metrics.

    1.6 Draft project charters.

    Outputs

    MRW pain points

    MRW tasks

    Estimate of MRW involved in each task

    Ranking of tasks for suitability for automation

    Top candidates for automation & success metrics

    Project charter(s)

    2 Map & Optimize Processes

    The Purpose

    Map and optimize the process flow of the top candidate(s).

    Key Benefits Achieved

    Requirements for automation of the top task(s).

    Activities

    2.1 Map process flows.

    2.2 Review and optimize process flows.

    2.3 Clarify logic and finalize future-state process flows.

    Outputs

    Current-state process flows

    Optimized process flows

    Future-state process flows with complete logic

    3 Build a Process for Managing Automation

    The Purpose

    Develop a lightweight process for rolling out automation and for managing the automation program.

    Key Benefits Achieved

    Ability to measure and to demonstrate success of each task automation, and of the program as a whole.

    Activities

    3.1 Kick off your test plan for each automation.

    3.2 Define process for automation rollout.

    3.3 Define process to manage your automation program.

    3.4 Define metrics to measure success of your automation program.

    Outputs

    Test plan considerations

    Automation rollout process

    Automation program management process

    Automation program metrics

    4 Build Automation Roadmap

    The Purpose

    Build a roadmap to enhance automation capabilities.

    Key Benefits Achieved

    A clear timeline of initiatives that will drive improvement in the automation program to reduce MRW.

    Activities

    4.1 Build a roadmap for next steps.

    Outputs

    IT automation roadmap

    Further reading

    Reduce Manual Repetitive Work With IT Automation

    Free up time for value-adding jobs.

    ANALYST PERSPECTIVE

    Automation cuts both ways.

    Automation can be very, very good, or very, very bad.
    Do it right, and you can make your life a whole lot easier.
    Do it wrong, and you can suffer some serious pain.
    All too often, automation is deployed willy-nilly, without regard to the overall systems or business processes in which it lives.
    IT professionals should follow a disciplined and consistent approach to automation to ensure that they maximize its value for their organization.

    Derek Shank,
    Research Analyst, Infrastructure & Operations
    Info-Tech Research Group

    Executive summary

    Situation

    • IT staff are overwhelmed with manual repetitive work.
    • You have little time for projects.
    • You cannot move as fast as the business wants.

    Complication

    • Automation is simple to say, but hard to implement.
    • Vendors claim automation will solve all your problems.
    • You have no process for managing automation.

    Resolution

    • Begin by automating a few tasks with the highest value to score quick wins.
    • Define a process for rolling out automation, leveraging SDLC best practices.
    • Determine metrics and continually track the success of the automation program.

    Info-Tech Insight

    1. Optimize before you automate.The current way isn’t necessarily the best way.
    2. Foster an engineering mindset.Your team members may not be process engineers, but they should learn to think like one.
    3. Build a process to iterate.Effective automation can't be a one-and-done. Define a lightweight process to manage your program.

    Infrastructure & operations teams are overloaded with work

    • DevOps and digital transformation initiatives demand increased speed.
    • I&O is still tasked with security and compliance and audit.
    • I&O is often overloaded and unable to keep up with demand.

    Manual repetitive work (MRW) sucks up time

    • Manual repetitive work is a fact of life in I&O.
    • DevOps circles refer to this type of work simply as “toil.”
    • Toil is like treading water: it must be done, but it consumes precious energy and effort just to stay in the same place.
    • Some amount of toil is inevitable, but it's important to measure and cap toil, so it does not end up overwhelming your team's whole capacity for engineering work.

    Info-Tech Insight

    Follow our methodology to focus IT automation on reducing toil.

    Manual hand-offs create costly delays

    • Every time there is a hand-off, we lose efficiency and productivity.
    • In addition to the cost of performing manual work itself, we must also consider the impact of lost productivity caused by the delay of waiting for that work to be performed.

    Every queue is a tire fire

    Queues create waste and are extremely damaging. Like a tire fire, once you get started, they’re almost impossible to stamp out!

    Increase queues if you want

    • “More overhead”
    • “Lower quality”
    • “More variability”
    • “Less motivation”
    • “Longer cycle time”
    • “Increased risk”

    (Source: Edwards, citing Donald G. Reinersten: The Principles of Product Development Flow: Second Generation Lean Product Development )

    Increasing complexity makes I&O’s job harder

    Every additional layer of complexity multiplies points of failure. Beyond a certain level of complexity, troubleshooting can become a nightmare.

    Today, Operations is responsible for the outcomes of a full stack of a very complex, software-defined, API-enabled system running on infrastructure they may or may not own.
    – Edwards

    Growing technical debt means an ever-rising workload

    • Enterprises naturally accumulate technical debt.
    • All technology requires care and feeding.
    • I&O cannot control how much technology it’s expected to support.
    • I&O faces a larger and larger workload as technical debt accumulates.

    The systems built under each new technology paradigm never fully replace the systems built under the old paradigms. It’s not uncommon for an enterprise to have an accumulation of systems built over 10-15 years and have no budget, risk appetite, or even a viable path to replace them all. With each shift, who bares [SIC] the brunt of the responsibility for making sure the old and the new hang together? Operations, of course. With each new advance, Operations juggles more complexity and more layers of legacy technologies than ever before.
    – Edwards

    Most IT shops can’t have a dedicated engineering team

    • In most organizations, the team that builds things is best equipped to support them.
    • Often the knowledge to design systems and the knowledge to run those systems naturally co-exists in the same personnel resources.
    • When your I&O team is trying to do engineering work, they can end up frequently interrupted to perform operational tasks.
    A Venn Diagram is depicted which compares People who build things with People who run things. the two circles are almost completely overlapping, indicating the strong connection between the two groups.

    Personnel resources in most IT organizations overlap heavily between “build” and “run.”

    IT operations must become an engineering practice

    • Usually you can’t double your staff or double their hours.
    • IT professionals must become engineers.
    • We do this by automating manual repetitive work and reducing toil.
    Two scenarios are depicted. The first scenario is found at a hypothetical work camp, in which one employee performs the task of manually splitting firewood with an axe. In order to split twice as much firewood, the employee would need to spend twice the time. The second scenario is Engineering Operations. in this scenario, a wood processor is used to automate the task, allowing far more wood to be split in same amount of time.

    Build your Sys Admin an Iron Man suit

    Some CIOs see a Sys Admin and want to replace them with a Roomba. I see a Sys Admin and want to build them an Iron Man suit.
    – Deepak Giridharagopal, CTO, Puppet

    Two Scenarios are depicted. In one, an employee is replaced by automation, represented by a Roomba, reducing costs by laying off a single employee. In the second scenario, the single employee is given automated tools to do their job, represented by an iron-man suit, leading to a 10X boost in employee productivity.

    Use automation to reduce risk

    Consistency

    When we automate, we can make sure we do something the same way every time and produce a consistent result.

    Auditing and Compliance

    We can design an automated execution that will ship logs that provide the context of the action for a detailed audit trail.

    Change

    • Enterprise environments are continually changing.
    • When context changes, so does the procedure.
    • You can update your docs all you want, but you can't make people read them before executing a procedure.
    • When you update the procedure itself, you can make sure it’s executed properly.

    Follow Info-Tech’s approach: Start small and snowball

    • It’s difficult for I&O to get the staffing resources it needs for engineering work.
    • Rather than trying to get buy-in for resources using a “top down” approach, Info-Tech recommends that I&O score some quick wins to build momentum.
    • Show success while giving your team the opportunity to build their engineering chops.

    Because the C-suite relies on upwards communication — often filtered and sanitized by the time it reaches them — executives don’t see the bottlenecks and broken processes that are stalling progress.
    – Andi Mann

    Info-Tech’s methodology employs a targeted approach

    • You aren’t going to automate IT operations end-to-end overnight.
    • In fact, such a large undertaking might be more effort than it’s worth.
    • Info-Tech’s methodology employs a targeted approach to identify which candidates will score some quick wins.
    • We’ll demonstrate success, gain momentum, and then iterate for continual improvement.

    Invest in automation to reap long-term rewards

    • All too often people think of automation like a vacuum cleaner you can buy once and then forget.
    • The reality is you need to perform care and feeding for automation like for any other process or program.
    • To reap the greatest rewards you must continually invest in automation – and invest wisely.

    To get the full ROI on your automation, you need to treat it like an employee. When you hire an employee, you invest in that person. You spend time and resources training and nurturing new employees so they can reach their full potential. The investment in a new employee is no different than your investment in automation.– Edwards

    Measure the success of your automation program

    Example of How to Estimate Dollar Value Impact of Automation
    Metric Timeline Target Value
    Hours of manual repetitive work 12 months 20% reduction $48,000/yr.(1)
    Hours of project capacity 18 months 30% increase $108,000/yr.(2)
    Downtime caused by errors 6 months 50% reduction $62,500/yr.(3)

    1 15 FTEs x 80k/yr.; 20% of time on MRW, reduced by 20%
    2 15 FTEs x 80k/yr.; 30% project capacity, increased by 30%
    3 25k/hr. of downtime.; 5 hours per year of downtime caused by errors

    Automating failover for disaster recovery

    CASE STUDY

    Industry Financial Services
    Source Interview

    Challenge

    An IT infrastructure manager had established DR failover procedures, but these required a lot of manual work to execute. His team lacked the expertise to build automation for the failover.

    Solution

    The manager hired consultants to build scripts that would execute portions of the failover and pause at certain points to report on outcomes and ask the human operator whether to proceed with the next step.

    Results

    The infrastructure team reduced their achievable RTOs as follows:
    Tier 1: 2.5h → 0.5h
    Tier 2: 4h → 1.5h
    Tier 3: 8h → 2.5h
    And now, anyone on the team could execute the entire failover!

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

    Guided Implementation

    “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

    Workshop

    “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

    Consulting

    “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

    Diagnostics and consistent frameworks used throughout all four options

    Reduce Manual Repetitive Work With IT Automation – project overview

    1. Select Candidates 2. Map Process Flows 3. Build Process 4. Build Roadmap
    Best-Practice Toolkit

    1.1 Identify MRW pain points

    1.2 Drill down pain points into tasks

    1.3 Estimate the MRW involved in each task

    1.4 Rank the tasks based on value and ease

    1.5 Select top candidates and define metrics

    1.6 Draft project charters

    2.1 Map process flows

    2.2 Review and optimize process flows

    2.3 Clarify logic and finalize future-state process flows

    3.1 Kick off your test plan for each automation

    3.2 Define process for automation rollout

    3.3 Define process to manage your automation program

    3.4 Define metrics to measure success of your automation program

    4.1 Build automation roadmap

    Guided Implementations

    Introduce methodology.

    Review automation candidates.

    Review success metrics.

    Review process flows.

    Review end-to-end process flows.

    Review testing considerations.

    Review automation SDLC.

    Review automation program metrics.

    Review automation roadmap.

    Onsite Workshop Module 1:
    Identify Automation Candidates
    Module 2:
    Map and Optimize Processes
    Module 3:
    Build a Process for Managing Automation
    Module 4:
    Build Automation Roadmap
    Phase 1 Results:
    Automation candidates and success metrics
    Phase 2 Results:
    End-to-end process flows for automation
    Phase 3 Results:
    Automation SDLC process, and automation program management process
    Phase 4 Results:
    Automation roadmap

    Develop a Security Awareness and Training Program That Empowers End Users

    • Buy Link or Shortcode: {j2store}370|cart{/j2store}
    • member rating overall impact: 9.4/10 Overall Impact
    • member rating average dollars saved: $12,075 Average $ Saved
    • member rating average days saved: 11 Average Days Saved
    • Parent Category Name: Security Strategy & Budgeting
    • Parent Category Link: /security-strategy-and-budgeting
    • The fast evolution of the cybersecurity landscape requires security training and awareness programs that are frequently updated and improved.
    • Security and awareness training programs often fail to engage end users. Lack of engagement can lead to low levels of knowledge retention.
    • Irrelevant or outdated training content does not properly prepare your end users to effectively defend the organization against security threats.

    Our Advice

    Critical Insight

    • One-time, annual training is no longer sufficient for creating an effective security awareness and training program.
    • By presenting security as a personal and individualized issue, you can make this new personal focus a driver for your organizational security awareness and training program.

    Impact and Result

    • Create a training program that delivers smaller amounts of information on a more frequent basis to minimize effort, reduce end-user training fatigue, and improve content relevance.
    • Evaluate and improve your security awareness and training program continuously to keep its content up-to-date. Leverage end-user feedback to ensure content remains relevant to those who receive it.

    Develop a Security Awareness and Training Program That Empowers End Users Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should develop a security awareness and training program that empowers end users, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Develop your training program

    Create or mature a security awareness and training program that is tailored to your organization.

    • Develop a Security Awareness and Training Program That Empowers End Users – Phase 1: Develop Your Training Program
    • Security Awareness and Training Program Development Tool
    • End-User Security Job Description Template
    • Training Materials – Physical Computer Security
    • Training Materials – Cyber Attacks
    • Training Materials – Incident Response
    • Training Materials – Mobile Security
    • Training Materials – Passwords
    • Training Materials – Phishing
    • Training Materials – Social Engineering
    • Training Materials – Web Usage
    • Security Awareness and Training Vendor Evaluation Tool
    • Security Awareness and Training Metrics Tool
    • End-User Security Knowledge Test Template
    • Security Training Campaign Development Tool

    2. Design an effective training delivery plan

    Explore methods of training delivery and select the most effective solutions.

    • Develop a Security Awareness and Training Program That Empowers End Users – Phase 2: Design an Effective Training Delivery Plan
    • Information Security Awareness and Training Policy
    • Security Awareness and Training Gamification Guide
    • Mock Spear Phishing Email Examples
    • Security Training Email Templates
    • Security Awareness and Training Module Builder and Training Schedule
    • Security Training Campaign Development Tool
    • Security Training Program Manual
    • Security Awareness and Training Feedback Template
    • Security Awareness Month Week 1: Staying in Touch
    • Security Awareness Month Week 2: Sharing Special Moments
    • Security Awareness Month Week 3: Working and Networking
    • Security Awareness Month Week 4: Families and Businesses
    [infographic]

    Workshop: Develop a Security Awareness and Training Program That Empowers End Users

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Outline the Plan for Long-term Program Improvement

    The Purpose

    Identify the maturity level of the existing security awareness and training program and set development goals.

    Establish program milestones and outline key initiatives for program development.

    Identify metrics to measure program effectiveness.

    Key Benefits Achieved

    Identified the gaps between the current maturity level of the security awareness and training program and future target states.

    Activities

    1.1 Create a program development plan.

    1.2 Investigate and select metrics to measure program effectiveness.

    1.3 Execute some low-hanging fruit initiatives for collecting metrics: e.g. create a knowledge test, feedback survey, or gamification guide.

    Outputs

    Customized development plan for program.

    Tool for tracking metrics.

    Customized knowledge quiz ready for distribution.

    Customized feedback survey for training.

    Gamification program outline.

    2 Identify and Assess Audience Groups and Security Training Topics

    The Purpose

    Determine the unique audience groups within your organization and evaluate their risks and vulnerabilities.

    Prioritize training topics and audience groups to effectively streamline program development.

    Key Benefits Achieved

    Created a comprehensive list of unique audience groups and the corresponding security training that each group should receive.

    Determined priority ratings for both audience groups and the security topics to be delivered.

    Activities

    2.1 Identify the unique audience groups within your organization and the threats they face.

    2.2 Determine the priority levels of the current security topics.

    2.3 Review audience groups and determine which topics need to be delivered to each group.

    Outputs

    Risk profile for each identified audience group.

    Priority scores for all training topics.

    List of relevant security topics for each identified audience group.

    3 Plan the Training Delivery

    The Purpose

    Identify all feasible delivery channels for security training within your organization.

    Build a vendor evaluation tool and shortlist or harvest materials for in-house content creation.

    Key Benefits Achieved

    List of all potential delivery mechanisms for security awareness and training.

    Built a vendor evaluation tool and discussed a vendor shortlist.

    Harvested a collection of free online materials for in-house training development.

    Activities

    3.1 Discuss potential delivery mechanisms for training, including the purchase and use of a vendor.

    3.2 If selecting a vendor, review vendor selection criteria and discuss potential vendor options.

    3.3 If creating content in-house, review and select available resources on the web.

    Outputs

    List of available delivery mechanisms for training.

    Vendor assessment tool and shortlist.

    Customized security training presentations.

    4 Create a Training Schedule for Content Deployment

    The Purpose

    Create a plan for deploying a pilot program to gather valuable feedback.

    Create an ongoing training schedule.

    Define the end users’ responsibilities towards security within the organization.

    Key Benefits Achieved

    Created a plan to deploy a pilot program.

    Created a schedule for training deployment.

    Defined role of end users in helping protect the organization against security threats.

    Activities

    4.1 Build training modules.

    4.2 Create an ongoing training schedule.

    4.3 Define and document your end users’ responsibilities towards their security.

    Outputs

    Documented modular structure to training content.

    Training schedule.

    Security job description template.

    End-user training policy.

    Enterprise Application Selection and Implementation

    • Buy Link or Shortcode: {j2store}29|cart{/j2store}
    • Related Products: {j2store}29|crosssells{/j2store}
    • member rating overall impact: 9.0/10
    • member rating average dollars saved: $37,356
    • member rating average days saved: 34
    • Parent Category Name: Applications
    • Parent Category Link: /applications

    The challenge

    • Large scale implementations are prone to failure. This is probably also true in your company. Typically large endeavors like this overrun the budget, are late to deliver, or are abandoned altogether. It would be best if you manage your risks when starting such a new project.

    Our advice

    Insight

    • Large-scale software implementations continue to fail at very high rates. A recent report by McKinsey & Company estimates that 66% go over budget, 33% over time, and 17% delivered less value than expected. Most companies will survive a botched implementation, but 17% threatened the existence of the company involved.
    • With all the knowledge sharing that we have today with oodles of data at our disposal, we should expect IT-providers to have clear, standardized frameworks to handle these implementations. But projects that overrun by more than 200% still occur more often than you may think.
    • When you solicit a systems integrator (SI), you want to equip yourself to manage the SI and not be utterly dependent on their methodology.

    Impact and results 

    • You can assume proper accountability for the implementation and avoid over-reliance on the systems integrator.
    • Leverage the collective knowledge and advice of additional IT professionals
    • Review the pitfalls and lessons learned from failed integrations.
    • Manage risk at every stage.
    • Perform a self-assessment at various stages of the integration path.

    The roadmap

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    Executive Summary

    Determine the rations for your implementation

    See if a custom-of-the-shelf process optimization makes sense.

    • Storyboard: Govern and Manage an Enterprise Software Implementation (ppt)

    Prepare

    Determine the right (level of) governance for your implementation.

    • Large Software Implementation Maturity Assessment Tool (xls)
    • Project Success Measurement Tool (xls)
    • Risk Mitigation Plan Template (xls)

    Plan and analyze

    Prepare for the overall implementation journey and gather your requirements. Then conduct a stage-gate assessment of this phase.

    • Project Phases Entry and Exit Criteria Checklist Tool (xls)
    • Project Lessons Learned Document (doc)

    Design, build and deploy

    Conduct a stage-gate assessment after every step below.

    • Make exact designs of the software implementation and ensure that all stakeholders and the integrator completely understand.
    • Build the solution according to the requirements and designs.
    • Thoroughly test and evaluate that the implementation meets your business expectations. 
    • Then deploy

    Initiate your roadmap

    Review your dispositions to ensure they align with your goals. 

    • Build an Application Rationalization Framework – Phase 4: Initiate Your Roadmap (ppt)
    • Disposition Prioritization Tool (xls)

    Secure Operations in High-Risk Jurisdictions

    • Buy Link or Shortcode: {j2store}369|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Security Strategy & Budgeting
    • Parent Category Link: /security-strategy-and-budgeting

    Business operations in high-risk areas of the world contend with complex threat environments and risk scenarios that often require a unique response. But traditional approaches to security strategy often miss these jurisdictional risks, leaving organizations vulnerable to threats that range from cybercrime and data breaches to fines and penalties.

    Security leaders need to identify high-risk jurisdictions, inventory critical assets, identify vulnerabilities, assess risks, and identify security controls necessary to mitigate those risks.

    Secure operations and protect critical assets in high-risk regions

    Across risks that include insider threats and commercial surveillance, the two greatest vulnerabilities that organizations face in high-risk parts of the world are travel and compliance. Organizations can make small adjustments to their security program to address these risks:

    1. Support high-risk travel: Put measures and guidelines in place to protect personnel, data, and devices before, during, and after employee travel.
    2. Mitigate compliance risk: Consider data residency requirements, data breach notification, cross-border data transfer, and third-party risks to support business growth.

    Using these two prevalent risk scenarios in high-risk jurisdictions as examples, this research walks you through the steps to analyze the threat landscape, assess security risks, and execute a response to mitigate them.

    Secure Operations in High-Risk Jurisdictions Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Secure Operations in High-Risk Jurisdictions – A step-by-step approach to mitigating jurisdictional security and privacy risks.

    Traditional approaches to security strategy often miss jurisdictional risks. Use this storyboard to make small adjustments to your security program to mitigate security risks in high-risk jurisdictions.

    • Secure Operations in High-Risk Jurisdictions – Phases 1-3

    2. Jurisdictional Risk Register and Heat Map Tool – A tool to inventory, assess, and treat jurisdictional risks.

    Use this tool to track jurisdictional risks, assess the exposure of critical assets, and identify mitigation controls. Use the geographic heatmap to communicate inherent jurisdictional risk with key stakeholders.

    • Jurisdictional Risk Register and Heat Map Tool

    3. Guidelines for Key Jurisdictional Risk Scenarios – Two structured templates to help you develop guidelines for two key jurisdictional risk scenarios: high-risk travel and compliance risk

    Use these two templates to develop help you develop your own guidelines for key jurisdictional risk scenarios. The guidelines address high-risk travel and compliance risk.

    • Digital Safety Guidelines for International Travel
    • Guidelines for Compliance With Local Security and Privacy Laws Template

    Infographic

    Workshop: Secure Operations in High-Risk Jurisdictions

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Identify Context for Risk Assessment

    The Purpose

    Assess business requirements and evaluate security pressures to set the context for the security risk assessment.

    Key Benefits Achieved

    Understand the goals of the organization in high-risk jurisdictions.

    Assess the threats to critical assets in these jurisdictions and capture stakeholder expectations for information security.

    Activities

    1.1 Determine assessment scope.

    1.2 Determine business goals.

    1.3 Determine compliance obligations.

    1.4 Determine risk appetite.

    1.5 Conduct pressure analysis.

    Outputs

    Business requirements

    Security pressure analysis

    2 Analyze Key Risk Scenarios for High-Risk Jurisdictions

    The Purpose

    Build key risk scenarios for high-risk jurisdictions.

    Key Benefits Achieved

    Identify critical assets in high-risk jurisdictions, their vulnerabilities to relevant threats, and the adverse impact should malicious agents exploit them.

    Assess risk exposure of critical assets in high-risk jurisdictions.

    Activities

    2.1 Identify critical assets.

    2.2 Identify threats.

    2.3 Assess risk likelihood.

    2.4 Assess risk impact.

    Outputs

    Key risk scenarios

    Jurisdictional risk exposure

    Jurisdictional Risk Register and Heat Map

    3 Build Risk Treatment Roadmap

    The Purpose

    Prioritize and treat jurisdictional risks to critical assets.

    Key Benefits Achieved

    Build an initiative roadmap to reduce residual risks in high-risk jurisdictions.

    Activities

    3.1 Identify and assess risk response.

    3.2 Assess residual risks.

    3.3 Identify security controls.

    3.4 Build initiative roadmap.

    Outputs

    Action plan to mitigate key risk scenarios

    Further reading

    Secure Operations in High-Risk Jurisdictions

    Assessments often omit jurisdictional risks. Are your assets exposed?

    EXECUTIVE BRIEF

    Analyst Perspective

    Operations in high-risk jurisdictions face unique security scenarios.

    The image contains a picture of Michel Hebert.

    Michel Hébert

    Research Director

    Security and Privacy

    Info-Tech Research Group


    The image contains a picture of Alan Tang.

    Alan Tang

    Principal Research Director

    Security and Privacy

    Info-Tech Research Group


    Traditional approaches to security strategies may miss key risk scenarios that critical assets face in high-risk jurisdictions. These include high-risk travel, heightened insider threats, advanced persistent threats, and complex compliance environments. Most organizations have security strategies and risk management practices in place, but securing global operations requires its own effort. Assess the security risk that global operations pose to critical assets. Consider the unique assets, threats, and vulnerabilities that come with operations in high-risk jurisdictions. Focus on the business activities you support and integrate your insights with existing risk management practices to ensure the controls you propose get the visibility they need. Your goal is to build a plan that mitigates the unique security risks that global operations pose and secures critical assets in high-risk areas. Don’t leave security to chance.

    Executive Summary

    Your Challenge

    • Security leaders who support operations in many countries struggle to mitigate security risks to critical assets. Operations in high-risk jurisdictions contend with complex threat environments and security risk scenarios that often require a unique response.
    • Security leaders need to identify critical assets, assess vulnerabilities, catalog threats, and identify the security controls necessary to mitigate related operational risks.

    Common Obstacles

    • Securing operations in high-risk jurisdictions requires additional due diligence. Each jurisdiction involves a different risk context, which complicates efforts to identify, assess, and mitigate security risks to critical assets.
    • Security leaders need to engage the organization with the right questions and identify high-risk vulnerabilities and security risk scenarios to help stakeholders make an informed decision about how to assess and treat the security risks they face in high-risk jurisdictions.

    Info-Tech’s Approach

    Info-Tech has developed an effective approach to protecting critical assets in high-risk jurisdictions.

    This approach includes tools for:

    • Evaluating the security context of your organization’s high-risk jurisdictions.
    • Identifying security risk scenarios unique to high-risk jurisdictions and assessing the exposure of critical assets.
    • Planning and executing a response.

    Info-Tech Insight

    Organizations with global operations must contend with a more diverse set of assets, threats, and vulnerabilities when they operate in high-risk jurisdictions. Security leaders need to take additional steps to secure operations and protect critical assets.

    Business operations in high-risk jurisdictions face a more complex security landscape

    Information security risks to business operations vary widely by region.

    The 2022 Allianz Risk Barometer surveyed 2,650 business risk specialists in 89 countries to identify the most important risks to operations. The report identified cybercrime, IT failures, outages, data breaches, fines, and penalties as the most important global business risks in 2022, but their results varied widely by region. The standout finding of the 2022 Allianz Risk Barometer is the return of security risks as the most important threat to business operations. Security risks will continue to be acute beyond 2022, especially in Africa, the Middle East, Europe, and the Asia-Pacific region, where they will dwarf risks of supply chain interruptions, natural catastrophe, and climate change.

    Global operations in high-risk jurisdictions contend with more diverse threats. These security risk scenarios are not captured in traditional security strategies.

    The image contains a picture of the world map that has certain areas of the map highlighted in various shades of blue based on higher security-related business risks.

    Figures represent the number of cybersecurity risks business risk specialists selected as a percentage of all business risks (Allianz, 2022). Higher scores indicate jurisdictions with higher security-related business risks. Jurisdictions without data are in grey.

    Different jurisdictions’ commitment to cybersecurity also varies widely, which increases security risks further

    The Global Cybersecurity Index (GCI) provides insight into the commitment of different countries to cybersecurity.

    The index assesses a country’s legal framework to identify basic requirements that public and private stakeholders must uphold and the legal instruments prohibiting harmful actions.

    The 2020 GCI results show overall improvement and strengthening of the cybersecurity agenda globally, but significant regional gaps persist. Of the 194 countries surveyed:

    • 33% had no data protection legislation.
    • 47% had no breach notification measures in place.
    • 50% had no legislation on the theft of personal information.
    • 19% still had no legislation on illegal access.

    Not every jurisdiction has the same commitment to cybersecurity. Protecting critical assets in high-risk jurisdictions requires additional due diligence.

    The image contains a picture of the world map that has certain areas of the map highlighted in various shades of blue based on scores in relation to the Global Security Index.

    The diagram sets out the score and rank for each country that took part in the Global Cybersecurity Index (ITU, 2021)

    Higher scores show jurisdictions with a lower rank on the CGI, which implies greater risk. Jurisdictions without data are in grey.

    Securing critical assets in high-risk jurisdictions requires additional effort

    Traditional approaches to security strategy may miss these key risk scenarios.

    As a result, security leaders who support operations in many countries need to take additional steps to mitigate security risks to critical assets.

    Guide stakeholders to make informed decisions about how to assess and treat the security risks and secure operations.

    • Engage the organization with the right questions.
    • Identify critical assets and assess vulnerabilities.
    • Catalogue threats and build risk scenarios.
    • Identify the security controls necessary to mitigate risks.

    Work with your organization to analyze the threat landscape, assess security risks unique to high-risk jurisdictions, and execute a response to mitigate them.

    This project blueprint works through this process using the two most prevalent risk scenarios in high-risk jurisdictions: high-risk travel and compliance risk.

    Key Risk Scenarios

    • High-Risk Travel
    • Compliance Risk
    • Insider Threat
    • Advanced Persistent Threat
    • Commercial Surveillance
    The image contains a screenshot of an Info-Tech thought model regarding secure global operations in high-risk jurisdictions.

    Travel risk is the first scenario we use as an example throughout the blueprint

    • This project blueprint outlines a process to identify, assess, and mitigate key risk scenarios in high-risk jurisdictions. We use two common key risk scenarios as examples throughout the deck to illustrate how you create and assess your own scenarios.
    • Supporting high-risk travel is the first scenario we will study in-depth as an example. Business growth, service delivery, and mergers and acquisitions can lead end users to travel to high-risk jurisdictions where staff, devices, and data are at risk.
    • Compromised or stolen devices can provide threat actors with access to data that could compromise the organization’s strategic, economic, or competitive advantage or expose the organization to regulatory risk.

    The project blueprint includes template guidance in Phase 3 to help you build and deploy your own travel guidelines to protect critical assets and support end users before they leave, during their trip, and when they return.

    Before you leave

    • Identify high-risk countries.
    • Enable controls.
    • Limit what you pack.

    During your trip

    • Assume you are monitored.
    • Limit access to systems.
    • Prevent theft.

    When you return

    • Change your password.
    • Restore your devices.

    Compliance risk is the second scenario we use as an example

    • Mitigating compliance risk is the second scenario we will study as an example in this blueprint. The legal and regulatory landscape is evolving rapidly to keep step with the pace of technological change. Security and privacy leaders are expected to mitigate the risk of noncompliance as the organization expands to new jurisdictions.
    • Later sections will show how to think through at least four compliance risks, including:
      • Cross-border data transfer
      • Third-party risk management
      • Data breach notification
      • Data residency

    The project blueprint includes template guidance in Phase 3 to help you deploy your own compliance governance controls as a risk mitigation measure.

    Secure Operations in High-Risk Jurisdictions: Info-Tech’s methodology

    1. Identify Context

    2. Assess Risks

    3. Execute Response

    Phase Steps

    1. Assess business requirements
    2. Evaluate security pressures
    1. Identify risks
    2. Assess risk exposure
    1. Treat security risks
    2. Build initiative roadmap

    Phase Outcomes

    • Internal security pressures that capture the governance, policies, practices, and risk tolerance of the organization
    • External security pressures that capture the expectations of customers, regulators, legislators, and business partners
    • A heatmap that captures not only the global exposure of your critical assets but also the business processes they support
    • A security risk register to allow for the easy transfer of critical assets’ global security risk data to your organization’s enterprise risk management practice
    • A roadmap of prioritized initiatives to apply relevant controls and secure global assets
    • A set of key risk indicators to monitor and report your progress

    Blueprint deliverables

    Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

    Business Security Requirements

    Identify the context for the global security risk assessment, including risk appetite and risk tolerance.

    Jurisdictional Risk Register and Heatmap

    Identify critical global assets and the threats they face in high-risk jurisdictions and assess exposure.

    Mitigation Plan

    Roadmap of initiatives and security controls to mitigate global risks to critical assets. Tools and templates to address key security risk scenarios.

    Key deliverable:

    Jurisdictional Risk Register and Heatmap

    Use the Jurisdictional Risk Register and Heatmap Tool to capture information security risks to critical assets in high-risk jurisdictions. The tool generates a world chart that illustrates the risks global operations face to help you engage the business and execute a response.

    Blueprint benefits

    Protect critical assets in high-risk jurisdictions

    IT Benefits

    Assess and remediate information security risk to critical assets in high-risk jurisdictions.

    Easily integrate your risk assessment with enterprise risk assessments to improve communication with the business.

    Illustrate key information security risk scenarios to make the case for action in terms the business understands.

    Business Benefits

    Develop mitigation plans to protect staff, devices, and data in high-risk jurisdictions.

    Support business growth in high-risk jurisdictions without compromising critical assets.

    Mitigate compliance risk to protect your organization’s reputation, avoid fines, and ensure business continuity.

    Quantify the impact of securing global operations

    The tool included with this blueprint can help you measure the impact of implementing the research

    • Use the Jurisdictional Risk Register and Heatmap Tool to describe the key risk scenarios you face, assess their likelihood and impact, and estimate the cost of mitigating measures. Working through the project in this way will help you quantify the impact of securing global operations.
    The image contains a screenshot of Info-Tech's Jurisdictional Risk Register and Heatmap Tool. The image contains a screenshot of the High-Risk Travel Jurisdiction.

    Establish Baseline Metrics

    • Review existing information security and risk management metrics and the output of the tools included with the blueprint.
    • Identify metrics to measure the impact of your risk management efforts. Focus specifically on high-risk jurisdictions.
    • Compare your results with those in your overall security and risk management program.

    ID

    Metric

    Why is this metric valuable?

    How do I calculate it?

    1.

    Overall Exposure – High-Risk Jurisdictions

    Illustrates the overall exposure of critical assets in high-risk jurisdictions.

    Use the Jurisdictional Risk Register and Heatmap Tool. Calculate the impact times the probability rating for each risk. Take the average.

    2.

    # Risks Identified – High-Risk Jurisdictions

    Informs risk tolerance assessments.

    Use the Jurisdictional Risk Register and Heatmap Tool.

    3.

    # Risks Treated – High-Risk Jurisdictions

    Informs residual risk assessments.

    Use the Jurisdictional Risk Register and Heatmap Tool.

    4.

    Mitigation Cost – High-Risk Jurisdictions

    Informs cost-benefit analysis to determine program effectiveness.

    Use the Jurisdictional Risk Register and Heatmap Tool.

    5.

    # Security Incidents – High-Risk Jurisdictions

    Informs incident trend calculations to determine program effectiveness.

    Draw the information from your service desk or IT service management tool.

    6.

    Incident Remediation Cost – High-Risk Jurisdictions

    Informs cost-benefit analysis to determine program effectiveness.

    Estimate based on cost and effort, including direct and indirect cost such as business disruptions, administrative finds, reputational damage, etc.

    7.

    TRENDS: Program Effectiveness – High-Risk Jurisdictions

    # of security incidents over time. Remediation : Mitigation costs over time

    Calculate based on metrics 5 to 7.

    Info-Tech offers various levels of support to best suit your needs.

    DIY Toolkit

    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

    Guided Implementation

    "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

    Workshop

    "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

    Consulting

    "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks are used throughout all four options.

    Guided Implementation

    What does a typical GI on this topic look like?

    Phase 1

    Call #1: Scope project requirements, determine assessment scope, and discuss challenges.

    Phase 2

    Call #2: Conduct initial risk assessment and determine risk tolerance.

    Call #3: Evaluate security pressures in high-risk jurisdictions.

    Call #4: Identify risks in high-risk jurisdictions.

    Call #5: Assess risk exposure.

    Phase 3

    Call #6: Treat security risks in high-risk jurisdictions.

    A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization. A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

    Workshop Overview

    Contact your account representative for more information. workshops@infotech.com 1-888-670-8889

    Days 1

    Days 2-3

    Day 4

    Day 5

    Identify Context

    Key Risk Scenarios

    Build Roadmap

    Next Steps and Wrap-Up (offsite)

    Activities

    1.1.1 Determine assessment scope.

    1.1.2 Determine business goals.

    1.1.3 Identify compliance obligations.

    1.2.1 Determine risk appetite.

    1.2.2 Conduct pressure analysis.

    2.1.1 Identify assets.

    2.1.2 Identify threats.

    2.2.1 Assess risk likelihood.

    2.2.2 Assess risk impact.

    3.1.1 Identify and assess risk response.

    3.1.2 Assess residual risks.

    3.2.1 Identify security controls.

    3.2.2 Build initiative roadmap.

    5.1 Complete in-progress deliverables from previous four days.

    5.2 Set up review time for workshop deliverables and to discuss next steps.

    Deliverables

    1. Business requirements for security risk assessment
    2. Identification of high-risk jurisdictions
    3. Security threat landscape for high-risk jurisdictions
    1. Inventory of relevant threats, critical assets, and their vulnerabilities
    2. Assessment of adverse effects should threat agents exploit vulnerabilities
    3. Risk register with key risk scenarios and heatmap of high-risk jurisdictions
    1. Action plan to mitigate key risk scenarios
    2. Investment and implementation roadmap
    1. Completed information security risk assessment for two key risk scenarios
    2. Risk mitigation roadmap

    No safe jurisdictions

    Stakeholders sometimes ask information security and privacy leaders to produce a list of safe jurisdictions from which to operate. We need to help them see that there are no safe jurisdictions, only relatively risky ones. As you build your security program, deepen the scope of your risk assessments to include risk scenarios critical assets face in different jurisdictions. These risks do not need to rule out operations, but they may require additional mitigation measures to keep staff, data, and devices safe and reduce potential reputational harms.

    Traditional approaches to security strategy often omit jurisdictional risks.

    Global operations must contend with a more complex security landscape. Secure critical assets in high-risk jurisdictions with a targeted risk assessment.

    The two greatest risks are high-risk travel and compliance risk.

    You can mitigate them with small adjustments to your security program.

    Support High-Risk Travel

    When securing travel to high-risk jurisdictions, you must consider personnel safety as well as data and device security. Put measures and guidelines in place to protect them before, during, and after travel.

    Mitigate Compliance Risk

    Think through data residency requirements, data breach notification, cross-border data transfer, and third-party risks to support business growth and mitigate compliance risks in high-risk jurisdictions to protect your organization’s reputation and avoid hefty fines or business disruptions.

    Phase 1

    Identify Context

    This phase will walk you through the following activities:

    • Assess business requirements to understand the goals of the organization’s global operations, as well as its risk governance, policies, and practices.
    • Evaluate jurisdictional security pressures to understand threats to critical assets and capture the expectations of external stakeholders, including customers, regulators, legislators, and business partners, and assess risk tolerance.

    This phase involves the following participants:

    • Business stakeholders
    • IT leadership
    • Security team
    • Risk and Compliance

    Step 1.1

    Assess Business Requirements

    Activities

    1.1.1 Determine assessment scope

    1.1.2 Identify enterprise goals in high-risk jurisdictions

    1.1.3 Identify compliance obligations

    This step involves the following participants:

    • Business stakeholders
    • IT leadership
    • Security team
    • Risk and Compliance

    Outcomes of this step

    • Assess business requirements to understand the goals of the organization’s global operations, as well as its risk governance, policies, and practices.

    Focus the risk assessment on high-risk jurisdictions

    Traditional approaches to information security strategy often miss threats to global operations

    • Successful security strategies are typically sensitive to risks to different IT systems and lines of business.
    • However, securing global operations requires additional focus on high-risk jurisdictions, considering what makes them unique.
    • This first phase of the project will help you evaluate the business context of operations in high-risk jurisdictions, including:
      • Enterprise and security goals.
      • Lines of business, physical locations, and IT systems that need additional oversight.
      • Unique compliance obligations.
      • Unique risks and security pressures.
      • Organizational risk tolerance in high-risk jurisdictions.

    Focus your risk assessment on the business activities security supports in high-risk jurisdictions and the unique threats they face to bridge gaps in your security strategy.

    Identify jurisdictions with higher inherent risks

    Your security strategy may not describe jurisdictional risk adequately.

    • Security strategies list lines of business, physical locations, and IT systems the organization needs to secure and those whose security will depend on a third-party. You can find additional guidance on fixing the scope and boundaries of a security strategy in Phase 1 of Build an Information Security Strategy.
    • However, security risks vary widely from one jurisdiction to another according to:
      • Active cyber threats.
      • Legal and regulatory frameworks.
      • Regional security and preparedness capabilities.
    • Your first task is to identify high-risk jurisdictions to target for additional oversight.

    Work closely with your enterprise risk management function.

    Enterprise risk management functions are often tasked with developing risk assessments from composite sources. Work closely with them to complete your own assessment.

    Countries at heightened risk of money laundering and terrorism financing are examples of high-risk jurisdictions. The Financial Action Task Force and the U.S. Treasury publish reports three times a year that identify Non-Cooperative Countries or Territories.

    Develop a robust jurisdictional assessment

    Design an intelligence collection strategy to inform your assessment

    Strategic Intelligence

    White papers, briefings, reports. Audience: C-Suite, board members

    Tactical Intelligence

    Internal reports, vendor reports. Audience: Security leaders

    Operational intelligence

    Indicators of compromise. Audience: IT Operations

    Operational intelligence focuses on machine-readable data used to block attacks, triage and validate alerts, and eliminate threats from the network. It becomes outdated in a matter of hours and is less useful for this exercise.

    Determine travel risks to bolster your assessments

    Not all locations and journeys will require the same security measures.

    • Travel risks vary significantly according to destination, the nature of the trip, and traveler profile.
    • Access to an up-to-date country risk rating system enables your organization and individual staff to quickly determine the overall level of risk in a specific country or location.
    • Based on this risk rating, you can specify what security measures are required prior to travel and what level of travel authorization is appropriate, in line with the organization's security policy or travel security procedures.
    • While some larger organizations can maintain their own country risk ratings, this requires significant capacity, particularly to obtain the necessary information to keep these regularly updated.
    • It may be more effective for your organization to make use of the travel risk ratings provided by an external security information provider, such as a company linked to your travel insurance or travel booking service, if available.
    • Alternatively, various open-source travel risk ratings are available via embassy travel sites or other website providers.

    Without a flexible system to account for the risk exposures of different jurisdictions, staff may perceive measures as a hindrance to operations.

    Develop a tiered risk rating

    The example below outlines potential risk indicators for high-risk travel.

    Rating

    Description

    Low

    Generally secure with adequate physical security. Low violent crime rates. Some civil unrest during significant events. Acts of terrorism rare. Risks associated with natural disasters limited and health threats mainly preventable.

    Moderate

    Periodic civil unrest. Antigovernment, insurgent, or extremist groups active with sporadic acts of terrorism. Staff at risk from common and violent crime. Transport and communications services are unreliable and safety records are poor. Jurisdiction prone to natural disasters or disease epidemics.

    High

    Regular periods of civil unrest, which may target foreigners. Antigovernment, insurgent, or extremist groups very active and threaten political or economic stability. Violent crime rates high, often targeting foreigners. Infrastructure and emergency services poor. May be regular disruption to transportation or communications services. Certain areas off-limits to foreigners. Jurisdictions experiencing natural disasters or epidemics are considered high risk.

    Extreme

    Undergoing active conflict or persistent civil unrest. Risk of being caught up in a violent incident or attack is very high. Authorities may have lost control of significant portions of the country. Lines between criminality and political and insurgent violence are blurred. Foreigners are likely to be denied access to parts of the country. Transportation and communication services are severely degraded or nonexistent. Violence presents a direct threat to staff security.

    Ratings are formulated by assessing several types of risk, including conflict, political/civil unrest, terrorism, crime, and health and infrastructure risks.

    1.1.1 Determine assessment scope

    1 – 2 hours

    1. As a group, brainstorm a list of high-risk jurisdictions to target for additional assessment. Write down as many items as possible to include in:
    • Lines of business
    • Physical locations
    • IT systems

    Pay close attention to elements of the assessment that are not in scope.

  • Discuss the response and the rationale for targeting each of them for additional risk assessments. Identify security-related concerns for different lines of business, locations, user groups, IT systems, and data.
  • Record your responses and your comments in the Information Security Requirements Gathering Tool.
  • Input

    Output

    • Corporate strategy
    • IT strategy
    • Security strategy
    • Relevant threat intelligence
    • A list of high-risk jurisdictions to focus your risk assessment

    Materials

    Participants

    • Laptop
    • Projector
    • Security team
    • IT leadership
    • Business stakeholders
    • Enterprise Risk Management
    • Compliance
    • Legal

    Download the Information Security Requirements Gathering Tool

    Position your efforts in a business context

    Securing critical assets in high-risk jurisdictions is a business imperative

    • Many companies relegate their information security strategies to their IT department. Aside from the strain the choice places on a department that already performs many different functions, it wrongly implies that mitigating information security risk is simply an IT problem.
    • Managing information security risks is a business problem. It requires that organizations identify their risk appetite, prioritize relevant threats, and define risk mitigation initiatives. Business leaders can only do these activities effectively in a context that recognizes the business and financial benefits of implementing protections.
    • This is notably true of businesses with operations in many different countries. Each jurisdiction has its own set of security risks the organization must account for, as well as unique local laws and regulations that affect business operations.
    • In high-risk jurisdictions, your efforts must consider the unique operational challenges your organization may not face in its home country. Your efforts to secure critical assets will be most successful if you describe key risk scenarios in terms of their impact on business goals.
    • You can find additional guidance on assessing the business context of a security strategy in Phase 1 of Build an Information Security Strategy.

    Do you understand the unique business context of operations in high-risk jurisdictions?

    1.1.2 Identify business goals

    Estimated Time: 1-2 hours

    1. As a group, brainstorm the primary and secondary business goals of the organization. Focus your assessment on operations in high-risk jurisdictions you identified in Exercise 1.1.1. Review:
    • Relevant corporate and IT strategies.
    • The business goal definitions and indicator metrics in tab 2, “Goals Definition,” of the Information Security Requirements Gathering Tool.
  • Limit business goals to no more than two primary goals and three secondary goals. This limitation will help you prioritize security initiatives at the end of the project.
  • For each business goal, identify up to two security alignment goals that will support business goals in high-risk jurisdictions.
  • Input

    Output

    • Corporate strategy
    • IT strategy
    • Security strategy
    • Your goals for the security risk assessment for high-risk jurisdictions

    Materials

    Participants

    • Laptop
    • Projector
    • Security team
    • IT leadership
    • Business stakeholders
    • Risk Management
    • Compliance
    • Legal

    Download the Information Security Requirements Gathering Tool

    Record business goals

    Capture the results in the Information Security Requirements Gathering Tool

    1. Record the primary and secondary business goals you identified in tab 3, “Goals Cascade,” of the Information Security Requirements Gathering Tool.
    2. Next, record the two security alignment goals you selected for each business goal based on the tool’s recommendations.
    3. Finally, review the graphic diagram that illustrates your goals on tab 6, “Results,” of the Information Security Requirements Gathering Tool.
    4. Revisit this exercise whenever operations expands to a new jurisdiction to capture how they contribute to the organization’s mission and vision and how the security program can support them.
    The image contains a screenshot of Tab 3, Goals Cascade.

    Tab 3, Goals Cascade

    The image contains a screenshot of Tab 6, Results.

    Tab 6, Results

    Analyze business goals

    Assess how operating in multiple jurisdictions adds nuance to your business goals

    • Security leaders need to understand the direction of the business to propose relevant security initiatives that support business goals in high-risk jurisdictions.
    • Operating in different jurisdictions carries its own degree of risk. The organization is subject not only to the information security risks and legal frameworks of its country of origin but also to those associated with international jurisdictions.
    • You need to understand where your organization operates and how these different jurisdictions contribute to your business goals to support their performance and protect the firm’s reputation.
    • This exercise will make an explicit link between security and privacy concerns in high-risk jurisdictions, what the business cares about, and what security is trying to accomplish.

    If the organization is considering a merger and acquisition project that will expand operations in jurisdictions with different travel risk profiles, the security organization needs to revise the security strategy to ensure the organization can support high-risk travel and mitigate risks to critical assets.

    Identify compliance obligations

    Data compliance obligations loom large in high-risk jurisdictions

    The image contains four hexagons, each with their own words. SOX, PCI DSS, HIPAA, HITECH.

    Security leaders are familiar with most conventional regulatory obligations that govern financial, personal, and healthcare data in North America and Europe.

    The image contains four hexagons, each with their own words. Residency, Cross-Border Transfer, Breach Notification, Third-Party Risk Mgmt.

    Data privacy concerns, nationalism, and the economic value of data are all driving jurisdictions to adopt data residency and data localization and to shut down the cross-border transfer of data.

    The next step requires you to consider the compliance obligations the organization needs to meet to support the business as it expands to other jurisdictions through natural growth, mergers, and acquisitions.

    1.1.3 Identify compliance obligations

    Estimated Time: 1-2 hours

    1. As a group, brainstorm compliance obligations in target jurisdictions. Focus your assessment on operations in high-risk jurisdictions.
    2. Include:

    • Laws
    • Governing regulations
    • Industry standards
    • Contractual agreements
  • Record your compliance obligations and comments on tab 4, “Compliance Obligations,” of the Information Security Requirements Gathering Tool.
  • If you need to take full stock of the laws and regulations in place in the jurisdictions where you operate that you are not familiar with, consider seeking local legal counsel to help you navigate this exercise.
  • Input

    Output

    • Legal and compliance frameworks in target jurisdictions
    • Mandatory and voluntary compliance obligations for target jurisdictions

    Materials

    Participants

    • Laptop
    • Projector
    • Security team
    • IT leadership
    • Business stakeholders
    • Risk Management
    • Compliance
    • Legal

    Download the Information Security Requirements Gathering Tool

    Step 1.2

    Evaluate Security Pressures

    Activities

    1.2.1 Conduct initial risk assessment

    1.2.2 Conduct pressure analysis

    1.2.3 Determine risk tolerance

    This step involves the following participants:

    • Security team
    • Risk and Compliance
    • IT leadership (optional)

    Outcomes of this step

    Identify threats to global assets and capture the security expectations of external stakeholders, including customers, regulators, legislators, and business partners, and determine risk tolerance.

    Evaluate security pressures to set the risk context

    Perform an initial assessment of high-risk jurisdictions to set the context.

    Assess:

    • The threat landscape.
    • The security pressures from key stakeholders.
    • The risk tolerance of your organization.

    You should be able to find the information in your existing security strategy. If you don’t have the information, work through the next three steps of the project blueprint.

    The image contains a diagram to demonstrate evaluating security pressures, as described in the text above.

    Some jurisdictions carry inherent risks

    • Jurisdictional risks stem from legal, regulatory, or political factors that exist in different countries or regions. They can also stem from unexpected legal changes in regions where critical assets have exposure. Understanding jurisdictional risks is critical because they can require additional security controls.
    • Jurisdictional risk tends to be higher in jurisdictions:
      • Where the organization:
        • Conducts high-value or high-volume financial transactions.
        • Supports and manages critical infrastructure.
        • Has high-cost data or data whose compromise could undermine competitive advantage.
        • Has a high percentage of part-time employees and contractors.
        • Experiences a high rate of employee turnover.
      • Where state actors:
        • Have a low commitment to cybersecurity, financial, and privacy legislation and regulation.
        • Support cybercrime organizations within their borders.

    Jurisdictional risk is often reduced to countries where money laundering and terrorist activities are high. In this blueprint, the term refers to the broader set of information security risks that arise when operating in a foreign country or jurisdiction.

    Five key risk scenarios are most prevalent

    Key Risk Scenarios

    • High-Risk Travel
    • Compliance Risk
    • Insider Threat
    • Advanced Persistent Threat
    • Commercial Surveillance

    Security leaders who support operations in many countries need to take additional steps to mitigate security risks to critical assets. The goal of the next two exercises is to analyze the threat landscape and security pressures unique to high-risk jurisdictions, which will inform the construction of key scenarios in Phase 2. These five scenarios are most prevalent in high-risk jurisdictions. Keep them in mind as you go through the exercises in this section.

    1.2.1 Assess jurisdictional risk

    1-3 hours

    1. As a group, review the questions on tab 2, “Risk Assessment,” of the Information Security Pressure Analysis Tool.
    2. Gather the required information from subject matter experts on the following risk elements with a focus on high-risk jurisdictions:
    3. Review each question in tab 2 of the Information Security Pressure Analysis Tool and select the most appropriate response.

    Input

    Output

    • Existing security strategy
    • List of organizational assets
    • Historical data on information security incidents
    • Completed risk assessment

    Materials

    Participants

    • Information Security Pressure Analysis Tool
    • Security team
    • IT leadership
    • Risk Management

    For more information on how to complete the risk assessment questionnaire, see Step 1.2.1 of Build an Information Security Strategy.

    1.2.2 Conduct pressure analysis

    1-3 hours

    1. As a group, review the questions on tab 3, “Pressure Analysis,” of the Information Security Pressure Analysis Tool.
    2. Gather the required information from subject matter experts on the following pressure elements with a focus on high-risk jurisdictions:
    • Compliance and oversight
    • Customer expectations
    • Business expectations
    • IT expectations
  • Review each question in the questionnaire and provide the most appropriate response using the drop-down list. It may be helpful to consult with the appropriate departments to obtain their perspectives.
  • For more information on how to complete the pressure analysis questionnaire, see Step 1.3 of Build an Information Security Strategy.

    Input

    Output

    • Information on various pressure elements within the organization
    • Existing security strategy
    • Completed pressure analysis

    Materials

    Participants

    • Information Security Pressure Analysis Tool
    • Security team
    • IT leadership
    • Business leaders
    • Compliance

    A low security pressure means that your stakeholders do not assign high importance to information security. You may need to engage stakeholders with the right key risk scenarios to illustrate jurisdictional risk and generate support for new security controls.

    Download the Information Security Pressure Analysis Tool

    Assess risk tolerance

    • Risk tolerance expresses the types and amount of risk the organization is willing to accept in pursuit of its goals.
    • These expectations can help you identify, manage, and report on key risk scenarios in high-risk jurisdictions.
    • For instance, an organization with a low risk tolerance will require a stronger information security program to minimize operational security risks.
    • It’s up to business leaders to determine the risks they are willing to accept. They may need guidance to understand how system-level risks affect the organization’s ability to pursue its goals.

    A formalized risk tolerance statement can help:

    • Support risk-based security decisions that align with business goals.
    • Provide a meaningful rationale for security initiatives.
    • Improve the transparency of investments in the organization’s security program.
    • Provide guidance for monitoring inherent risk and residual risk exposure.

    The role of security professionals is to identify and analyze key risk scenarios that may prevent the organization from reaching its goals.

    1.2.3 Determine risk tolerance

    1-3 hours

    1. As a group, review the questions on tab 4, “Risk Tolerance,” of the Information Security Pressure Analysis Tool.
    2. Gather the required information from subject matter experts on the following risk tolerance elements:
    • Recent IT problems, especially downtime and data recovery issues
    • Historical security incidents
  • Review any relevant documentation, including:
    • Existing security strategy
    • Business impact assessments
    • Service-level agreements

    For more information on how to complete the risk tolerance questionnaire, see Step 1.4 of Build an Information Security Strategy.

    Input

    Output

    • Existing security strategy
    • Data on recent IT problems and incidents
    • Business impact assessments
    • Completed risk tolerance statement

    Materials

    Participants

    • Information Security Pressure Analysis Tool
    • Security team
    • IT leadership
    • Risk Management

    Download the Information Security Pressure Analysis Tool

    Review the output of the results tab

    • The organizational risk assessment provides a high-level assessment of inherent risks in high-risk jurisdictions. Use the results to build and assess key risk scenarios in Phase 2.
    • Use the security pressure analysis to inform stakeholder management efforts. A low security pressure indicates that stakeholders do not yet grasp the impact of information security on organizational goals. You may need to communicate its importance before you discuss additional security controls.
    • Jurisdictions in which organizations have a low risk tolerance will require stronger information security controls to minimize operational risks.
    The image contains a screenshot of the organizational risk assessment. The image contains a screenshot of the security pressure analysis. The image contains a screenshot of the risk tolerance curve.

    Phase 2

    Assess Security Risks to Critical Assets

    This phase will walk you through the following activities:

    • Identify critical assets, their vulnerabilities to relevant threats, and the adverse impact a successful threat event would have on the organization.
    • Assess risk exposure of critical assets in high-risk jurisdictions for each risk scenario through an analysis of its likelihood and impact.

    This phase involves the following participants:

    • Security team
    • Risk and Compliance
    • IT leadership (optional)

    Step 2.1

    Identify Risks

    Activities

    2.1.1 Identify assets

    2.1.2 Identify threats

    This step involves the following participants:

    • Security team
    • Risk and Compliance
    • IT leadership (optional)

    Outcomes of this step

    • Define risk scenarios that identify critical assets, their vulnerabilities to relevant threats, and the adverse impact a successful threat event would have on the organization.

    This blueprint focuses on mitigating jurisdictional risks

    The image contains a screenshot of the IT Risk Management Framework. The framework includes: Risk Identification, Risk Assessment, Risk Response, and Risk Governance.

    For a deeper dive into building a risk management program, see Info-Tech’s core project blueprints on risk management:

    Build an IT Risk Management Program

    Combine Security Risk Management Components Into One Program

    Draft key risk scenarios to illustrate adverse events

    Risk scenarios help decision-makers understand how adverse events affect business goals.

    • Risk-scenario building is the process of identifying the critical factors that contribute to an adverse event and crafting a narrative that describes the circumstances and consequences if it were to happen.
    • Risk scenarios set up the risk analysis stage of the risk assessment process. They are narratives that describe in detail:
      • The asset at risk.
      • The threat that can act against the asset.
      • Their intent or motivation.
      • The circumstances and threat actor model associated with the threat event.
      • The potential effect on the organization.
      • When or how often the event might occur.

    Risk scenarios are further distilled into a single sentence or risk statement that communicates the essential elements from the scenario.

    Well-crafted risk scenarios have four components

    The second phase of the project will help you craft meaningful risk scenarios

    Threat

    Exploits an

    Asset

    Using a

    Method

    Creating an

    Effect

    An actor capable of harming an asset

    Anything of value that can be affected and results in loss

    Technique an actor uses to affect an asset

    How loss materializes

    Examples: Malicious or untrained employees, cybercriminal groups, malicious state actors

    Examples: Systems, regulated data, intellectual property, people

    Examples: Credential compromise, privilege escalation, data exfiltration

    Examples: Loss of data confidentiality, integrity, or availability; impact on staff health & safety

    Risk scenarios are concise, four to six sentence narratives that describe the core elements of forecasted adverse events. Use them to engage stakeholders with the right questions and guide them to make informed decisions about how to address and treat security risks in high-risk jurisdictions.

    The next slides review five key risk scenarios prevalent in high-risk jurisdictions. Use them as examples to develop your own.

    Travel to high-risk jurisdictions requires special measures to protect staff, devices, and data

    Governmental, academic, and commercial advisors compile lists of jurisdictions that pose greater travel risks annually.

    For instance, in the US, these lists might include countries that are:

    • Subjects of travel warnings by the US Department of State.
    • Identified as high risk by other US government sources such as:
      • The Department of the Treasury Office of Foreign Assets Control (OFAC).
      • The Federal Bureau of Investigation (FBI).
      • The Office of the Director of National Intelligence (ODNI).
    • Compiled from academic and commercial sources, such as Control Risks.

    When securing travel to high-risk jurisdictions, you must consider personnel safety as well as data and device security.

    The image contains a diagram to present high-risk jurisdictions.

    The diagram presents high-risk jurisdictions based on US governmental sources (2021) listed on this slide.

    High-risk travel

    Likelihood: Medium

    Impact: Medium

    Key Risk Scenario #1

    Malicious state actors, cybercriminals, and competitors can threaten staff, devices, and data during travel to high-risk jurisdictions. Device theft or compromise may occur while traveling through airports, accessing hotel computer and phone networks, or in internet cafés or other public areas. Threat actors can exploit data from compromised or stolen devices to undermine the organization’s strategic, economic, or competitive advantage. They can also infect compromised devices with malware that delivers malicious payloads once they reconnect with home networks.

    Threat Actor:

    • Malicious state actors
    • Cybercriminals
    • Competitors

    Assets:

    • Staff
    • IT systems
    • Sensitive data

    Effect:

    • Compromised staff health and safety
    • Loss of data
    • Lost of system integrity

    Methods:

    • Identify, steal, or target mobile devices.
    • Compromise network, wireless, or Bluetooth connections.
    • Leverage stolen devices as a means of infecting other networks.
    • Access devices to track user location.
    • Activate microphones on devices to collect information.
    • Intercept electronic communications users send from high-risk jurisdictions.

    The data compliance landscape is a jigsaw puzzle of data protection and data residency requirements

    Since the EU passed the GDPR in 2016, jurisdictions have turned to data regulations to protect citizen data

    Data privacy concerns, nationalism, and the economic value of data are all driving jurisdictions to adopt data residency, breach notification, and cross-border data transfer regulations. As 2021 wound down to a close, nearly all the world’s 30 largest economies had some form of data regulation in place. The regulatory landscape is shifting rapidly, which complicates operations as organizations grow into new markets or engage in merger and acquisition activities.

    Global operations require special attention to data-residency requirements, data breach notification requirements, and cross-border data transfer regulations to mitigate compliance risk.

    The image contains a diagram to demonstrate the data regulations placed in various places around the world.

    Compliance risk

    Likelihood: Medium

    Impact: High

    Key Risk Scenario #2

    Rapid changes in the privacy and security regulatory landscape threaten organizations’ ability to meet their compliance obligations from local legal and regulatory frameworks. Organizations risk reputational damage, administrative fines, criminal charges, and loss of market share. In extreme cases, organizations may lose their license to operate in high-risk jurisdictions. Shifts in the regulatory landscape can involve additional requirements for data residency, cross-border data transfer, data breach notification, and third-party risk management.

    Threat Actor:

    • Local, regional, and national state actors

    Asset:

    • Reputation, market share
    • License to operate

    Effect:

    • Administrative fines
    • Loss of reputation, brand trust, and consumer loyalty
    • Loss of market share
    • Suspension of business operations
    • Lawsuits due to collective actions and claims
    • Criminal charges

    Methods:

    • Shifts in the privacy and security regulatory landscape, including requirements for:
      • Data residency.
      • Cross-border data transfer.
      • Data breach notification.
      • Third-party security and privacy risk management.

    The incidence of insider threats varies widely by jurisdiction in unexpected ways

    On average, companies in North America, the Middle East, and Africa had the most insider incidents in 2021, while those in the Asia-Pacific region had the least.

    The Ponemon Institute set out to understand the financial consequences that result from insider threats and gain insight into how well organizations are mitigating these risks.

    In the context of this research, insider threat is defined as:

    • Employee or contractor negligence.
    • Criminal or malicious insider activities.
    • Credential theft (imposter risk).

    On average, the total cost to remediate insider threats in 2021 was US$15.4 million per incident.

    In all regions, employee or contractor negligence occurred most frequently. Organizations in North America and in the Middle East and Africa were most likely to experience insider threat incidents in 2021.

    the image contains a diagram of the world, with various places coloured in different shades of blue.

    The diagram represents the average number of insider incidents reported per organization in 2021. The results are analyzed in four regions (Ponemon Institute, 2022)

    Insider threat

    Likelihood: Low to Medium

    Impact: High

    Key Risk Scenario #3

    Malicious insiders, negligent employees, and credential thieves can exploit inside access to information systems to commit fraud, steal confidential or commercially valuable information, or sabotage computer systems. Insider threats are difficult to identify, especially when security is geared toward external threats. They are often familiar with the organization’s data and intellectual property as well as the methods in place to protect them. An insider may steal information for personal gain or install malicious software on information systems. They may also be legitimate users who make errors and disregard policies, which places the organization at risk.

    Threat Actor:

    • Malicious insiders
    • Negligent employees
    • Infiltrators

    Asset:

    • Sensitive data
    • Employee credentials
    • IT systems

    Effects:

    • Loss of system integrity
    • Loss of data confidentiality
    • Financial loss

    Methods:

    • Infiltrators may compromise credentials.
    • Malicious or negligent insiders may use corporate email to steal or share sensitive data, including:
      • Regulated data.
      • Intellectual property.
      • Critical business information.
    • Malicious agents may facilitate data exfiltration, as well as open-port and vulnerability scans.

    The risk of advanced persistent threats is more prevalent in Central and South America and the Asia-Pacific region

    Attacks from advanced persistent threat (APT) actors are more sophisticated than traditional ones.

    • More countries will use legal indictments as part of their cyber strategy. Exposing toolsets of APT groups carried out at the governmental level will drive more states to do the same.
    • Expect APTs to increasingly target network appliances like VPN gateways as organizations continue to sustain hybrid workforces.
    • The line between APTs and state-sanctioned ransomware groups is blurring. Expect cybercriminals to wield better tools, mount more targeted attacks, and use double-extortion tactics.
    • Expect more disruption and collateral damage from direct attacks on critical infrastructure.

    Top 10 Significant Threat Actors:

    • Lazarus
    • DeathStalker
    • CactusPete
    • IAmTheKing
    • TransparentTribe
    • StrongPity
    • Sofacy
    • CoughingDown
    • MuddyWater
    • SixLittleMonkeys

    Top 10 Targets:

    • Government
    • Banks
    • Financial Institutions
    • Diplomatic
    • Telecommunications
    • Educational
    • Defense
    • Energy
    • Military
    • IT Companies
    The image contains a world map coloured in various shades of blue.
    Top 12 countries targeted by APTs (Kaspersky, 2020)

    Track notable APTs to revise your list of high-risk jurisdictions and review the latest tactics and techniques

    Governmental advisors track notable APT actors that pose greater risks.

    The CISA Shields Up site, SANS Storm Center site, and MITRE ATT&CK group site provide helpful and timely information to understand APT risks in different jurisdictions.

    The following threat actors are currently associated with cyberattacks affiliated with the Russian government.

    Activity Group

    Risks

    APT28 (GRU)

    Known as Fancy Bear, this threat group has been tied to espionage since 2004. They compromised the Hillary Clinton campaign, amid other major events.

    APT29 (SVT)

    Tied to espionage since 2008. Reportedly compromised the Democratic National Committee in 2015. Cited in the 2021 SolarWinds compromise.

    Buhtrap/RTM Group

    Group focused on financial targets since 2014. Currently known to target Russian and Ukrainian banks.

    Gamaredon

    Operating in Crimea. Aligned with Russian interests. Has previously targeted Ukrainian government officials and organizations.

    DEV-0586

    Carried out wiper malware attacks on Ukrainian targets in January 2022.

    UNC1151

    Active since 2016. Linked to information operation campaigns and the distribution of anti-NATO material.

    Conti

    Most successful ransomware gang of 2021, with US$188M revenue. Supported Russian invasion of Ukraine, threatening attacks on allied critical infrastructure.

    Sources: MITRE ATT&CK; Security Boulevard, 2022; Reuters, 2022; The Verge, 2022

    Advanced persistent threat

    Likelihood: Low to Medium

    Impact: High

    Key Risk Scenario #4

    Advanced persistent threats are state actors or state-sponsored affiliates with the means to avoid detection by anti-malware software and intrusion detection systems. These highly-skilled and persistent malicious agents have significant resources with which to bypass traditional security controls, establish a foothold in the information technology infrastructure, and exfiltrate data undetected. APTs have the resources to adapt to a defender’s efforts to resist them over time. The loss of system integrity and data confidentiality over time can lead to financial losses, business continuity disruptions, and the destruction of critical infrastructure.

    Threat Actor:

    • State actors
    • State-sponsored affiliates

    Asset:

    • Sensitive data
    • IT systems
    • Critical infrastructure

    Effects:

    • Loss of system integrity
    • Loss of data confidentiality
    • Financial loss
    • Business continuity disruptions
    • Infrastructure destruction

    Methods:

    • Persistent, consistent attacks using the most advanced threats and tactics to bypass security defenses.
    • The goal of APTs is to maintain access to networks for prolonged periods without being detected.
    • The median dwell time differs widely between regions. FireEye reported the mean dwell time for 2018:
      • Americas: 71 days
      • Europe, Middle East, and Africa: 177 days
      • Asia-Pacific: 204 days
    Sources: Symantec, 2011; FireEye, 2019

    Threat agents have deployed invasive technology for commercial surveillance in at least 76 countries since 2015

    State actors and their affiliates purchased and used invasive spyware from companies in Europe, Israel, and the US.

    • “Customers are predominantly repressive regimes looking for new ways to control the flow of information and stifle dissent. Less than 10% of suspected customers are considered full democracies by the Economist Intelligence Unit.” (Top10VPN, 2021)
    • Companies based in economically developed and largely democratic states are profiting off the technology.
    • The findings demonstrate the need to consider geopolitical realities when assessing high-risk jurisdictions and to take meaningful action to increase layered defenses against invasive malware.
    • Spyware is having an increasingly well-known impact on civil society. For instance, since 2016, over 50,000 individual phone numbers have been identified as potential targets by NSO Group, the Israeli manufacturers of the notorious Pegasus Spyware. The target list contained the phone numbers of politicians, journalists, activists, doctors, and academics across the world.
    • The true number of those affected by spyware is almost impossible to determine given that many fall victim to the technology and do not notice.
    The image contains a map of the world with various countries highlighted in shades of blue.

    Countries where commercial surveillance tools have been deployed (“Global Spyware Market Index,” Top10VPN, 2021)

    The risks and effects of spyware vary greatly

    Spyware can steal mundane information, track a user’s every move, and everything in between.

    Adware

    Software applications that display advertisements while the program is running.

    Keyboard Loggers

    Applications that monitor and record keystrokes. Malicious agents use them to steal credentials and sensitive enterprise data.

    Trojans

    Applications that appear harmless but inflict damage or data loss to a system.

    Mobile Spyware

    Surveillance applications that infect mobile devices via SMS or MMS channels, though the most advanced can infect devices without user input.

    State actors and their affiliates use system monitors to track browsing habits, application usage, and keystrokes and capture information from devices’ GPS location data, microphone, and camera. The most advanced system monitor spyware, such as NSO Group’s Pegasus, can infect devices without user input and record conversations from end-to-end encrypted messaging systems.

    Commercial surveillance

    Likelihood: Low to Medium

    Impact: Medium

    Key Risk Scenario #5

    Malicious agents can deploy malware on end-user devices with commercial tools available off the shelf to secretly monitor the digital activity of users. Attacks exploit widespread vulnerabilities in telecommunications protocols. They occur through email and text phishing campaigns, malware embedded in untested applications, and sophisticated zero-click attacks that deliver payloads without requiring user interactions. Attacks target sensitive as well as mundane information. They can be used to track employee activities, investigate criminal activity, or steal credentials, credit card numbers, or other personally identifiable information.

    Threat Actor:

    • State actors
    • State-sponsored affiliates

    Asset:

    • Sensitive data
    • Staff health and safety
    • IT systems

    Effects:

    • Data breaches
    • Loss of data confidentiality
    • Increased risk to staff health and safety
    • Misuse of private data
    • Financial loss

    Methods:

    • Email and text phishing attacks that delivery malware payloads
    • Sideloading untested applications from a third-party source rather than an official retailer
    • Sophisticated zero-click attacks that deliver payloads without requiring user interaction

    Use the Jurisdictional Risk Register and Heatmap Tool

    The tool included with this blueprint can help you draft risk scenarios and risk statements in this section.

    The risk register will capture a list of critical assets and their vulnerabilities, the threats that endanger them, and the adverse effect your organization may face.

    The image includes two screenshots of the jurisdictional risk register and heatmap tool. The image contains a screenshot of the High-Risk Travel Jurisdiction.

    Download the Jurisdictional Risk Register and Heatmap Tool

    2.1.1 Identify assets

    1 – 2 hours

    1. As a group, consider critical or mission-essential functions in high-risk jurisdictions and the systems on which they depend. Brainstorm a list of the organization’s mission-supporting assets in high-risk jurisdictions. Consider:
    • Staff
    • Critical IT systems
    • Sensitive data
    • Critical operational processes
  • On a whiteboard, brainstorm the potential adverse effect of malicious agents in high-risk jurisdictions compromising critical assets. Consider the impact on:
    • Information systems.
    • Sensitive or regulated data.
    • Staff health and safety.
    • Critical operations and objectives.
    • Organizational finances.
    • Reputation and brand loyalty

    Threat

    Exploits an

    Asset

    Using a

    Method

    Creating an

    Effect

    Inputs for risk scenario identification

    Input

    Output

    • Corporate strategy
    • IT strategy
    • Security strategy
    • Business impact analyses
    • A list of the organization’s mission-supporting assets

    Materials

    Participants

    • Laptop
    • Projector
    • Whiteboard
    • Security team
    • IT leadership
    • System owner
    • Enterprise Risk Management

    Threat

    Exploits an

    Asset

    Using a

    Method

    Creating an

    Effect

    Inputs for risk scenario identification

    The image contains an example of the activity mentioned in the text above.

    Model threats to narrow the range of scenarios

    Motives and capabilities to perform attacks on critical assets vary across different threat actors.

    Category

    Actions

    Motivation

    Sophistication

    Nation-states

    Cyberespionage, cyberattacks

    Geopolitical

    High. Dedicated resources and personnel, extensive planning and coordination.

    Proxy organizations

    Espionage, destructive attacks

    Geopolitical, Ideological, Profit

    Moderate. Some planning and support functions and technical expertise.

    Cybercrime

    Theft, fraud, extortion

    Profit

    Moderate. Some planning and support functions and technical expertise.

    Hacktivists

    Disrupt operations, attack brands, release sensitive data

    Ideological

    Low. Rely on widely available tools that require little skill to deploy.

    Insiders

    Destruction or release of sensitive data, theft, exposure through negligence

    Incompetence, Discontent

    Internal access. Acting on their own or in concert with any of the above.

    • Criminals, hacktivists, and insiders vary in sophistication. Some criminal groups demonstrate a high degree of sophistication; however, a large cyber event that damages critical infrastructure does not align with their incentives to make money at minimal risk.
    • Proxy actors conduct offensive cyber operations on behalf of a beneficiary. They may be acting on behalf of a competitor, national government, or group of individuals.
    • Nation-states engage in long-term espionage and offensive cyber operations that support geopolitical and strategic policy objectives.

    2.1.2 Identify threats

    1 – 2 hours

    1. Review the outputs from activity 1.1.1 and activity 2.1.1.
    2. Identify threat agents that could undermine the security of critical assets in high-risk jurisdictions. Include internal and external actors.
    3. Assess their motives, means, and opportunities.
    • Which critical assets are most attractive? Why?
    • What paths and vulnerabilities can threat agents exploit to reach critical assets without going through a control?
    • How could they defeat existing controls? Draw on the MITRE framework to inform your analysis.
    • Once agents defeat a control, what further attack can they launch?

    Threat

    Exploits an

    Asset

    Using a

    Method

    Creating an

    Effect

    Inputs for risk scenario identification

    Input

    Output

    • Jurisdictional assessment from activity 1.1.1
    • Critical assets from activity 2.1.1
    • Potential vulnerabilities from:
      • Security control gap analysis
      • Security risk register
    • Threat intelligence
    • MITRE framework
    • A list of critical assets, threat agents, vulnerabilities, and potential attack vectors.

    Materials

    Participants

    • Laptop
    • Projector
    • Whiteboard
    • Security team
    • Infrastructure & Operations team
    • Enterprise Risk Management

    2.1.2 Identify threats (continued)

    1 – 2 hours

    1. On a whiteboard, brainstorm how threat agents will exploit vulnerabilities in critical assets to reach their goal. Redefine attack vectors to capture what could result from a successful initial attack.

    For example:

    • State actors and cybercriminals may steal or compromise end-user devices during travel to high-risk jurisdictions using malware they embed in airport charging stations, internet café networks, or hotel business centers.
    • Compromised devices may infect corporate networks and threaten sensitive data once they reconnect to them.

    Threat

    Exploits an

    Asset

    Using a

    Method

    Creating an

    Effect

    The image contains a screenshot of activity 2.1.2 as described in the text above.

    Bring together the critical risk elements into a single risk scenario

    Summarize the scenario further into a single risk statement

    Risk Scenario: High-Risk Travel

    State actors and cybercriminals can threaten staff, devices, and data during travel to high-risk jurisdictions. Device theft or compromise may occur while traveling through airports, accessing hotel computer and phone networks, or in internet cafés or other public areas. Threat actors can exploit data from compromised or stolen devices to undermine the organization’s strategic, economic, or competitive advantage. They can also infect compromised devices with malware that delivers malicious payloads once they reconnect with home networks.

    Risk Statement

    Cybercriminals compromise end-user devices during travel to high-risk jurisdictions, jeopardizing staff safety and leading to loss of sensitive data.

    Risk Scenario: Compliance Risk

    Rapid changes in the privacy and security regulatory landscape threaten an organization’s ability to meet its compliance obligations from local legal and regulatory frameworks. Organizations that fail to do so risk reputational damage, administrative fines, criminal charges, and loss of market share. In extreme cases, organizations may lose their license to operate in high-risk jurisdictions. Shifts in the regulatory landscape can involve additional requirements for data residency, cross-border data transfer, data breach notification, and third-party risk management.

    Risk Statement

    Rapid changes in the privacy and security regulations landscape threaten our ability to remain compliant, leading to reputational and financial loss.

    Fill out the Jurisdictional Risk Register and Heatmap Tool

    The tool is populated with data from two key risk scenarios: high-risk travel and compliance risk.

    The image includes two screenshots of the Jurisdictional Risk Register and Heatmap Tool.

    1. Label the risk in Tab 3, Column B.
    2. Record your risk scenario in Tab 3, Column C.
    3. Record your risk statement in Tab 3, Column D.
    4. Identify the applicable jurisdictions in Tab 3, Column E.
    5. You can further categorize the scenario as:
      • an enterprise risk (Column G).
      • an IT risk (Column H).

    Download the Jurisdictional Risk Register and Heatmap Tool

    Step 2.2

    Assess Risk Exposure

    Activities

    2.2.1 Identify existing controls

    2.2.2 Assess likelihood and impact

    This step involves the following participants:

    • Security team
    • Risk and Compliance
    • IT leadership (optional)

    Outcomes of this step

    • Assess risk exposure for each risk scenario through an analysis of its likelihood and impact.

    Brush up on risk assessment essentials

    The next step will help you prioritize IT risks based on severity.

    Likelihood of Occurrence X Likelihood of Impact = Risk Severity

    Likelihood of occurrence: How likely the risk is to occur.

    Likelihood of impact: The likely impact of a risk event.

    Risk severity: The significance of the risk.

    Evaluate risk severity against the risk tolerance thresholds and the cost of risk response.

    Identify existing controls before you proceed

    Existing controls will reduce the inherent likelihood and impact of the risk scenario you face.

    Existing controls were put in place to avoid, mitigate, or transfer key risks your organization faced in the past. Without considering existing controls, you run the risk of overestimating the likelihood and impact of the risk scenarios your organization faces in high-risk jurisdictions.

    For instance, the ability to remote-wipe corporate-owned devices will reduce the potential impact of a device lost or compromised during travel to high-risk jurisdictions.

    As you complete the risk assessment for each scenario, document existing controls that reduce their inherent likelihood and impact.

    2.2.1 Document existing controls

    6-10 hours

    1. Document the Risk Category and Existing Controls in the Jurisdictional Risk Register and Heatmap Tool.
      • Tactical controls apply to individual risks only. For instance, the ability to remote-wipe devices mitigates the impact of a device lost in a high-risk jurisdiction.
      • Strategic controls apply to multiple risks. For instance, deploying MFA for critical applications mitigates the likelihood that malicious actors can compromise a lost device and impedes their access in devices they do compromise.

    Input

    Output

    • Risk scenarios
    • Existing controls for risk scenarios

    Materials

    Participants

    • Jurisdictional Risk Register and Heatmap Tool
    • Laptop
    • Projector
    • Security team
    • IT leadership
    • Business stakeholders
    • Enterprise Risk Management

    Download the Jurisdictional Risk Register and Heatmap Tool.

    Assess the risk scenarios you identified in Phase 1

    The risk register is the central repository for risks in high-risk jurisdictions.

    • Use the second tab of the Jurisdictional Risk Register and Heatmap Tool to create likelihood, impact, and risk tolerance assessment scales to evaluate every risk event effectively.
    • Severity-level assessment is a “first pass” of your risk scenarios that will reveal your organization’s most severe risks in high-risk jurisdictions.
    • You can incorporate expected cost calculations into your evaluation to assess scenarios in greater detail.
    • Expected cost represents how much you would expect to pay in an average year for each risk event. Expected cost calculations can help compare IT risks to non-IT risks that may not use the same scales and communicate system-level risk to the business in a language they will understand.

    Expected cost calculations may not be practical. Determining robust likelihood and impact values to produce cost estimates can be challenging and time consuming. Use severity-level assessments as a first pass to make the case for risk mitigation measures and take your lead from stakeholders.

    The image contains two screenshots of the Jurisdictional Risk Register and Heatmap Tool.

    Use the Jurisdictional Risk Register and Heatmap Tool to capture and analyze your data.

    2.2.2 Assess likelihood and impact

    6-10 hours

    1. Assign each risk scenario a likelihood of occurrence and a likely impact level that represents the impact of the scenario on the whole organization considering existing controls. Record your results in Tab 3, column R and S, respectively.
    2. You can further dissect likelihood and impact into component parameters but focus first on total likelihood and impact to keep the task manageable.
    3. As you input the first few likelihood and impact values, compare them to one another to ensure consistency and accuracy. For instance, is a device lost in a high-risk jurisdiction truly more impactful than a device compromised with commercial surveillance software?
    4. The tool will calculate the probability of risk exposure based on the likelihood and consequence associated with the scenario. The results are published in Tab 3, Column T.

    Input

    Output

    • Risk scenarios
    • Assessed the likelihood of occurrence and impact for all identified risk events

    Materials

    Participants

    • Jurisdictional Risk Register and Heatmap Tool
    • Laptop
    • Projector
    • Security team
    • IT leadership
    • Business stakeholders
    • Enterprise Risk Management

    Download the Jurisdictional Risk Register and Heatmap Tool.

    Refine your risk assessment to justify your estimates

    Document the rationale behind each value and the level of consensus in group discussions.

    Stakeholders will likely ask you to explain some of the numbers you assigned to likelihood and impact assessments. Pointing to an assessment methodology will give your estimates greater credibility.

    • Assign one individual to take notes during the assessment exercise.
    • Have them document the main rationale behind each value and the level of consensus.

    The goal is to develop robust intersubjective estimates of the likelihood and impact of a risk scenario.

    We assigned a 50% likelihood rating to a risk scenario. Were we correct?

    Assess the truth of the following statements to test likelihood assessments. In this case, do these two statements seem true?

    • The risk event will likely occur once in the next two years, all things being equal.
    • In two nearly identical organizations, one out of two will experience the risk event this year.
    The image includes a screenshot of the High-Risk Travel Jurisdictions.

    Phase 3

    Execute Response

    This phase will walk you through the following activities:

    • Prioritize and treat global risks to critical assets based on their value and exposure.
    • Build an initiative roadmap that identifies and applies relevant controls to protect critical assets. Identify key risk indicators to monitor progress.

    This phase involves the following participants:

    • Security team
    • Risk and Compliance
    • IT leadership (optional)

    Step 3.1

    Treat Security Risks

    Activities

    3.1.1 Identify and assess risk response

    This step involves the following participants:

    • Security team
    • Risk and Compliance
    • IT leadership (optional)

    Outcomes of this step

    • Prioritize and treat global risks to critical assets based on their value and exposure.

    Analyze and select risk responses

    The next step will help you treat the risk scenarios you built in Phase 2.

    Identify

    Identify risk responses.

    Predict

    Predict the effectiveness of the risk response, if implemented, by estimating the residual likelihood and impact of the risk.

    Calculate

    The tool will calculate the residual severity of the risk after applying the risk response.

    The first part of the phase outlines project activities. The second part elaborates on high-risk travel and compliance risk, the two key risk scenarios we are following throughout the project. Use the Jurisdictional Risk Register and Heatmap Tool to capture your work.

    Analyze likelihood and impact to identify response

    The image contains a diagram of he risk response analysis. Risk Transfer and Risk Avoidance has the most likelihood, and Risk Acceptance and Risk Mitigation have the most impact. Risk Avoidance has the most likelihood and most impact in regards to risk response.

    3.1.1 Identify and assess risk response

    Complete the following steps for each risk scenario.

    1. Identify a risk response action that will help reduce the likelihood of occurrence or the impact if the scenario were to occur. Indicate the type of risk response (avoidance, mitigation, transfer, acceptance, or no risk exists).
    2. Assign each risk response action a residual likelihood level and a residual impact level. This is the same step you performed in Activity 2.2.2, but you are now are estimating the likelihood and impact of the risk event after you implemented the risk response action successfully. The Jurisdictional Risk Register and Heatmap Tool will generate a residual risk severity level for each risk event.
    3. Identify the potential Risk Action Owner (Project Manager) if the response is selected and turned into an IT project, and document this in the Jurisdictional Risk Register and Heatmap Tool .
    4. For each risk event, document risk response actions, residual likelihood and impact levels, and residual risk severity level.

    Input

    Output

    • Risk scenarios from Phase 2
    • Risk scenario mitigation plan

    Materials

    Participants

    • Whiteboard/flip charts
    • Jurisdictional Risk Register and Heatmap Tool
    • Security team
    • Risk and Compliance
    • IT leadership (optional)

    Download the Jurisdictional Risk Register and Heatmap Tool

    Step 3.2

    Mitigate Travel Risk

    Activities

    3.2.1 Develop a travel policy

    3.2.2 Develop travel procedures

    3.2.3 Design high-risk travel guidelines

    This step involves the following participants:

    • Security team
    • Risk and Compliance
    • IT leadership (optional)

    Outcomes of this step

    • Prioritize and treat global risks to critical assets based on their value and exposure.

    Identify controls to mitigate jurisdictional risk

    This section provides guidance on the most prevalent risk scenarios identified in Phase 2 and provides a more in-depth examination of the two most prevalent ones, high-risk travel and compliance risk. Determine the appropriate response to each risk scenario to keep global risks to critical assets aligned with the organization’s risk tolerance.

    Key Risk Scenarios

    • High-Risk Travel
    • Compliance Risk
    • Insider Threat
    • Advanced Persistent Threat
    • Commercial Surveillance

    Travel risk is a common concern in organizations with global operations

    • The security of staff, devices, and data is one of the biggest challenges facing organizations with a global footprint. Working and traveling in unpredictable environments will aways carry a degree of risk, but organizations can do much to develop a safer and more secure working environment.
    • Compromised or stolen devices can provide threat actors with access to data that could compromise the organization’s strategic, economic, or competitive advantage or expose the organization to regulatory risk.
    • For many organizations, security risk assessments, security plans, travel security procedures, security training, and incident reporting systems are a key part of their operating language.
    • The following section provides a simple structure to help organizations demystify travel in high-risk jurisdictions.

    The image contains a diagram to present high-risk jurisdictions.

    Before you leave

    • Identify high-risk countries.
    • Enable controls.
    • Limit what you pack.

    During your trip

    • Assume you are monitored.
    • Limit access to systems.
    • Prevent theft.

    When you return

    • Change your password.
    • Restore your devices.

    Case study

    Higher Education: Camosun College

    Interview: Evan Garland

    Frame additional security controls as a value-added service.

    Situation

    The director of the international department at Camosun College reached out to IT security for additional support. Department staff often traveled to hostile environments. They were concerned malicious agents would either steal end-user devices or compromise them and access sensitive data. The director asked IT security for options that would better protect traveling staff, their devices, and the information they contain.

    Challenges

    First, controls would need to admit both work and personal use of corporate devices. Staff relied exclusively on work devices for travel to mitigate the risk of personal device theft. Personal use of corporate devices during travel was common. Second, controls needed to strike the right balance between friction and effortless access. Traveling staff had only intermittent access to IT support. Restrictive controls could prevent them from accessing their devices and data altogether.

    Solution

    IT consulted staff to discuss light-touch solutions that would secure devices without introducing too much complexity or compromising functionality. They then planned security controls that involved user interaction and others that did not and identified training requirements.

    Results

    Controls with user interaction

    Controls without user interaction

    • Multifactor authentication for college systems and collaboration platforms
    • Password manager for both work and personal use for staff for stronger passwords and practices
    • Security awareness training to help traveling staff identify potential threats while traveling through airports or accessing public Wi-Fi.
    • Drive encryption and always-on VPN to protect data at rest and in transit
    • Increased setting for phishing and spam filtering for traveling staff email
    • Enhanced anti-malware/endpoint detection and response (EDR) solution for traveling laptops

    Build a program to mitigate travel risks

    There is no one-size-fits-all solution.

    The most effective solution will take advantage of existing risk management policies, processes, and procedures at your organization.

    • Develop a framework. Outline the organization’s approach to high-risk travel, including the policies, procedures, and mechanisms put in place to ensure safe travel to high-risk jurisdictions.
    • Draft a policy. Outline the organization’s risk attitude and key security principles and define roles and responsibilities. Include security responsibilities and obligations in job descriptions of staff members and senior managers.
    • Provide flexible options. Inherent travel risk will vary from one jurisdiction to another. You will likely not find an approach that works for every case. Establish locally relevant measures and plans in different security contexts and risk environments.
    • Look for quick wins. Identify measures or requirements that you can establish quickly but that can have a positive effect on the security of staff, data, and devices.
    • Monitor and review. Undertake periodic reviews of the organization’s security approach and management framework, as well as their implementation, to ensure the framework remains effective.

    3.2.1 Develop a travel policy

    1. Work with your business leaders to build a travel policy for high-risk jurisdictions. The policy should be a short and accessible document structured around four key sections:
      • A statement on the importance of staff security and safety, the scope of the policy, and who it applies to (staff, consultants, contractors, volunteers, visitors, accompanying dependants, etc.).
      • A principles section explaining the organization’s security culture, risk attitude, and the key principles that shape the organization’s approach to staff security and safety.
      • A responsibilities section setting out the organization’s security risk management structure and the roles and actions allocated to specific positions.
      • A minimal security requirements section establishing the specific security requirements that must be in place in all locations and specific locations.
    2. Common security principles include:
    • Shared responsibility – Managing risks to staff is a shared organizational responsibility.
    • Acknowledgment of risk – Managing security will not remove all risks. Staff need to appreciate, as part of their informed consent, that they are still exposed to risk.
    • Primacy of life – Staff safety is of the highest importance. Staff should never place themselves at excessive risk to meet program objectives or protect property.
    • Proportionate risk – Risks must be assessed to ensure they are proportionate to the benefits organizational activities provide and the ability to manage those risks.
    • Right to withdraw – Staff have the right to withdraw from or refuse to take up work in a particular area due to security concerns.
    • No right to remain – The organization has the right to suspend activities that it considers too dangerous.
  • Cross-reference the organization’s other governing policies that outline requirements related to security risk management, such as the health and safety policy, access control policy, and acceptable use of security assets.
  • Input

    Output

    • List of high-risk jurisdictions
    • Risk scenarios from Phase 2
    • Data inventory and data flows
    • Travel policy for high-risk jurisdictions

    Materials

    Participants

    • Whiteboard/flip charts
    • Jurisdictional Risk Register and Heatmap Tool
    • Security team
    • Legal team
    • IT leadership
    • Risk Management

    Develop security plans for high-risk travel

    Security plans advise staff on how to manage the risk identified in assessments.

    Security plans are key country documents that outline the security measures and procedures in place and the responsibilities and resources required to implement them. Security plans should be established in high-risk jurisdictions where your organization has a regular, significant presence. Security plans must remain relevant and accessible documents that address the specific risks that exist in that location, and, if appropriate, are specific about where the measures apply and who they apply to. Plans should be updated regularly, especially following significant incidents or changes in the operating environment or activities.

    Key Components

    Critical information – One-page summary of pertinent information for easy access and quick reference (e.g. curfew times, no-go areas, important contacts).

    Overview – Purpose and scope of the document, responsibilities for security plan, organization’s risk attitude, date of completion and review date, and a summary of the security strategy and policy.

    Current Context – Summary of current operating context and overall security situation; main risks to staff, assets, and operations; and existing threats and risk rating.

    Procedures – Simple security procedures that staff should adhere to in order to prevent incidents and how to respond should problems arise. Standard operating procedures (SOPs) should address key risks identified in the assessment.

    Security levels – The organization's security levels/phases, with situational indicators that reflect increasing risks to staff in that context and location and specific actions/measures required in response to increasing insecurity.

    Incident reporting – The procedures and responsibilities for reporting security-related incidents; for example, the type of incidents to be reported, the reporting structure, and the format for incident reporting.

    Determine travel risk

    Tailor your risk response to the security risk assessment you conducted in earlier stages of this project.

    Ratings are formulated by assessing several types of risk, including conflict, political/civil unrest, terrorism, crime, and health and infrastructure risks.

    Rating

    Description (Examples)

    Recommended Action

    Low

    Generally secure with adequate physical security. Low violent crime rates. Some civil unrest during significant events. Acts of terrorism rare. Risks associated with natural disasters limited and health threats mainly preventable.

    Basic personal security, travel, and health precautions required.

    Moderate

    Periodic civil unrest. Antigovernment, insurgent, or extremist groups active with sporadic acts of terrorism. Staff at risk from common and violent crime. Transport and communications services are unreliable and safety records are poor. Jurisdiction prone to natural disasters or disease epidemics.

    Increased vigilance and routine security procedures required.

    High

    Regular periods of civil unrest, which may target foreigners. Antigovernment, insurgent, or extremist groups very active and threaten political or economic stability. Violent crime rates high and targeting of foreigners is common. Infrastructure and emergency services poor. May be regular disruption to transportation or communications services. Certain areas off-limits to foreigners. Jurisdictions experiencing a natural disaster or a disease epidemic are considered high risk.

    High level of vigilance and effective, context-specific security precautions required.

    Extreme

    Undergoing active conflict or persistent civil unrest. Risk of being caught up in a violent incident or attack is very high. Civil authorities may have lost control of significant portions of the country. Lines between criminality and political and insurgent violence are blurred. Foreigners are likely to be denied access to significant parts of the country. Transportation and communication services are severely degraded or non-existent. Violence presents a direct threat to staff security.

    Stringent security precautions essential and may not be sufficient to prevent serious incidents.

    Program activities may be suspended and staff withdrawn at very short notice.

    3.2.2 Develop travel procedures

    1. Work with your business leaders to build travel procedures for high-risk jurisdictions. The procedures should be tailored to the risk assessment and address the risk scenarios identified in Phase 2.
    2. Use the categories outlined in the next two slides to structure the procedure. Address all types of travel, detail security measures, and outline what the organization expects of travelers before, during, and after their trip.
    3. Consider the implementation of special measures to limit the impact of a potential security event, including:
      • Information end-user device loaner programs.
      • Temporary travel service email accounts.
    4. Specify what happens when staff add personal travel to their work trip to cover issues such as insurance, check-in, actual travel times, etc.
    5. Discuss the rationale for each procedure. Ensure the components align with the policy statements outlined in the high-risk travel policy developed in the previous step.

    Input

    Output

    • List of high-risk jurisdictions
    • Risk scenarios from Phase 2
    • High-risk travel policy
    • Travel procedures for high-risk jurisdictions

    Materials

    Participants

    • Whiteboard/flip charts
    • Jurisdictional Risk Register and Heatmap Tool
    • Security team
    • Legal team
    • IT leadership
    • Risk Management

    Draft procedures to mitigate travel risks

    Address all types of travel, detail security measures, and outline what the organization expects of travelers before, during, and after their trip

    Introduction

    Clarifies who the procedures apply to. Highlights any differences in travel security requirements or support provided to staff, consultants, partners, and official visitors.

    Travel risk ratings

    Explains the travel or country risk rating system, how staff access the information, the different categories and indicators, and their implications.

    Roles and responsibilities

    Clarifies the responsibilities of travelers, their line managers or contact points, and senior management regarding travel security and how this changes for destinations with higher risk ratings.

    Travel authorization

    Stipulates who in the organization authorizes travel, the various compliance measures required, and how this changes for destinations with higher risk ratings.

    Travel risk assessment

    Explains when travel risk assessments are required, the template that should be used, and who approves the completed assessments.

    Travel security procedures should specify what happens when staff add personal travel to their work trip to cover issues such as insurance, check-in, actual travel times, etc.

    Pre-travel briefings

    Outlines the information that must be provided to travelers prior to departure, the type of briefing required and who provides it, and how these requirements change as risk ratings increase.

    Security training

    Explain security training required prior to travel. This may vary depending on the country’s risk rating. Includes information on training waiver system, including justifications and authorization.

    Traveler profile forms

    Travelers should complete a profile form, which includes personal details, emergency contacts, medical details, social media footprint, and proof-of-life questions (in contexts where there are abduction risks).

    Check-in protocol

    Specifies who travelers must maintain contact with while traveling and how often, as well as the escalation process in case of loss of contact. The frequency of check-ins should reflect the increase in the risk rating for the destination.

    Emergency procedures

    Outlines the organization's emergency procedures for security and medical emergencies.

    3.2.3 Design high-risk travel guidelines

    • Supplement the high-risk travel policies and procedures with guidelines to help international travelers stay safe.
    • The document is intended for an end-user audience and should reflect your organization’s policies and procedures for the use of information and information systems during international travel.
    • Use the Digital Safety Guidelines for International Travel template in concert with this blueprint to provide guidance on what end users can do to stay safe before they leave, during their trip, and when they return.
    • Consider integrating the guidelines into specialized security awareness training sessions that target end users who travel to high-risk jurisdictions.
    • The guidelines should supplement and align with existing technical controls.

    Input

    Output

    • List of high-risk jurisdictions
    • Risk scenarios from Phase 2
    • High-risk travel policy
    • High-risk travel procedure
    • Travel guidelines for high-risk jurisdictions

    Materials

    Participants

    • Whiteboard/flip charts
    • Jurisdictional Risk Register and Heatmap Tool
    • Security team
    • Legal team
    • IT leadership
    • Risk Management

    Download the Digital Safety Guidelines for International Travel template

    Step 3.3

    Mitigate Compliance Risk

    Activities

    3.3.1 Identify data localization obligations

    3.3.2 Integrate obligations into IT system design

    3.3.3 Document data processing activities

    3.3.4 Choose the right mechanism

    3.3.5 Implement the appropriate controls

    3.3.6 Identify data breach notification obligations

    3.3.7 Integrate data breach notification into incident response

    3.3.8 Identify vendor security and data protection requirements

    3.3.9 Build due diligence questionnaire

    3.3.10 Build appropriate data processing agreement

    This step involves the following participants:

    • Security team
    • Risk and Compliance
    • IT leadership (optional)

    Outcomes of this step

    • Prioritize and treat global risks to critical assets based on their value and exposure.

    Compliance risk is a prevalent risk in organizations with a global footprint

    • The legal and regulatory landscape is evolving rapidly to keep step with the pace of technological change. Security and privacy leaders are expected to mitigate the risk of noncompliance as the organization expands to new jurisdictions.
    • Organizations with a global footprint must stay abreast of local regulations and provide risk management guidance to business leaders to support global operations.
    • This sections describes four compliance risks in this context:
      • Cross-border data transfer
      • Third-party risk management
      • Data breach notification
      • Data residency

    Compliance with local obligations

    Likelihood: Medium to High

    Impact: High

    Data Residency

    Gap Controls

    • Identify and document the data localization obligations for the jurisdictions that the organization is operating in.
    • Design and implement IT systems that satisfy the data localization requirements.
    • Comply with data localization obligations within each jurisdiction.

    Heatmap of Global Data Residency Regulations

    The image contains a screenshot of a picture of a world map with various shades of blue to demonstrate the heatmap of global data residency regulations.
    Source: InCountry, 2021

    Examples of Data Residency Requirements

    Country

    Data Type

    Local Storage Requirements

    Australia

    Personal data – heath record

    My Health Records Act 2012

    China

    Personal information — critical information infrastructure operators

    Cybersecurity law

    Government cloud data

    Opinions of the Office of the Central Leading Group for Cyberspace Affairs on Strengthening Cybersecurity Administration of Cloud Computing Services for Communist Party and Government Agencies

    India

    Government email data

    The Public Records Act of 1993

    Indonesia

    Data held by electronic system operator for the public service

    Regulation 82 concerning “Electronic System and Transaction Operation”

    Germany

    Government cloud service data

    Criteria for the procurement and use of cloud services by the federal German administration

    Russia

    Personal data

    The amendments of Data Protection Act No. 152 FZ

    Vietnam

    Data held by internet service providers

    The Decree on Management, Provision, and Use of Internet Services and Information Content Online (Decree 72)

    US

    Government cloud service data

    Defense Federal Acquisition Regulation Supplement: Network Penetration Reporting and Contracting for Cloud Services (DFARS Case 2013-D018)

    3.3.1 Identify data localization obligations

    1-2 hours

    1. Work with your business leaders to identify and document the jurisdictions where your organization is operating in or providing services and products to consumers within.
    2. Work with your legal team to identify and document all relevant data localization obligations for the data your organization generates, collects, and processes in order to operate your business.
    3. Record your data localization obligations in the table below.

    Jurisdiction

    Relevant Regulations

    Local Storage Requirements

    Date Type

    Input

    Output

    • List of jurisdictions your organization is operating in
    • Relevant security and data protection regulations
    • Data inventory and data flows
    • Completed list of data localization obligations

    Materials

    Participants

    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Privacy team
    • Security team
    • Legal team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    3.3.2 Integrate obligations into your IT system design

    1-2 hours

    1. Work with your IT department to design the IT architecture and systems to satisfy the data localization requirements.
    2. The table below provides a checklist for integrating privacy considerations into your IT systems.

    Item

    Consideration

    Answer

    Supporting Document

    1

    Have you identified business services that process data that will be subject to localization requirements?

    2

    Have you identified IT systems associated with the business services mentioned above?

    3

    Have you established a data inventory (i.e. data types, business purposes) for the IT systems mentioned above?

    4

    Have you established a data flow diagram for the data identified above?

    5

    Have you identified the types of data that should be stored locally?

    6

    Have you confirmed whether a copy of the data locally stored will satisfy the obligations?

    7

    Have you confirmed whether an IT redesign is needed or whether modifications (e.g. adding a server) to the IT systems would satisfy the obligations?

    8

    Have you confirmed whether access from another jurisdiction is allowed?

    9

    Have you identified how long the data should be stored?

    Input

    Output

    • Data localization obligations
    • Business services that process data that will be subject to localization requirements
    • IT systems associated with business services
    • Data inventory and data flows
    • Completed checklist of localization obligations for IT system design

    Materials

    Participants

    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Privacy team
    • Security team
    • Legal team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    Compliance with local obligations

    Likelihood: Medium to High

    Impact: High

    Cross-Border Transfer

    Gap Controls

    • Know where you transfer your data.
    • Identify jurisdictions that your organization is operating in and that impose different requirements for the cross-border transfer of personal data.
    • Adopt and implement a proper cross-border data transfer mechanism in accordance with applicable privacy laws and regulations.
    • Re-evaluate at appropriate intervals.

    Which cross-border transfer mechanism should I choose?

    Transfer Mechanism

    Advantages

    Disadvantages

    Standard Contractual Clauses (SCC)

    • Easy to implement
    • No DPA (data processing agreement) approval
    • Not suitable for complex data transfers
    • Do not meet business agility
    • Needs legal solution

    Binding Corporate Rules (BCRs)

    • Meets business agility needs
    • Raises trust in the organization
    • Doubles as solution for art. 24/25 of the GDPR
    • Sets high compliance maturity level
    • Takes time to draft/implement
    • Requires DPA approval (scrutiny)
    • Requires culture of compliance
    • Approved by one "lead" authority and two other "co-lead“ authorities
    • Takes usually between six and nine months for the approval process only

    Code of Conduct

    • Raises trust in the sector
    • Self-regulation instead of law
    • No code of conduct approved yet
    • Takes time to draft/implement
    • Requires DPA approval and culture of compliance
    • Needs of organization may not be met

    Certification

    • Raises trust in the organization
    • No certification schemes available yet
    • Risk of compliance at minimum necessary
    • Requires audits

    Consent

    • Legal certainty
    • Transparent
    • Administrative burden
    • Some data subjects are incapable of consenting all or nothing

    3.3.3 Document data processing activities

    1-2 hours

    1. Identify and document the following information:
      • Name of business process
      • Purposes of processing
      • Lawful basis
      • Categories of data subjects and personal data
      • Data subject categories
      • Which system the data resides in
      • Recipient categories
      • Third country/international organization
      • Documents for appropriate safeguards for international transfer (adequacy, SCCs, BCRs, etc.)
      • Description of mitigating measures

    Input

    Output

    • Name of business process
    • Categories of personal data
    • Which system the data resides
    • Third country/international organization
    • Documents for appropriate safeguards for international transfer
    • Completed list of data processing activities

    Materials

    Participants

    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Privacy team
    • Security team
    • Legal team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    3.3.4 Choose the right mechanism

    1-2 hours

    1. Identify jurisdictions that your organization is operating in and that impose different requirements for the cross-border transfer of personal data. For example, the EU’s GDPR and China’s Personal Information Protection Law require proper cross-border transfer mechanisms before the data transfers. Your organization should decide which cross-border transfer mechanism is the best fit for your cross-border data transfer scenarios.
    2. Use the following table to identify and document the pros and cons of each data transfer mechanism and the final decision.

    Data Transfer Mechanism

    Pros

    Cons

    Final Decision

    SCC

    BCR

    Code of Conduct

    Certification

    Consent

    Input

    Output

    • List of relevant data transfer mechanisms
    • Assessment of the pros and cons of each mechanism
    • Final decision regarding which data transfer mechanism is the best fit for your organization

    Materials

    Participants

    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Privacy team
    • Security team
    • Legal team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    3.3.5 Implement the appropriate controls

    1-3 hours

    • One of the most common mechanisms is standard contractual clauses (SCCs).
    • Use Info-Tech’s Standard Contractual Clauses Template to facilitate your cross-border transfer activities.
    • Identify and check whether the following core components are covered in your SCC and record the results in the table below.
    # Core Components Status Note
    1 Purpose and scope
    2 Effect and invariability of the Clauses
    3 Description of the transfer(s)
    4 Data protection safeguards
    5 Purpose limitation
    6 Transparency
    7 Accuracy and data minimization
    8 Duration of processing and erasure or return of data
    9 Storage limitation
    10 Security of processing
    11 Sensitive data
    12 Onward transfers
    13 Processing under the authority of the data importer
    14 Documentation and compliance
    15 Use of subprocessors
    16 Data subject rights
    17 Redress
    18 Liability
    19 Local laws and practices affecting compliance with the Clauses
    20 Noncompliance with the Clauses and termination
    21 Description of data processing activities, such as list of parties, description of transfer, etc.
    22 Technical and organizational measures
    InputOutput
    • Description of the transfer(s)
    • Duration of processing and erasure or return of data
    • Onward transfers
    • Use of subprocessors
    • Etc.
    • Draft of the standard contractual clauses (SCC)
    MaterialsParticipants
    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Legal team
    • Privacy team
    • Security team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    Compliance with local obligations

    Likelihood: High

    Impact: Medium to High

    Data Breach

    Gap Controls

    • Identify jurisdictions that your organization is operating in and that impose different obligations for data breach reporting.
    • Document the notification obligations for various business scenarios, such as controller to DPA, controller to data subject, and processor to controller.
    • Integrate breach notification obligations into security incident response process.

    Examples of Data Breach Notification Obligations

    Location

    Regulation/ Standard

    Reporting Obligation

    EU

    GDPR

    72 hours

    China

    PIPL

    Immediately

    US

    HIPAA

    No later than 60 days

    Canada

    PIPEDA

    As soon as feasible

    Global

    PCI DSS

    • Visa – immediately after breach discovered
    • Mastercard – within 24 hours of discovering breach
    • American Express – immediately after breach discovered

    Summary of US State Data Breach Notification Statutes

    The image contains a graph to show the summary of the US State Data Breach Notification Statutes.

    Source: Davis Wright Tremaine

    3.3.6 Identify data breach notification obligations

    1-2 hours

    1. Identify jurisdictions that your organization is operating in and that impose different obligations for data breach reporting.
    2. Document the notification obligations for various business scenarios, such as controller to DPA, controller to data subject, and processor to controller.
    3. Record your data breach obligations in the table below.
    Region Regulation/Standard Reporting Obligation

    Input

    Output

    • List of regions and jurisdictions your business is operating in
    • List of relevant regulations and standards
    • Documentation of data breach reporting obligations in applicable jurisdictions

    Materials

    Participants

    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Legal team
    • Privacy team
    • Security team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    3.3.7 Integrate data breach notification into incident response

    1-2 hours

    • Integrate breach notification obligations into the security incident response process. Understand the security incident management framework.
    • All incident runbooks follow the same process: detection, analysis, containment, eradication, recovery, and post-incident activity.
    • The table below provides a basic checklist for you to consider when implementing your data breach and incident handling process.
    # Phase Considerations Status Notes
    1 Prepare Ensure the appropriate resources are available to best handle an incident.
    2 Detect Leverage monitoring controls to actively detect threats.
    3 Analyze Distill real events from false positives.
    4 Contain Isolate the threat before it can cause additional damage.
    5 Eradicate Eliminate the threat from your operating environment.
    6 Recover Restore impacted systems to a normal state of operations.
    7 Report Report data breaches to relevant regulators and data subjects if required.
    8 Post-Incident Activities Conduct a lessons-learned post-mortem analysis.
    InputOutput
    • Security and data protection incident response steps
    • Key considerations for integrating data breach notifications into incident response
    • Data breach notifications integrated into the incident response process
    MaterialsParticipants
    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Security team
    • Privacy team
    • Legal team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    Compliance with local obligations

    Likelihood: High

    Impact: Medium to High

    Third-Party Risk

    Gap Controls

    • Build an end-to-end third-party security and privacy risk management process.
    • Perform internal due diligence prior to selecting a service provider.
    • Stipulate the security and privacy protection obligations of the third party in a legally binding document such as contract or data processing agreement, etc.

    End-to-End Third-Party Security and Privacy Risk Management

    1. Pre-Contract
    • Due diligence check
  • Signing of Contract
    • Data processing agreement
  • Post-Contract
    • Continuous monitoring
    • Regular check or audit
  • Termination of Contract
    • Data deletion
    • Access deprovisioning

    Examples of Vendor Security Management Requirements

    Region

    Law/Standard

    Section

    EU

    General Data Protection Regulation (GDPR)

    Article 28 (1)

    Article 46 (1)

    US

    Health Insurance Portability and Accountability Act (HIPAA)

    §164.308(b)(1)

    US

    New York Department of Financial Services Cybersecurity Requirements

    500.11(a)

    Global

    ISO 27002:2013

    15.1.1

    15.1.2

    15.1.3

    15.2.1

    15.2.2

    US

    NIST 800-53

    SA-12

    SA-12 (2)

    US

    NIST Cybersecurity Framework

    ID-SC-1

    ID-SC-2

    ID-SC-3

    ID-SC-4

    Canada

    OSFI Cybersecurity Guidelines

    4.25

    4.26

    3.3.8 Identify vendor security and data protection requirements

    1-2 hours

    • Effective vendor security risk management is an end-to-end process that includes assessment, risk mitigation, and periodic reassessments.
    • An efficient and effective assessment process can only be achieved when all stakeholders are participating.
    • Identify and document your vendor security and data protection requirements in the table below.
    Region Law/Standard Section Requirements

    Input

    Output

    • List of regions and jurisdictions your business is operating in
    • List of relevant regulations and standards
    • Documentation of vendor security and data protection obligations in applicable jurisdictions

    Materials

    Participants

    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Legal team
    • Privacy team
    • Security team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    3.3.9 Build due diligence questionnaire

    1-2 hours

    Perform internal due diligence prior to selecting a service provider.

    1. Build and right-size your vendor security questionnaire by leveraging Info-Tech’s Vendor Security Questionnaire template.
    2. Document your vendor security questionnaire in the table below.
    # Question Vendor Request Vendor Comments
    1 Document Requests
    2 Asset Management
    3 Governance
    4 Supply Chain Risk Management
    5 Identify Management, Authentication, and Access Control
    InputOutput
    • List of regions and jurisdictions your business is operating in
    • List of relevant regulations and standards
    • Business security and data protection requirements and expectations
    • Draft of due diligence questionnaire
    MaterialsParticipants
    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Legal team
    • Privacy team
    • Security team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    3.3.10 Build appropriate data processing agreement

    1-2 hours

    1. Stipulate the security and privacy protection obligations of the third party in a legally binding document such as contract or data processing agreement, etc.
    2. Leverage Info-Tech’s Data Processing Agreement Template to put the language into your legally binding document.
    3. Use the table below to check whether core components of a typical DPA are covered in your document.
    # Core Components Status Note
    1 Processing of personal data
    2 Scope of application and responsibilities
    3 Processor's obligations
    4

    Controller's obligations

    5 Data subject requests
    6 Right to audit and inspection
    7 Subprocessing
    8 Data breach management
    9 Security controls
    10 Transfer of personal data
    11 Duty of confidentiality
    12 Compliance with applicable laws
    13 Service termination
    14 Liability and damages
    InputOutput
    • Processing of personal data
    • Processor’s obligations
    • Controller’s obligations
    • Subprocessing
    • Etc.
    • Draft of data processing agreement (DPA)
    MaterialsParticipants
    • Guidelines for Compliance With Local Security and Privacy Laws Template
    • Legal team
    • Privacy team
    • Security team
    • IT leadership
    • Risk Management

    Download the Guidelines for Compliance With Local Security and Privacy Laws Template

    Summary of Accomplishment

    Problem Solved

    By following Info-Tech’s methodology for securing global operations, you have:

    • Evaluated the security context of your organization’s global operations.
    • Identified security risks scenarios unique to high-risk jurisdictions and assessed the exposure of critical assets.
    • Planned and executed a response.

    You have gone through a deeper analysis of two key risk scenarios that affect global operations:

    • Travel to high-risk jurisdictions.
    • Compliance risk.

    If you would like additional support, have our analysts guide you through an Info-Tech workshop or Guided Implementation.

    Contact your account representative for more information.

    workshop@infotech.com

    1-888-670-8889

    Additional Support

    If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

    The image contains a picture of Michel Hebert.

    Contact your account representative for more information.

    workshops@infotech.com 1-888-670-8889

    To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team. Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    The image contains a screenshot of High-Risk Travel Jurisdictions.

    Identify High-Risk Jurisdictions

    Develop requirements to identify high-risk jurisdictions.

    The image contains a screenshot of Build Risk Scenarios.

    Build Risk Scenarios

    Build risk scenarios to capture assets, vulnerabilities, threats, and the potential effect of a compromise.

    External Research Contributors

    Ken Muir

    CISO

    LMC Security

    Premchand Kurup

    CEO

    Paramount Computer Systems

    Preeti Dhawan

    Manager, Security Governance

    Payments Canada

    Scott Wiggins

    Information Risk and Governance

    CDPHP

    Fritz Y. Jean Louis

    CISO

    Globe and Mail

    Eric Gervais

    CIO

    Ovivo Water

    David Morrish

    CEO

    MBS Techservices

    Evan Garland

    Manager, IT Security

    Camosun College

    Jacopo Fumagalli

    CISO

    Axpo

    Dennis Leon

    Governance and Security Manager

    CPA Canada

    Tero Lehtinen

    CIO

    Planmeca Oy

    Related Info-Tech Research

    Build an IT Risk Management Program

    • Build a program to identify, evaluate, assess, and treat IT risks.
    • Monitor and communicate risks effectively to support business decision making.

    Combine Security Risk Management Components Into One Program

    • Develop a program focused on assessing and managing information system risks.
    • Build a governance structure that integrates security risks within the organization’s broader approach to risk management.

    Build an Information Security Strategy

    • Build a holistic, risk-aware strategy that aligns to business goals.
    • Develop a roadmap of prioritized initiatives to implement the strategy over 18 to 36 months.

    Bibliography

    2022 Cost of Insider Threats Global Report.” Ponemon Institute, NOVIPRO, 9 Feb. 2022. Accessed 25 May 22.

    “Allianz Risk Barometer 2022.” Allianz Global Corporate & Specialty, Jan. 2022. Accessed 25 May 22.

    Bickley, Shaun. “Security Risk Management: a basic guide for smaller NGOs”. European Interagency Security Forum (EISF), 2017. Web.

    “Biden Administration Warns against spyware targeting dissidents.” New York Times, 7 Jan 22. Accessed 20 Jan 2022.

    Boehm, Jim, et al. “The risk-based approach to cybersecurity.” McKinsey & Company, October 2019. Web.

    “Cost of a Data Breach Report 2021.” IBM Security, July 2021. Web.

    “Cyber Risk in Asia-Pacific: The Case for Greater Transparency.” Marsh & McLennan Companies, 2017. Web.

    “Cyber Risk Index.” NordVPN, 2020. Accessed 25 May 22

    Dawson, Maurice. “Applying a holistic cybersecurity framework for global IT organizations.” Business Information Review, vol. 35, no. 2, 2018, pp. 60-67.

    “Framework for improving critical infrastructure cybersecurity.” National Institute of Standards and Technology, 16 Apr 2018. Web.

    “Global Cybersecurity Index 2020.” International Telecommunication Union (ITU), 2021. Accessed 25 May 22.

    “Global Risk Survey 2022.” Control Risks, 2022. Accessed 25 May 22.

    “International Travel Guidance for Government Mobile Devices.” Federal Mobility Group (FMG), Aug. 2021. Accessed 18 Nov 2021.

    Kaffenberger, Lincoln, and Emanuel Kopp. “Cyber Risk Scenarios, the Financial System, and Systemic Risk Assessment.” Carnegie Endowment for International Peace, September 2019. Accessed 11 Jan 2022.

    Koehler, Thomas R. Understanding Cyber Risk. Routledge, 2018.

    Owens, Brian. “Cybersecurity for the travelling scientist.” Nature, vol. 548, 3 Aug 2017. Accessed 19 Jan. 2022.

    Parsons, Fintan J., et al. “Cybersecurity risks and recommendations for international travellers.” Journal of Travel Medicine, vol. 1, no. 4, 2021. Accessed 19 Jan 2022.

    Quinn, Stephen, et al. “Identifying and estimating cybersecurity risk for enterprise risk management.” National Institute of Standards and Technology (NIST), Interagency or Internal Report (IR) 8286A, Nov. 2021.

    Quinn, Stephen, et al. “Prioritizing cybersecurity risk for enterprise risk management.” NIST, IR 8286B, Sept. 2021.

    “Remaining cyber safe while travelling security recommendations.” Government of Canada, 27 April 2022. Accessed 31 Jan 2022.

    Stine, Kevin, et al. “Integrating cybersecurity and enterprise risk management.” NIST, IR 8286, Oct. 2020.

    Tammineedi, Rama. “Integrating KRIs and KPIs for effective technology risk management.” ISACA Journal, vol. 4, 1 July 2018.

    Tikk, Eneken, and Mika Kerttunen, editors. Routledge Handbook of International Cybersecurity. Routledge, 2020.

    Voo, Julia, et al. “National Cyber Power Index 2020.” Belfer Center for Science and International Affairs, Harvard Kennedy School, Sept. 2020. Web.

    Zhang, Fang. “Navigating cybersecurity risks in international trade.” Harvard Business Review, Dec 2021. Accessed 31 Jan 22.

    Appendix

    Insider Threat

    Key Risk Scenario

    Likelihood: Medium to High

    Impact: High

    Gap Controls

    The image contains a picture of the Gap Controls. The controls include: Policy and Awareness, Identification, Monitoring and Visibility, which leads to Cooperation.

    • Identification: Effective and efficient management of insider threats begins with a threat and risk assessment to establish which assets and which employees to consider, especially in jurisdictions associated with sensitive or critical data. You need to pay extra attention to employees who are working in satellite offices in jurisdictions with loose security and privacy laws.
    • Monitoring and Visibility: Organizations should monitor critical assets and groups with privileged access to defend against malicious behavior. Implement an insider threat management platform that provides your organization with the visibility and context into data movement, especially cross-border transfers that might cause security and privacy breaches.
    • Policy and Awareness Training: Insider threats will persist without appropriate action and culture change. Training and consistent communication of best practices will mitigate vulnerabilities to accidental or negligent attacks. Customized training materials using local languages and role-based case studies might be needed for employees in high-risk jurisdictions.
    • Cooperation: An effective insider threat management program should be built with cross-team functions such as Security, IT, Compliance and Legal, etc.

    For more holistic approach, you can leverage our Reduce and Manage Your Organization’s Insider Threat Risk blueprint.

    Info-Tech Insight

    You can’t just throw tools at a human problem. While organizations should monitor critical assets and groups with privileged access to defend against malicious behavior, good management and supervision can help detect attacks and prevent them from happening in the first place.

    Insider threats are not industry specific, but malicious insiders are

    Industry

    Actors

    Risks

    Tactics

    Motives

    State and Local Government

    • Full-time employees
    • Current employees
    • Privileged access to personally identifiable information, financial assets, and physical property
    • Abuse of privileged access
    • Received or transferred fraudulent funds
    • Financial gain
    • Recognition
    • Benefiting foreign entity

    Information Technology

    • Equal mix of former and current employees
    • Privileged access to networks or systems as well as data
    • Highly technical attacks
    • Received or transferred fraudulent funds
    • Revenge
    • Financial gain

    Healthcare

    • Majority were full-time and current employees
    • Privileged access to customer data with personally identifiable information, financial assets
    • Abuse of privileged access
    • Received or transferred fraudulent funds
    • Financial gain
    • Entitlement

    Finance and Insurance

    • Majority were full-time and current employees
    • Authorized users
    • Electronic financial assets
    • Privileged access to customer data
    • Created or used fraudulent accounts
    • Fraudulent purchases
    • Identity theft
    • Financial gain
    • Gambling addiction
    • Family pressures
    • Multiple motivations

    Source: Carnegie Mellon University Software Engineering Institute, 2019

    Advanced Persistent Threat

    Key Risk Scenario #4

    Likelihood: Medium to High

    Impact: High

    Gap Controls

    The image contains a screenshot of the Gap Controls listed: Prevent, Detect, Analyze, Respond.

    Prevent: Defense in depth is the best approach to protect against unknown and unpredictable attacks. Effective anti-malware, diligent patching and vulnerability management, and strong human-centric security are essential.

    Detect: There are two types of companies – those who have been breached and know it, and those who have been breached and don’t know it. Ensure that monitoring, logging, and event detection tools are in place and appropriate to your organizational needs.

    Analyze: Raw data without interpretation cannot improve security and is a waste of time, money, and effort. Establish a tiered operational process that not only enriches data but also provides visibility into your threat landscape.

    Respond: Organizations can’t rely on ad hoc response anymore – don’t wait until a state of panic. Formalize your response processes in a detailed incident runbook to reduce incident remediation time and effort.

    Best practices moving forward

    Defense in Depth

    Lock down your organization. Among other tactics, control administrative privileges, leverage threat intelligence, use IP whitelisting, adopt endpoint protection and two-factor authentication, and formalize incident response measures.

    Block Indicators

    Information alone is not actionable. A successful threat intelligence program contextualizes threat data, aligns intelligence with business objectives, and then builds processes to satisfy those objectives. Actively block indicators and act upon gathered intelligence.

    Drive Adoption

    Create organizational situational awareness around security initiatives to drive adoption of foundational security measures: network hardening, threat intelligence, red-teaming exercises, and zero-day mitigation, policies, and procedures.

    Supply Chain Security

    Security extends beyond your organization. Ensure your organization has a comprehensive view of your organizational threat landscape and a clear understanding of the security posture of any managed service providers in your supply chain.

    Awareness and Training

    Conduct security awareness and training. Teach end users how to recognize current cyberattacks before they fall victim – this is a mandatory first line of defense.

    Additional Resources

    Follow only official sources of information to help you assess risk

    The image contains an image highlighting a few additional resources.

    As misinformation is a major attack vector for malicious actors, follow only reliable sources for cyberalerts and actionable intelligence. Aggregate information from these reliable sources.

    Federal Cyber Agency Alerts

    Informational Resources

    Info-Tech Insight

    The CISA Shields Up site provides the latest cyber risk updates on the Russia-Ukraine conflict and should provide the most value in staying informed.

    Plan Your Digital Transformation on a Page

    • Buy Link or Shortcode: {j2store}81|cart{/j2store}
    • member rating overall impact: 8.0/10 Overall Impact
    • member rating average dollars saved: $34,649 Average $ Saved
    • member rating average days saved: 20 Average Days Saved
    • Parent Category Name: IT Strategy
    • Parent Category Link: /it-strategy
    • Digital investments often under deliver on expectations of return, and there is no cohesive approach to managing the flow of capital into digital.
    • The focus of the business has historically been to survive technological disruption rather than to thrive in it.
    • Strategy is based mostly on opinion rather than an objective analysis of the outcomes customers want from the organization.
    • Digital is considered a buzzword – nobody has a clear understanding of what it is and what it means in the organization’s context.

    Our Advice

    Critical Insight

    • The purpose of going digital is getting one step closer to the customer. The mark of a digital organization lies in how they answer the question, “How does what we’re doing contribute to what the customer wants from us?”
    • The goal of digital strategy is digital enablement. An organization that is digitally enabled no longer needs a digital strategy, it’s just “the strategy.”

    Impact and Result

    • Focus strategy making on delivering the digital outcomes that customers want.
      • Leverage the talent, expertise, and perspectives within the organization to build a customer-centric digital strategy.
    • Design a balanced digital strategy that creates value across the five digital value pools:
      • Digital marketing, digital channels, digital products, digital supporting capabilities, and business model innovation.
    • Ask how disruption can be leveraged, or even become the disruptor.
      • Manage disruption through quick-win approaches and empowering staff to innovate.
    • Use a Digital Strategy-on-a-Page to spark the digital transformation.
      • Drive awareness and alignment on the digital vision and spark your organization’s imagination around digital.

    Plan Your Digital Transformation on a Page Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to understand how digital disruption is driving the need for transformation, and how Info-Tech’s methodology can help.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Scope the digital transformation

    Learn how to apply the Digital Value Pools thought model and scope strategy around them.

    • Plan Your Digital Transformation on a Page – Phase 1: Scope the Digital Transformation

    2. Design the digital future state vision

    Identify business imperatives, define digital outcomes, and define the strategy’s guiding principles.

    • Plan Your Digital Transformation on a Page – Phase 2: Design the Digital Future State Vision
    • Digital Strategy on a Page

    3. Define the digital roadmap

    Define, prioritize, and roadmap digital initiatives and plan contingencies.

    • Plan Your Digital Transformation on a Page – Phase 3: Define the Digital Roadmap

    4. Sustain digital transformation

    Create, polish, and socialize the Digital Strategy-on-a-Page.

    • Plan Your Digital Transformation on a Page – Phase 4: Sustain Digital Transformation
    [infographic]

    Workshop: Plan Your Digital Transformation on a Page

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Scope the Digital Transformation

    The Purpose

    Identify the need for and use of digital strategy and determine a realistic scope for the digital strategy.

    Key Benefits Achieved

    The digital strategy project is planned and scoped around a subset of the five digital value pools.

    Activities

    1.1 Introduction to digital strategy.

    1.2 Establish motivation for digital.

    1.3 Discuss in-flight digital investments.

    1.4 Define the scope of digital.

    1.5 Identify stakeholders.

    1.6 Perform discovery interviews.

    1.7 Select two value pools to focus day 2, 3, and 4 activities.

    Outputs

    Business model canvas

    Stakeholder power map

    Discovery interview results

    Two value pools for focus throughout the workshop

    2 Design the Digital Future State Vision

    The Purpose

    Create guiding principles to help define future digital initiatives. Generate the target state with the help of strategic goals.

    Key Benefits Achieved

    Establish the basis for planning out the initiatives needed to achieve the target state from the current state.

    Activities

    2.1 Identify digital imperatives.

    2.2 Define key digital outcomes.

    2.3 Create a digital investment thesis.

    2.4 Define digital guiding principles.

    Outputs

    Corporate strategy analysis, PESTLE analysis, documented operational pain points (value streams)

    Customer needs assessment (journey maps)

    Digital investment thesis

    Digital guiding principles

    3 Define the Digital Roadmap

    The Purpose

    Understand the gap between the current and target state. Create transition options and assessment against qualitative and quantitative metrics to generate a list of initiatives the organization will pursue to reach the target state. Build a roadmap to plan out when each transition initiative will be implemented.

    Key Benefits Achieved

    Finalize the initiatives the organization will use to achieve the target digital state. Create a roadmap to plan out the timing of each initiative and generate an easy-to-present document for digital strategy approval.

    Activities

    3.1 Identify initiatives to achieve digital outcomes.

    3.2 Align in-flight initiatives to digital initiatives.

    3.3 Prioritize digital initiatives.

    3.4 Document architecturally significant requirements for high-priority initiatives.

    Outputs

    Digital outcomes and KPIs

    Investment/value pool matrix

    Digital initiative prioritization

    Architecturally significant requirements for high-priority initiatives

    4 Define the Digital Roadmap

    The Purpose

    Plan your approach to socializing the digital strategy to help facilitate the cultural changes necessary for digital transformation.

    Key Benefits Achieved

    Plant the seed of digital and innovation to start making digital a part of the organization’s DNA.

    Activities

    4.1 Review and refine Digital Strategy on a Page.

    4.2 Assess company culture.

    4.3 Define high-level cultural changes needed for successful transformation.

    4.4 Define the role of the digital transformation team.

    4.5 Establish digital transformation team membership and desired outcomes.

    Outputs

    Digital Strategy on a Page

    Strategyzer Culture Map

    Digital transformation team charter

    Stakeholder Relations

    • Buy Link or Shortcode: {j2store}25|cart{/j2store}
    • Related Products: {j2store}25|crosssells{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Strategy and Governance
    • Parent Category Link: /strategy-and-governance

    The challenge

    • Stakeholders come in a wide variety, often with competing and conflicting demands.
    • Some stakeholders are hard to identify. Those hidden agendas may derail your efforts.
    • Understanding your stakeholders' relative importance allows you to prioritize your IT agenda according to the business needs.

    Our advice

    Insight

    • Stakeholder management is an essential factor in how successful you will be.
    • Stakeholder management is a continuous process. The landscape constantly shifts.
    • You must also update your stakeholder management plan and approach on an ongoing basis.

    Impact and results 

    • Use your stakeholder management process to identify, prioritize, and manage key stakeholders effectively.
    • Continue to build on strengthening your relationships with stakeholders. It will help to gain easier buy-in and support for your future initiatives. 

    The roadmap

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    Make the case

    Identify stakeholders

    • Stakeholder Management Analysis Tool (xls)

    Analyze your stakeholders

    Assess the stakeholder's influence, interest, standing, and support to determine priority for future actions 

    Manage your stakeholders

    Develop your stakeholder management and communication plans

    • Stakeholder Management Plan Template (doc)
    • Communication Plan Template (doc)

    Monitor your stakeholder management plan performance

    Measure and monitor the success of your stakeholder management process.

     

     

    Develop a Project Portfolio Management Strategy

    • Buy Link or Shortcode: {j2store}331|cart{/j2store}
    • member rating overall impact: 9.4/10 Overall Impact
    • member rating average dollars saved: $111,064 Average $ Saved
    • member rating average days saved: 33 Average Days Saved
    • Parent Category Name: Project Management Office
    • Parent Category Link: /project-management-office
    • As an IT leader, you oversee a project environment in which the organizational demand for new products, services, and enhancements far outweighs IT’s resource capacity to adequately deliver on everything.
    • As a result, project throughput suffers. IT starts a lot of projects, but has constant difficulties delivering the bulk of them on time, on budget, in scope, and of high quality. What’s more, many of the projects that consume IT’s time are of questionable value to the business.
    • You need a project portfolio management (PPM) strategy to help bring order to IT’s project activity. With the right PPM strategy, you can ensure that you’re driving the throughput of the best projects and maximizing stakeholder satisfaction with IT.

    Our Advice

    Critical Insight

    • IT leaders commonly conflate PPM and project management, falsely believing that they already have a PPM strategy via their project management playbook. While the tactical focus of project management can help ensure that individual projects are effectively planned, executed, and closed, it is no supplement for the insight into “the big picture” that a PPM strategy can provide.
    • Many organizations falter at PPM by mistaking a set of processes for a strategy. While processes are no doubt important, without an end in mind – such as that provided by a deliberate strategy – they inevitably devolve into inertia or confusion.
    • Executive layer buy-in is a critical prerequisite for the success of a PPM strategy. Without it, any efforts to reconcile supply and demand, and improve the strategic value of IT’s project activity, could be quashed by irresponsible, non-compliant stakeholders.

    Impact and Result

    • Manage the portfolio as more than just the sum of its parts. Create a coherent strategy to maximize the sum of values that projects deliver as a whole – as a project portfolio, rather than a collection of individual projects.
    • Get to value early. Info-Tech’s methodology tackles one of PPM’s most pressing challenges upfront by helping you to articulate a strategy and get executive buy-in for it before you define your process goals. When senior management understands why a PPM strategy is necessary and of value to them, the path to implementation is much more stable.
    • Create PPM processes you can sustain. Translate your PPM strategy into specific, tangible near-term and long-term goals, which are realized through a suite of project portfolio management processes tailored to your organization and its culture.

    Develop a Project Portfolio Management Strategy Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should develop a project portfolio management strategy, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Develop a Project Portfolio Management Strategy – Executive Brief
    • Develop a Project Portfolio Management Strategy – Phases 1-3

    1. Get executive buy-in for your PPM strategy

    Choose the right PPM strategy for your organization and get executive buy-in before you start to set PPM process goals.

    • Develop a Project Portfolio Management Strategy – Phase 1: Get Executive Buy-In for Your PPM Strategy
    • PPM High-Level Supply-Demand Calculator
    • PPM Strategic Plan Template
    • PPM Strategy-Process Goals Translation Matrix Template

    2. Align PPM processes to your strategic goals

    Use the advice and tools in this phase to align the PPM processes that make up the infrastructure around projects with your new PPM strategy.

    • Develop a Project Portfolio Management Strategy – Phase 2: Align PPM Processes to Your Strategic Goals
    • PPM Strategy Development Tool

    3. Complete your PPM strategic plan

    Refine your PPM strategic plan with inputs from the previous phases by adding a cost-benefit analysis and PPM tool recommendation.

    • Develop a Project Portfolio Management Strategy – Phase 3: Complete Your PPM Strategic Plan
    • Project Portfolio Analyst / PMO Analyst
    [infographic]

    Workshop: Develop a Project Portfolio Management Strategy

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Get Executive Buy-In for Your PPM Strategy

    The Purpose

    Choose the right PPM strategy for your organization and ensure executive buy-in.

    Set process goals to address PPM strategic expectations and steer the PPM strategic plan.

    Key Benefits Achieved

    A right-sized PPM strategy complete with executive buy-in for it.

    A prioritized list of PPM process goals.

    Activities

    1.1 Assess leadership mandate.

    1.2 Determine potential resource capacity.

    1.3 Create a project inventory.

    1.4 Prepare to communicate your PPM strategy to key stakeholders.

    1.5 Translate each strategic goal into process goals.

    1.6 Set metrics and preliminary targets for PPM process goals.

    Outputs

    Choice of PPM strategy and the leadership mandate

    Analysis of current project capacity

    Analysis of current project demand

    PPM Strategic Plan – Executive Brief

    PPM strategy-aligned process goals

    Metrics and long-term targets for PPM process goals

    2 Align PPM Processes to Your Strategic Goals

    The Purpose

    Examine your current-state PPM processes and create a high-level description of the target-state process for each of the five PPM processes within Info-Tech’s PPM framework.

    Build a sound business case for implementing the new PPM strategy by documenting roles and responsibilities for key PPM activities as well as the time costs associated with them.

    Key Benefits Achieved

    Near-term and long-term goals as well as an organizationally specific wireframe for your PPM processes.

    Time cost assumptions for your proposed processes to ensure sustainability.

    Activities

    2.1 Develop and refine the project intake, prioritization, and approval process.

    2.2 Develop and refine the resource management process.

    2.3 Develop and refine the portfolio reporting process.

    2.4 Develop and refine the project closure process

    2.5 Develop and refine the benefits realization process.

    Outputs

    Process capability level

    Current-state PPM process description

    Retrospective examination of the current-state PPM process

    Action items to achieve the target states

    Time cost of the process at current and target states

    3 Complete Your PPM Strategic Plan

    The Purpose

    Perform a PPM tool analysis in order to determine the right tool to support your processes.

    Estimate the total cost-in-use of managing the project portfolio, as well as the estimated benefits of an optimized PPM strategy.

    Key Benefits Achieved

    A right-sized tool selection to help support your PPM strategy.

    A PPM strategy cost-benefit analysis.

    Activities

    3.1 Right-size the PPM tools for your processes.

    3.2 Conduct a cost-benefit analysis of implementing the new PPM strategy.

    3.3 Define roles and responsibilities for the new processes.

    3.4 Refine and consolidate the near-term action items into a cohesive plan.

    Outputs

    Recommendation for a PPM tool

    Cost-benefit analysis

    Roles and responsibilities matrix for each PPM process

    An implementation timeline for your PPM strategy

    Further reading

    Develop a Project Portfolio Management Strategy

    Drive IT project throughput by throttling resource capacity.

    Analyst Perspective

    “Tactics without strategy is the noise before defeat.” – Sun Tzŭ

    "Organizations typically come to project portfolio management (PPM) with at least one of two misconceptions: (1) that PPM is synonymous with project management and (2) that a collection of PPM processes constitutes a PPM strategy.

    Both foundations are faulty: project management and PPM are separate disciplines with distinct goals and processes, and a set of processes do not comprise a strategy – they should flow from a strategy, not precede one. When built upon these foundations, the benefits of PPM go unrealized, as the means (i.e. project and portfolio processes) commonly eclipse the ends of a PPM strategy – e.g. a portfolio better aligned with business goals, improved project throughput, increased stakeholder satisfaction, and so on.

    Start with the end in mind: articulate a PPM strategy that is truly project portfolio in nature, i.e. focused on the whole portfolio and not just the individual parts. Then, let your PPM strategy guide your process goals and help to drive successful outcomes, project after project." (Barry Cousins, Senior Director of Research, PMO Practice, Info-Tech Research Group)

    Our understanding of the problem

    This Research Is Designed For:

    • CIOs who want to maximize IT’s fulfillment of both business strategic goals and operational needs.
    • CIOs who want to better manage the business and project sponsors’ expectations and satisfaction.
    • CIOs, PMO directors, and portfolio managers who want a strategy to set the best projects for the highest chance of success.

    This Research Will Help You:

    • Get C-level buy-in on a strategy for managing the project portfolio and clarify their expectations on how it should be managed.
    • Draft strategy-aligned, high-level project portfolio management process description.
    • Put together a strategic plan for improving PPM processes to reclaim wasted project capacity and increase business satisfaction of IT.

    This Research Will Also Assist:

    • Steering committee and C-suite management who want to maximize IT’s value to business.
    • Project sponsors who seek clarity and fairness on pushing their projects through a myriad of priorities and objectives.
    • CIOs, PMO directors, and portfolio managers who want to enable data-driven decisions from the portfolio owners.

    This Research Will Help Them:

    • Optimize IT’s added value to the business through project delivery.
    • Provide clarity on how IT’s project portfolio should be managed and the expectations for its management.
    • Improve project portfolio visibility by making trustworthy project portfolio data available, with which to steer the portfolio.

    Executive Summary

    Situation

    • As CIO, there are too many projects and not enough resource capacity to deliver projects on time, on budget, and in scope with high quality.
    • Prioritizing projects against one another is difficult in the face of conflicting priorities and agenda; therefore, projects with dubious value/benefits consume resource capacity.

    Complication

    • Not all IT projects carry a direct value to business; IT is accountable for keeping the lights on and it consumes a significant amount of resources.
    • Business and project sponsors approve projects without considering the scarcity of resource capacity and are frustrated when the projects fail to deliver or linger in the backlog.

    Resolution

    • Create a coherent strategy to maximize the total value that projects deliver as a whole portfolio, rather than a collection of individual projects.
    • Ensure that the steering committee or senior executive layer buys into the strategy by helping them understand why the said strategy is necessary, and more importantly, why the strategy is valuable to them.
    • Translate the strategic expectations to specific, tangible goals, which are realized through a suite of project portfolio management processes tailored to your organization and its culture.
    • Putting into place people, processes, and tools that are sustainable and manageable, plus a communication strategy to maintain the stakeholder buy-in.

    Info-Tech Insight

    1. Time is money; therefore, the portfolio manager is an accountant of time. It is the portfolio manager’s responsibility to provide the project portfolio owners with reliable data and close the loop on portfolio decisions.
    2. Business satisfaction is driven by delivering projects that align to and maximize business value. Use Info-Tech’s method for developing a PPM strategy and synchronize its definition of “best projects” with yours.

    Projects that deliver on strategic goals of the business is the #1 driver of business satisfaction for IT

    Info-Tech’s CIO Business Vision Survey (N=21,367) has identified a direct correlation between IT project success and overall business satisfaction with IT.

    Comparative rankings of IT services in two columns 'Reported Importance' and 'Actual Importance' with arrows showing where each service moved to in the 'Actual Importance' ranking. The highlighted move is 'Projects' from number 10 in 'Reported' to number 1 in 'Actual'. 'Reported' rankings from 1 to 12 are 'Network Infrastructure', 'Service Desk', 'Business Applications', 'Data Quality', Devices', 'Analytical Capability', 'Client-Facing Technology', 'Work Orders', 'Innovation Leadership', 'Projects', 'IT Policies', and 'Requirements Gathering'. 'Actual' rankings from 1 to 12 are 'Projects', 'Work Orders', 'Innovation Leadership', 'Business Applications', 'Requirements Gathering', 'Service Desk', 'Client-Facing Technology', 'Network Infrastructure', 'Analytical Capability', 'Data Quality', 'IT Policies', and 'Devices'.

    Reported Importance: Initially, when CIOs were asked to rank the importance of IT services, respondents ranked “projects” low on the list – 10 out of a possible 12.

    Actual Importance: Despite this low “reported importance,” of those organizations that were “satisfied” to “fully satisfied” with IT, the service that had the strongest correlation to high business satisfaction was “projects,” i.e. IT’s ability to help plan, support, and execute projects and initiatives that help the business achieve its strategic goals.

    On average, executives perceive IT as being poorly aligned with business strategy

    Info-Tech’s CIO Business Vision Survey data highlights the importance of IT projects in supporting the business achieve its strategic goals. However, Info-Tech’s CEO-CIO Alignment Survey (N=124) data indicates that CEOs perceive IT to be poorly aligned to business’ strategic goals:

    • 43% of CEOs believe that business goals are going unsupported by IT.
    • 60% of CEOs believe that improvement is required around IT’s understanding of business goals.
    • 80% of CIOs/CEOs are misaligned on the target role for IT.
    • 30% of business stakeholders* are supporters of their IT departments.
    • (Source: Info-Tech CIO/CEO Alignment Diagnostics, * N=32,536)

    Efforts to deliver on projects are largely hampered by causes of project failure outside a project manager’s control

    The most recent data from the Project Management Institute (PMI) shows that more projects are meeting their original goals and business intent and less projects are being deemed failures. However, at the same time, more projects are experiencing scope creep. Scope creeps result in schedule and cost overrun, which result in dissatisfied project sponsors, stakeholders, and project workers.

    Graph of data from Project Management Institute comparing projects from 2015 to 2017 that 'Met original goals/business intent', 'Experienced scope creep', and were 'Deemed failures'. Projects from the first two categories went up in 2017, while projects that were deemed failures went down.

    Meanwhile, the primary causes of project failures remain largely unchanged. Interestingly, most of these primary causes can be traced to sources outside of a project manager’s control, either entirely or in part. As a result, project management tactics and processes are limited in adequately addressing them.

    Relative rank

    Primary cause of project failure

    2015

    2016

    2017

    Trend

    Change in organization's priorities 1st 1st 1st Stable
    Inaccurate requirements gathering 2nd 3rd 2nd Stable
    Change in project objectives 3rd 2nd 3rd Stable
    Inadequate vision/goal for project 6th 5th 4th Rising
    Inadequate/poor communication 5th 7th 5th Stable
    Poor change management 11th 9th 6th Rising
    (Source: Project Management Institute, Pulse of the Profession, 2015-2017)

    Project portfolio management (PPM) can improve business alignment of projects and reduce chance of project failure

    PPM is about “doing the right things.”

    The PMI describes PPM as:

    Interrelated organizational processes by which an organization evaluates, selects, prioritizes, and allocates its limited internal resources to best accomplish organizational strategies consistent with its vision, mission, and values. (PMI, Standard for Portfolio Management, 3rd ed.)

    Selecting and prioritizing projects with the strongest alignment to business strategy goals and ensuring that resources are properly allocated to deliver them, enable IT to:

    1. Improve business satisfaction and their perception of IT’s alignment with the business.
    2. Better engage the business and the project customers.
    3. Minimize the risk of project failure due to changing organizational/ project vision, goals, and objectives.

    "In today’s competitive business environment, a portfolio management process improves the linkage between corporate strategy and the selection of the ‘right’ projects for investment. It also provides focus, helping to ensure the most efficient and effective use of available resources." (Lou Pack, PMP, Senior VP, ICF International (PMI, 2015))

    PPM is a common area of shortcomings for IT, with much room for improvement

    Info-Tech’s IT Management & Governance Survey (N=879) shows that PPM tends to be regarded as neither an effective nor an important process amongst IT organizations.

    Two deviation from median charts highlighting Portfolio Management's ranking compared to other IT processes in 'Effectiveness scores' and 'Importance scores'. PPM ranks 37th out of 45 in Effectiveness and 33rd out of 45 in Importance.

    55% ... of IT organizations believe that their PPM processes are neither effective nor important.

    21% ... of IT organizations reported having no one responsible or accountable for PPM.

    62% ... of projects in organizations effective in PPM met/exceeded the expected ROI (PMI, 2015).

    In addition to PPM’s benefits, improving PPM processes presents an opportunity for getting ahead of the curve in the industry.

    Info-Tech’s methodology for developing a PPM strategy delivers extraordinary value, fast

    Our methodology is designed to tackle your hardest challenge first to deliver the highest-value part of the deliverable. For developing a PPM strategy, the biggest challenge is to get the buy-in of the executive layer.

    "Without senior management participation, PPM doesn’t work, and the organization is likely to end up with, or return to, a squeaky-wheel-gets-the-grease mindset for all those involved." (Mark Price Perry, Business Driven Project Portfolio Management)

    In the first step of the blueprint, you will be guided through the following steps:

    1. Choose the right PPM strategy: driven by the executives, supported by management.
    2. Objectively assess your current project portfolio with minimal effort to build a case for the PPM strategy.
    3. Engage the executive layer to get the critical prerequisite of a PPM strategy: their buy-in.

    A PPM strategic plan is the end deliverable of this blueprint. In the first step, download the pre-filled template with content that represents the most common case. Then, throughout the blueprint, customize with your data.

    Use this blueprint to develop, or refine, a PPM strategy that works for your organization

    Get buy-in for PPM strategy from decision makers.

    Buy-in from the owners of project portfolio (Steering Committee, C-suite management, etc.) is a critical prerequisite for any PPM strategy. This blueprint will give you the tools and templates to help you make your case and win the buy-in of portfolio owners.

    Connect strategic expectations to PPM process goals.

    This blueprint offers a methodology to translate the broad aim of PPM to practical, tactical goals of the five core PPM processes, as well as how to measure the results. Our methodology is supported with industry-leading frameworks, best practices, and our insider research.

    Develop your PPM processes.

    This blueprint takes you through a series of steps to translate the process goals into a high-level process description, as well as a business case and a roadmap for implementing the new PPM processes.

    Refine your PPM processes.

    Our methodology is also equally as applicable for making your existing PPM processes better, and help you draft a roadmap for improvement with well-defined goals, roles, and responsibilities.

    Info-Tech’s PPM model consists of five core processes

    There are five core processes in Info-Tech’s thought model for PPM.

    Info-Tech's Process Model detailing the steps and their importance in project portfolio management. Step 3: 'Status and Progress Reporting' sits above the others as a process of importance throughout the model. In the 'Intake' phase of the model are Step 1: 'Intake, Approval, and Prioritization' and Step 2: 'Resource Management'. In the 'Execution' phase is 'Project Management', the main highlighted section, and a part of Step 3, the overarching 'Status and Progress Reporting'. In the 'Closure' phase of the model are Step 4: 'Project Closure' and Step 5: 'Benefits Tracking'.

    These processes create an infrastructure around projects, which aims to enable:

    1. Initiation of the “best” projects with the right resources and project information.
    2. Timely and trustworthy reporting to facilitate the flow of information for better decision making.
    3. Proper closure of projects, releasing resources, and managing benefits realization.

    PPM has many moving pieces. To ensure that all of these processes work in harmony, you need a PPM strategy.

    De-couple project management from PPM to break down complexity and create flexibility

    Tailor project management (PM) processes to fit your projects.

    Info-Tech’s PPM thought model enables you to manage your project portfolio independent of your PM methodology or capability. Projects interact with PPM via:

    • A project charter that authorizes the use of resources and defines project benefits.
    • Status reports that feed up-to-date, trustworthy data to your project portfolio.
    • Acceptance of deliverables that enable proper project closure and benefits reporting.

    Info-Tech’s PPM strategy is applicable whether you use Agile, waterfall, or anything in between for PM.

    The process model from the previous page but with project management processes overlaid. The 'Intake' phase is covered by 'Project Charter'. The 'Execution' phase, or 'Project Management' is covered by 'Status report'. The 'Closure' phase is covered by 'Deliverable Acceptance'.

    Learn about project management approach for small projects in Info-Tech’s Tailor PM Processes to Fit Your Projects blueprint.

    Sample of the Info-Tech blueprint 'Tailor PM Processes to Fit Your Projects'.

    Info-Tech’s approach to PPM is informed by industry best practices and rooted in practical insider research

    Info-Tech uses PMI and ISACA frameworks for areas of this research.

    Logo for 'Project Management Institute (PMI)'.' Logo for 'COBIT 5 an ISACA Framework'.
    PMI’s Standard for Portfolio Management, 3rd ed. is the leading industry framework, proving project portfolio management best practices and process guidelines. COBIT 5 is the leading framework for the governance and management of enterprise IT.

    In addition to industry-leading frameworks, our best-practice approach is enhanced by the insights and guidance from our analysts, industry experts, and our clients.

    Logo for 'Info-Tech Research Group'.

    33,000+ Our peer network of over 33,000 happy clients proves the effectiveness of our research.

    1000+ Our team conducts 1,000+ hours of primary and secondary research to ensure that our approach is enhanced by best practices.

    Re-position IT as the “facilitator of business projects” for PPM success

    CASE STUDY

    Industry: Construction
    Source: Info-Tech Client

    Chaos in the project portfolio

    At first, there were no less than 14 teams of developers, each with their own methodologies and processes. Changes to projects were not managed. Only 35% of the projects were completed on time.

    Business drives, IT facilitates

    Anyone had the right to ask for something; however, converting ideas to a formal project demand required senior leadership within a business division getting on board with the idea.

    The CIO and senior leadership decided that projects, previously assigned to IT, were to be owned and driven by the business, as the projects are undertaken to serve its needs and rarely IT’s own. The rest of the organization understood that the business, not IT, was accountable for prioritizing project work: IT was re-positioned as a facilitator of business projects. While it was a long process, the result speaks for itself: 75% of projects were now being completed on time.

    Balancing the target mix of the project portfolio

    What about maintaining and feeding the IT infrastructure? The CIO reserved 40% of IT project capacity for “keeping the lights on,” and 20% for reactive, unplanned activities, with an aim to lower this percentage. With the rest of the time, IT facilitated business projects

    Three key drivers of project priority

    1. Does the project meet the overall company goals and objectives?
      “If they don't, we must ask why we are bothering with it.”
    2. Does the project address a regulatory or compliance need?
      “Half of our business is heavily regulated. We must focus on it.”
    3. Are there significant savings to be had?
      “Not soft; hard savings. Can we demonstrate that, after implementing this, can we see good hard results? And, can we measure it?”

    "Projects are dumped on IT, and the business abdicates responsibility. Flip that over, and say ‘that's your project’ and ‘how can we help you?’"

    Use these icons to help direct you as you navigate this research

    Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.

    A small monochrome icon of a wrench and screwdriver creating an X.

    This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project.

    A small monochrome icon depicting a person in front of a blank slide.

    This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization.

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    Guided Implementation

    Workshop

    Consulting

    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks used throughout all four options

    Develop a PPM strategy – project overview

    1. Get executive buy-in for your PPM strategy

    2. Align PPM processes to your strategic goals

    3. Complete your PPM strategic plan

    Supporting Tool icon

    Best-Practice Toolkit

    1.1 Choose the right PPM strategy for your organization

    1.2 Translate PPM strategy expectations to specific process goals

    2.1 Develop and refine project intake, prioritization, and resource management processes

    2.2 Develop and refine portfolio reporting, project closure, and benefits realization processes

    3.1 Select a right-sized PPM solution for supporting your new processes

    3.2 Finalize customizing your PPM Strategic Plan Template

    Guided Implementations

    • Scoping call: discuss current state of PPM and review strategy options.
    • How to wireframe realistic process goals, rooted in your PPM strategic expectations, that will be sustained by the organization.
    • Examine your current-state PPM process and create a high-level description of the target-state process for each of the five PPM processes (1-2 calls per each process).
    • Assess your PPM tool requirements to help support your processes.
    • Determine the costs and potential benefits of your PPM practice.
    Associated Activity icon

    Onsite Workshop

    Module 1:
    Set strategic expectations and realistic goals for the PPM strategy
    Module 2:
    Develop and refine strategy-aligned PPM processes
    Module 3:
    Compose your PPM strategic plan
    Phase 1 Outcome:
    • Analysis of the current state of PPM
    • Strategy-aligned goals and metrics for PPM processes
    Phase 2 Outcome:
    • PPM capability levels
    • High-level descriptions of near- and long-term target state
    Phase 3 Outcome:
    • PPM tool recommendations
    • Cost-benefit analysis
    • Customized PPM strategic plan

    Workshop overview

    Contact your account representative or email Workshops@InfoTech.com for more information.

    Workshop Day 1

    Workshop Day 2

    Workshop Day 3

    Workshop Day 4

    Workshop Day 5

    Get leadership buy-in for PPM strategy Set PPM process goals and metrics with strategic expectations Develop and Refine PPM processes Develop and Refine PPM processes Complete the PPM strategic plan

    Activities

    • 1.1 Assess leadership mandate.
    • 1.2 Determine potential resource capacity.
    • 1.3 Create a project inventory.
    • 1.4 Communicate your PPM strategy to key stakeholders.
    • 2.1 Translate each strategic goal into process goals.
    • 2.2 Set metrics and preliminary targets for PPM process goals.
    • 3.1 Develop and refine the project intake, prioritization, and approval process.
    • 3.2 Develop and refine the resource management process.
    • 4.1 Develop and refine the portfolio reporting process.
    • 4.2 Develop and refine the project closure process.
    • 4.3 Develop and refine the benefits realization process.
    • 5.1 Right-size the PPM tools for your processes.
    • 5.2 Conduct a cost-benefit analysis of implementing the new PPM strategy.
    • 5.3 Define roles and responsibilities for the new processes.

    Deliverables

    1. Choice of PPM strategy and the leadership mandate
    2. Analysis of current project capacity
    3. Analysis of current project demand
    4. PPM Strategic Plan – Executive Brief
    1. PPM strategy-aligned process goals
    2. Metrics and long-term targets for PPM process goals
      For each of the five PPM processes:
    1. Process capability level
    2. Current-state PPM process description
    3. Retrospective examination of the current-state PPM process
    4. Action items to achieve the target states
    5. Time cost of the process at current and target states
    1. Recommendation for a PPM tool
    2. Cost-benefit analysis
    3. Roles and responsibilities matrix for each PPM process

    Develop a Project Portfolio Management Strategy

    PHASE 1

    Get Executive Buy-In for Your PPM Strategy

    Phase 1 outline

    Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 1: Get executive buy-in for your PPM strategy

    Proposed Time to Completion: 2 weeks
    Step 1.1: Choose the right PPM strategy Step 1.2: Translate strategic expectations to process goals
    Start with an analyst kick-off call:
    • Scoping call to discuss the current state of PPM and review strategy options.
    Work with an analyst to:
    • Discuss how to wireframe realistic process goals, rooted in your PPM strategic expectations, that will be sustained by the organization.
    Then complete these activities…
    • Execute a leadership mandate survey.
    • Perform a high-level supply/demand analysis.
    • Prepare an executive presentation to get strategy buy-in.
    Then complete these activities…
    • Develop realistic process goals based in your PPM strategic expectations.
    • Set metrics and preliminary targets for your high-priority PPM process goals.
    With these tools & templates:
    • PPM High-Level Supply/Demand Calculator
    • PPM Strategic Plan Template
    With these tools & templates:
    • PPM Strategy-Process Translation Matrix

    Phase 1 Results & Insights

    • Executive layer buy-in is a critical prerequisite for the success of a top-down PPM strategy. Ensure your executives are onboard before proceeding to implement your PPM strategy.

    Prepare to get to value early with step 1.1 of this blueprint

    The first step of this blueprint will help you define your PPM strategy and get executive buy-in for it using section one of Info-Tech’s PPM Strategic Plan Template.

    Where traditional models of consulting can take considerable amounts of time before delivering value to clients, Info-Tech’s methodology for developing a PPM strategy gets you to value fast.

    In the first step of this blueprint, you will define your PPM strategy and prepare an executive presentation to get buy-in for the strategy. The presentation can be prepared in just a few hours.

    • The activities in step 1.1 of this blueprint will help you customize the slides in section 1 of Info-Tech’s PPM Strategic Plan Template.
    • Section one of the Template will then serve as your presentation document.

    Once you have received buy-in for your PPM strategy, the remainder of this blueprint will help you customize section 2 of the Template.

    • Section 2 of the Template will communicate:
      • Your processes and process goals.
      • Your near-term and long-term action items for implementing the strategy.
      • Your PPM tool requirements.
      • The costs and benefits of your PPM strategy.

    Download Info-Tech’s PPM Strategic Plan Template.

    Sample of Info-Tech's 'PPM Strategic Plan Template.'

    Step 1.1: Choose the right PPM strategy for your organization

    PHASE 1

    PHASE 2

    PHASE 3

    1.1 1.2 2.1 2.2 3.1 3.2
    Choose the right PPM strategy Translate strategy into process goals Define intake & resource mgmt. processes Define reporting, closure, & benefits mgmt. processes Select a right-sized PPM solution Finalize your PPM strategic plan

    This step will walk you through the following activities:

    • Perform a leadership mandate survey.
    • Choose your PPM strategy.
    • Calculate your resource capacity for projects.
    • Determine overall organizational demand for projects.
    • Prepare an executive presentation of the PPM strategy.

    This step involves the following participants:

    • CIO
    • PMO Director/Portfolio Manager
    • Project Managers
    • IT Managers

    Outcomes of this step

    • A PPM strategy
    • A resource supply/project demand analysis
    • An executive brief presentation
    • Executive buy-in for the PPM strategy

    “Too many projects, not enough resources” is the reality of most IT environments

    In today’s organizations, the desires of business units for new products and enhancements, and the appetites of senior leadership to approve more and more projects for those products and services, far outstrips IT’s ability to realistically deliver on everything.

    The vast majority of IT departments lack the resourcing to meet project demand – especially given the fact that day-to-day operational demands frequently trump project work.

    As a result, project throughput suffers – and with it, IT's reputation within the organization.

    A visualization of 'Project Demand' versus 'Resource supply' utilizing courtroom scales with numerous project titles weighing down the 'Project Demand' side and silhouettes of three little people raised aloft on the 'Resource supply' side.

    In these environments, a PPM strategy is required.

    A PPM strategy should enable executive decision makers to make sense of the excess of demand and give IT the ability to prioritize those projects that are of the most strategic value to the business.

    With the right PPM strategy, IT can improve project outcomes across its portfolio and drive business value – all while improving the workloads of IT project staff.

    Info-Tech has two PPM strategy options that you can start to deploy today

    This step will help you choose the most suitable option, depending on your project pain points and current level of executive engagement in actively steering the portfolio.

    Option A:
    Top-Down, Executive Driven Strategy

    Option B:
    Bottom-Up, Project Manager Driven Strategy

    Goals of this approach:
    • This approach is intended to assist decision makers in their job: choosing the right projects, committing to timelines for those projects, and monitoring/directing their progress.
    Goals of this approach:
    • This approach is primarily intended to ensure that projects are well managed in a standardized manner in order to provide project managers with clear direction.
    Who this approach is for:
    • IT departments looking to improve alignment of project demand and resource capacity.
    • IT departments wanting to prioritize strategically valuable work.
    • IT departments with sufficient executive backing and engagement with the portfolio.
    Who this approach is for:
    • IT departments that would not the get support for a top-down approach due to a disengaged executive layer.
    • IT departments that already have a top-down PPM strategy and feel they are sufficiently resourced to confront project demand.

    Each of these strategy options is driven by a set of specific strategic expectations to help communicate your PPM goals. See the following slides for an articulation of each strategy option.

    A top-down, executive driven strategy is the optimal route, putting leadership in a position to best conduct the portfolio

    Option A: Top-Down, Executive Driven Strategy

    Strategic Expectations:

    • Project Throughput: Maximize throughput of the best projects.
    • Portfolio Visibility: Ensure visibility of current and pending projects.
    • Portfolio Responsiveness: Make the portfolio responsive to executive steering when new projects and changing priorities need rapid action.
    • Resource Utilization: Minimize resource waste and optimize the alignment of skills to assignments.
    • Benefits Realization: Clarify accountability for post-project benefits attainment for each project, and facilitate the process of tracking/reporting those benefits.

    Info-Tech Insight

    Serve the executive with insight before you impede the projects with governance. This strategy option is where Info-Tech sees the most PPM success. A strategy focused at improving decision making at the executive layer will both improve project outcomes and help alleviate project workloads.

    A bottom-up strategy can help project managers and teams succeed where insight into the big picture is lacking

    Option B: Bottom-Up, Project Manager Driven Strategy

    Strategic Expectations:

    • Project Management Governance: All projects consuming IT resources will be continually validated in terms of best-practice process compliance.
    • Project Risk Management: Identify risks and related mitigation approaches for all high-risk areas.
    • Stakeholder Management: Ensure that project stakeholders are identified and involved.
    • Project Manager Resourcing: Provide project managers as needed.
    • Project-Level Visibility: Provide access to the details of project management processes (planning and progress) as needed.

    Info-Tech Insight

    Right-size governance to maximize success. Project management and governance success don’t necessarily equal project success. Project management processes should be a means to an end (i.e. successful project outcomes), and not an end in themselves. Ensure the ends justify the means.

    Most recurring project challenges require a top-down portfolio management approach

    While project management is a key ingredient to project success, tying to solve endemic project problems with project management alone won’t improve results over the long term.

    Why Top-Down is a better starting point than Bottom-Up.

    The most common IT project problems – schedule and budget overruns, scope creep, and poor quality – can ultimately, in the vast majority of cases, be traced back to bad decisions made at the portfolio level:

    • The wrong projects get greenlighted.
    • Shifting leadership priorities and operational demands make project plans and estimated delivery dates obsolete from the start.
    • Too many projects get approved when there are not enough resources to effectively work on them all.

    No amount of project management rigor can help alleviate these common root causes of project failure.

    With a top-down PPM strategy, however, you can make sure that leadership is informed and engaged in making the right project decisions and that project managers and teams are situated for success.

    "There is nothing so useless as doing efficiently that which should not be done at all." (Peter Drucker (quoted in Lessing))

    Info-Tech Insight

    Get Strategic About Project Success.

    The difference between project management and project portfolio management comes down to doing things right vs. doing the right things. Both are important, no doubt; but doing the wrong things well doesn’t provide much value to the business in the long run.

    Get insight into the big picture with a top-down strategy before imposing more administrative overhead on project managers and leads.

    Perform a leadership mandate assessment to gauge executive needs and expectations

    Associated Activity icon 1.1.1 – 15 to 30 minutes (prep time) 10 to 20 minutes (execution time)

    INPUT: Leadership expectations for portfolio and project management.

    OUTPUT: Leadership mandate bar chart

    Materials: Tab 6 of Info-Tech’s PPM High-Level Supply-Demand Calculator

    Participants: Portfolio manager (or equivalent), PPM strategy sponsor(s), CIO and other members of senior management

    Before choosing your strategy option, survey the organization’s leadership to assess what they’re expecting from the PPM strategy.

    Use the “Leadership Mandate Survey” (located on tab 6 of Info-Tech’s PPM High-Level Supply-Demand Calculator) to assess the degree to which your leadership expects the PPM strategy to provide outcomes across the following capabilities: portfolio reporting, project governance, and project management.

    • Deploy the 12-question survey via individual one-on-one meetings or group working sessions with your boss (the PPM strategy sponsor) as well as with the CIO and other senior managers from within IT and the business.
      • If you cannot connect with the executive layer for this survey, do your best to estimate their responses to complete the survey.
    • The survey should help distinguish if executives are looking for portfolio management or project management. It should be one input that informs your choice of strategy option A or B.
      • If leadership is looking primarily for project management, you should proceed to Info-Tech’s Tailor Project Management Processes that Fit Your Projects blueprint.

    Refer to the next slide for assistance analyzing the outputs in tab 6 and using them to inform your choice of strategy.

    How to make use of the results of the leadership survey

    Two possible result scenarios of the leadership survey. There are two bar graphs titled 'Leadership Mandate', each with an explanation of the scenario they belong to. In Scenario 1, the 'Leadership Mandate' graph has a descending trend with 'Portfolio Reporting' at the highest level, 'Project Governance' in the middle, and 'Project Management' at the lowest level. 'A result like this, with a higher portfolio reporting score, shows a higher need for a top-down approach and demonstrates well-balanced expectations for a PPM strategy from the leadership. There is greater emphasis put on the portfolio than there is project governance or project management.' In Scenario 2, the 'Leadership Mandate' graph has an ascending trend with 'Portfolio Reporting' at the lowest level, 'Project Governance' in the middle, and 'Project Management' at the highest level. 'If your graph looks like this, your executive leadership has placed greater importance on project governance and management. Completing a top-down PPM strategy may not meet their expectations at this time. In this situation, a bottom-up approach may be more applicable.'

    Customize Info-Tech’s PPM Strategic Plan Template. Insert screenshots of the survey and the bar graph from tab 6 of the PPM High-Level Supply-Demand Calculator onto slides 7 and 8, “PPM Strategy Leadership Mandate,” of the PPM Strategic Plan Template.

    Proceed with the right PPM strategy for your organization

    Based upon the results of the “Leadership Mandate Survey,” and your assessment of each strategy option as described in the previous slides, choose the strategy option that is right for your IT department/PMO at this time.

    "Without a strategic methodology, project portfolio planning is frustrating and has little chance of achieving exceptional business success." (G Wahl (quoted in Merkhofer))

    Option A:

    Those proceeding with Option A should continue with remainder of this blueprint. Update your strategy statement on slide 3 of your PPM Strategic Plan Template to reflect your choice

    Option B:

    Those proceeding with Option B should exit this blueprint and refer to Info-Tech’s Tailor Project Management Processes to Fit Your Projects blueprint to help define a project management standard operating procedure.

    Customize Info-Tech’s PPM Strategic Plan Template. If you’re proceeding with Option A, update slide 4, “Project Portfolio Management Strategy,” of your PPM Strategic Plan Template to reflect your choice of PPM strategy. If you’re proceeding with Option B, you may want to include your strategy statement in your Project Management SOP Template.

    The success of your top-down strategy will hinge on the quality of your capacity awareness and resource utilization

    A PPM strategy should facilitate alignment between project demand with resource supply. Use Info-Tech’s PPM High-Level Supply/Demand Calculator as a step towards this alignment.

    Info-Tech’s research shows that the ability to provide a centralized view of IT’s capacity for projects is one of the top PPM capabilities that contributes to overall project success.

    Accurate and reliable forecasts into IT’s capacity, coupled with an engaged executive layer making project approval and prioritization decisions based upon that capacity data, is the hallmark of an effective top-down PPM strategy.

    • Use Info-Tech’s PPM High-Level Supply/Demand Calculator to help improve visibility (and with it, organizational understanding) into project demand and IT resource supply.
    • The Calculator will help you determine IT’s actual capacity for projects and analyze organizational demand by taking an inventory of active and backlog projects.

    Download Info-Tech’s PPM High-Level Supply/Demand Calculator.

    Sample of Into-Tech's PPM High-Level Supply/Demand Calculator.

    Info-Tech Insight

    Where does the time go? The portfolio manager (or equivalent) should function as the accounting department for time, showing what’s available in IT’s human resources budget for projects and providing ongoing visibility into how that budget of time is being spent.

    Establish the total resource capacity of your portfolio

    Associated Activity icon 1.1.2 – 30 to 60 minutes

    INPUT: Staff resource types, Average work week, Estimated allocations

    OUTPUT: Breakdown of annual portfolio HR spend, Capacity pie chart

    Materials: PPM High-Level Supply/Demand Calculator, tab 3

    Participants: Portfolio manager (or equivalent), Resource and/or project managers

    Use tab 3 of the calculator to determine your actual HR portfolio budget for projects, relative to the organization’s non-project demands.

    • Tab 3 analyzes your resource supply asks you to consider how your staff spend their time weekly across four categories: out of office time, administrative time (e.g. meetings, training, checking email), keep-the-lights-on time (i.e. support and maintenance), and project time.
    • The screenshot below walks you through columns B to E of tab 3, which help calculate your potential capacity. This activity will continue on the next slide, where we will determine your realized capacity for project work from this potential capacity.
    Screenshot of tab 3 in the PPM High-Level Supply/Demand Calculator. It has 4 columns, 'Resource Type', '# People', 'Hours / Week', and 'Hours / Year', which are referred to in notes as columns B through E respectively. The note on 'Resource Type' reads '1. Compile a list of each of the roles within your department in column B'. The note on '# People' reads '2. In column C, provide the number of staff currently performing each role'. The note on 'Hours / Week' reads '3. In column D, provide a baseline for the number of hours in a typical work week for each role'. The note on 'Hours / Year' reads '4. Column E will auto-populate based on E and D. The total at the bottom of column E (row 26) constitutes your department’s total capacity'.

    Determine the project/non-project ratio for each role

    Associated Activity icon 1.1.2 (continued)

    The previous slide walked you through columns B to E of tab 3. This slide walks you through columns F to J, which ask you to consider how your potential capacity is spent.

    Screenshot of tab 3 in the PPM High-Level Supply/Demand Calculator. It has 6 columns, 'Hours / Year', 'Absence', 'Working Time / Year', 'Admin', 'KTLO', and 'Project Work', which, starting at 'Absence', are referred to in notes as columns F through J respectively. The note on 'Absence' reads '5. Enter the percentage of your total time across each role that is unavailable due to foreseeable out-of-office time (vacation, sick time, etc.) in column F. Industry standard runs anywhere from 12% to 16%, depending on your industry and geographical region'. The note on 'Working Time / Year' reads '6. Column G will auto-calculate to show your overall net capacity after out-of-office percentages have been taken off the top. These totals constitute your working time for the year'. The note on 'Admin' and 'KTLO' reads '6. Column G will auto-calculate to show your overall net capacity after out-of-office percentages have been taken off the top. These totals constitute your working time for the year'. The note on 'Project Work' reads '8. The project percentage in column J will auto-calculate based upon what’s leftover after your non-project working time allocations in columns H and I have been subtracted'.

    Review your annual portfolio capacity for projects

    Associated Activity icon 1.1.2 (continued)

    The previous slides walked you through the inputs for tab “3. Project Capacity.” This slide walks you through the outputs of the tab.

    Based upon the inputs from columns B to J, the rest of tab 3 analyzes how IT available time is spent across the time categories, highlighting how much of IT’s capacity is actually available for projects after admin work, support and maintenance work, and absences have been taken into account.

    A table and pie chart of output data from Tab 3 of the PPM High-Level Supply/Demand Calculator. Pie segments are labelled 'Admin', 'Absence', 'Project Capacity', and 'Keep The Lights On'.

    Customize Info-Tech’s PPM Strategic Plan Template. Update slide 10, “Current Project Capacity,” of your PPM Strategic Plan Template to include the outputs from tab 3 of the Calculator.

    Create an inventory of active and backlog projects to help gauge overall project demand

    Associated Activity icon 1.1.3 – 15 to 30 minutes

    INPUT: Number of active and backlog projects across different sizes

    OUTPUT: Total project demand in estimated hours of work effort

    Materials: PPM High-Level Supply/Demand Calculator, tab 4

    Participants: Portfolio manager (or equivalent), Project managers

    Where tab 3 of the Calculator gave you visibility into your overall resource supply for projects, tab 4 will help you establish insight into the demand side.

    • Before starting on tab 4, be sure to enter the required project size data on the set-up tab.
    • Using a list of current active projects, categorize the items on the list by size: small, medium, large, and extra large. Enter the number of projects in each category of project in column C of tab 4.
    • Using a list of on-hold projects, or projects that have been approved but not started, categorize the list by size and enter the number of projects in each category in column D.
    • In column E, estimate the number of new requests and projects across each size that you anticipate being added to the portfolio/backlog in the next 12 months. Use historical data from the past 12 to 24 months to inform your estimates.
    • In column F, estimate the number of projects that you anticipate being completed in each size category in the next 12 months. Take the current state of active projects into account as you make your estimates, as well as throughput data from the previous 12 to 24 months.
    Screenshot of tab 4 in the PPM High-Level Supply/Demand Calculator. It has 5 columns labelled 'Project Types' with values Small to Extra-Large, 'Number of active projects currently in the portfolio', 'Number of projects currently in the portfolio backlog', 'Number of new requests anticipated to be added to the portfolio/backlog in the next 12 months', and 'Number of projects expected to be delivered within the next 12 months'.

    Make supply and demand part of the conversation as you get buy-in for your top-down strategy

    Tab 5 of the Calculator is an output tab, visualizing the alignment (or lack thereof) of project demand and resource supply.

    Once tabs 3 and 4 are complete, use tab 5 to analyze the supply/demand data to help build your case for a top-down PPM strategy and get buy-in for it.

    Screenshots of Tab 5 in the PPM High-Level Supply/Demand Calculator. A bar chart obscures a table with the note 'The bar chart shows your estimated total project demand in person hours (in black) relative to your estimated total resource capacity for projects (in green)'. Notes on the table are 'The table below the bar chart shows your estimated annual project throughput rate (based upon the number of projects you estimated you would complete this year) as well as the rate at which portfolio demand will grow (based upon the number of new requests and projects you estimated for the next 12 months)' and 'If the “Total Estimated Project Demand (in hours) in 12 Months Time” number is more than your current demand levels, then you have a supply-demand problem that your PPM strategy will need to address'.

    Customize Info-Tech’s PPM Strategic Plan Template. Update slides 11 and 12, “Current Project Demand,” of your PPM Strategic Plan Template to include the outputs from tabs 4 and 5 of the Calculator.

    Recommended: Complete Info-Tech’s PPM Current State Scorecard to measure your resource utilization

    Associated Activity icon Contact your rep or call 1-888-670-8889

    This step is highly recommended but not required. Call 1-888-670-8889 to inquire about or request the PPM Diagnostics.

    Info-Tech’s PPM Current State Scorecard diagnostic provides a comprehensive view of your portfolio management strengths and weaknesses, including project portfolio management, project management, customer management, and resource utilization.

    Screenshots of Info-Tech's PPM Current State Scorecard diagnostic with a pie chart obscuring a table/key. The attached note reads 'In particular, the analysis of resource utilization in the PPM Current State Scorecard report, will help to complement the supply/demand analysis in the previous slides. The diagnostic will help you to analyze how, within that percentage of your overall capacity that is available for project work, your staff productively utilizes this time to successfully complete project tasks and how much of this time is lost within Info-Tech’s categories of resource waste.'

    Customize Info-Tech’s PPM Strategic Plan Template. Update slides 14 and 15, “Current State Resource Utilization” of your PPM Strategic Plan Template to include the resource utilization outputs from your PPM Current State Scorecard.

    Finalize section one of the PPM Strategic Plan Template and prepare to communicate your strategy

    Associated Activity icon 1.1.4 – 10 to 30 minutes

    INPUT: The previous activities from this step

    OUTPUT: An presentation communication your PPM strategy

    Materials: PPM Strategic Plan Template, section 1

    Participants: Portfolio manager (or equivalent)

    By now, you should be ready to complete section one of the PPM Strategic Plan Template.

    The purpose of this section of the Template is to capture the outputs of this step and use them to communicate the value of a top-down PPM strategy and to get buy-in for this strategy from senior management before you move forward to develop your PPM processes in the subsequent phases of this blueprint.

    • Within section one, update any of the text that is (in grey) to reflect the specifics of your organization – i.e. the name of your organization and department – and the specific outcomes of step 1.2 activities. In addition, replace the placeholders for a company logo with the logo of your company.
    • Replace the tool screenshots with the outputs from your version of the PPM High-Level Supply/Demand Calculator.
    • Proofread all of the text to ensure the content accurately reflects your outcomes. Edit the content as needed to more accurately reflect your outcomes.
    • Determine the audience for the presentation of your PPM strategy and make a logistical arrangement. Include PPM strategy sponsors, senior management from within IT and the business, and other important stakeholders.

    Get executive buy-in for your top-down PPM strategy

    Executive layer buy-in is a critical prerequisite for the success of a top-down PPM strategy. Ensure your executives are on board before preceding.

    You’re now ready to communicate your PPM strategy to your leadership team and other stakeholders.

    It is essential that you get preliminary buy-in for this strategy from the executive layer before you move forward to develop your PPM processes in the subsequent phases of this blueprint. Lack of executive engagement is one of the top barriers to PPM strategy success.

    • If you have gone through the preceding activities in this step, section one of your PPM Strategic Plan Template should now be ready to present.
    • As explained in 1.1.4, you should present this section to an audience of PPM strategy sponsors, C-suite executives, and other members of the senior management team.
    • Allow at least 60 minutes for the presentation – around 20 minutes to deliver the slide presentation and 40 minutes for discussion.
    • If you get sufficient buy-in by the end of the presentation, proceed to the next step of this blueprint. If buy-in is lacking, now might not be the right time for a top-down PPM strategy. Think about adopting a bottom-up approach until leadership is more engaged in the portfolio.

    "Gaining executive sponsorship early is key…It is important for the executives in your organization to understand that the PPM initiatives and the PMO organization are there to support (but never hinder) executive decision making." (KeyedIn Projects)

    Info-Tech Best Practice

    Engage(d) sponsorship. According to Prosci, the top factor in contributing to the success of a change initiative is active and visible executive sponsorship. Use this meeting to communicate to your sponsor(s) the importance of their involvement in championing the PPM strategy.

    A PPM strategic plan elevates PMO’s status to a business strategic partner

    CASE STUDY

    Industry: Public Administration
    Source: IAG / Info-Tech Interview

    Challenge

    The PMO operated in a way that is, in their self-assessment, reactive; project requests and capacity were not effectively managed. Perhaps due to this, the leadership team was not always visible, or regularly available, to PM leaders. This, in turn, complicated efforts to effectively manage their projects.

    Solution

    Establishing a simple prioritization methodology enabled the senior leadership to engage and effectively steer the project portfolio by strategic importance. The criteria and tool also gave the business units a clear understanding to promote the strategic value of each of their project requests.

    Results

    PM leaders now have the support and confidence of the senior leadership team to both proactively manage and deliver on strategic projects. This new prioritization model brought the PM Leader and senior leadership team in direct access with each other.

    "By implementing this new project intake and prioritization framework, we drastically improved our ability to predict, meet, and manage project requests and unit workload. We adopted a client-focused and client-centric approach that enabled all project participants to see their role and value in successful project delivery. We created methodologies that were easy to follow from the client participation perspective, but also as PM leaders, provided us with the metrics, planning, and proactive tools to meet and anticipate client project demand. The response from our clients was extremely positive, encouraging, and appreciative."

    Step 1.2: Translate PPM strategic expectations to process goals

    PHASE 1

    PHASE 2

    PHASE 3

    1.11.22.12.23.13.2
    Choose the right PPM strategyTranslate strategy into process goalsDefine intake & resource mgmt. processesDefine reporting, closure, & benefits mgmt. processesSelect a right-sized PPM solutionFinalize your PPM strategic plan

    This step will walk you through the following activities:

    • Determine process goals based upon your PPM strategy.
    • Set metrics and preliminary targets for your PPM processes.

    This step involves the following participants:

    • CIO
    • Steering Committee
    • Business Unit Leaders
    • PMO Director/Portfolio Manager

    Outcomes of this step

    • Stakeholder-prioritized PPM process goals
    • Metrics and targets for high-priority process goals

    Use the PPM strategy to set the direction for PPM processes that make up the infrastructure around projects

    PPM strategy enables you to answer any and all of these questions in a way that is consistent, cohesive, and aligned with one another.

    Info-Tech's PPM Process Model from earlier with notes overlaid asking a series of questions. The questions for '1. Intake, Approval, and Prioritization' are 'Who can request a project? How do you request a project? Who decides what to fund? What is the target investment mix? How will they decide?' The questions for '2. Resource Management' are 'Who assigns the resources? Who feeds the data on resources? How do we make sure it’s valid? How do we handle contingencies when projects are late, or if availability changes?' The questions for '3. Status and Progress Reporting' are 'What project information that should be reported? Who reports on project status? When? How?' The questions between 'Project Management' and '4. Project Closure' are 'Who declares that a project is done? Who validates it? Who is this reported to? Who terminates low-value projects? How will they decide?' The questions for '5. Benefits Tracking' are 'How do we validate the project benefits from the original business case? How do we track the benefits? Who reports it? When?'

    Set process goals to address PPM strategic expectations and steer the PPM strategic plan

    Associated Activity icon 1.2.1 – 2 hours

    INPUT: PPM strategy & expectations, Organizational strategy and culture

    OUTPUT: Prioritized list of strategy-aligned PPM process goals

    Materials: PPM Strategy-Process Translation Matrix

    Participants: CIO, Steering Committee, Business Unit Leaders, PMO Director/ Portfolio Manager

    This activity is designed for key departmental stakeholders to articulate how PPM processes should be developed or refined to meet the PPM strategic expectations.

    Participation of the key departmental stakeholders in this exercise is critical, e.g. CIO, Steering Committee, business unit leaders.

    Strategic Expectations x Processes = Process goals aligned to strategy
    Throughput Project Intake, Approval, & Prioritization
    Visibility Resource Management
    Responsiveness Status & Progress Reporting
    Resource Utilization Project Closure
    Benefits Benefits Realization

    Download Info-Tech’s PPM Strategy-Process Goals Translation Matrix Template.

    Use Info-Tech’s Translation Matrix to systematically articulate strategy-aligned PPM process goals

    Supporting Tool icon 1.2.1 – PPM Strategy-Process Translation Matrix, tab 2

    Formula: To answer “[question]” in a way that we can [strategic expectation], it will be important to [process goal].

    Example 1:
    To answer the question “who can request a project, and how?” in a way that we can maximize the throughput of the best projects, it will be important to standardize the project request process.

    Example 2:
    To answer the question “how will they decide what to fund?” in a way that we can maximize the throughput of the best projects, it will be important to reach a consensus on project prioritization criteria.

    Example 3:
    To answer the question “how will we track the projected benefits?” in a way that we can maximize the throughput of the best projects, it will be important to double-check the validity of benefits before projects are approved.

    Screenshot of Tab 2 in Info-Tech's PPM Strategy-Process Translation Matrix tool. There is a table with notes overlaid 'Enter the process goals in the appropriate question–strategic expectation slot' and 'Assign a priority, from the most important (1) to the least important (5)'.

    Set metrics and preliminary targets for your high-priority PPM process goals

    Associated Activity icon 1.2.2 – 1-2 hours

    INPUT: Prioritized list of strategy-aligned PPM process goals, Organizational strategy and culture

    OUTPUT: Metrics and targets for high-priority PPM process goals

    Materials: PPM Strategy-Process Translation Matrix

    Participants: CIO, Steering Committee, Business Unit Leaders, PMO Director/ Portfolio Manager

    Your highest-priority process goals and their corresponding strategy expectations are displayed in tab 3 of the PPM Strategy-Process Translation Matrix template (example below).

    Through a group discussion, document what will be measured to decide the achievement of each process goal, as well as your current estimate and the long-term target. If necessary, adjust the approximate target duration.

    Screenshot of Tab 3 in Info-Tech's PPM Strategy-Process Translation Matrix tool. There is a table with 6 columns 'PPM Process', 'High-priority Process Goals', 'Strategy Expectation', 'How will you measure success?', 'Current Estimate', and 'Long-Term Target'; they are referred to in notes as columns B through G respectively. Overlaid notes are 'Columns C and D will auto-populate based upon your inputs from tab 2. The five PPM process areas are arranged vertically in column B and your top-five process goals from each area appear in column C.' 'Use column E to brainstorm how you might measure the success of each process goal at your organization. These can be tentative for now and refined over time.' 'Determine current metrics for each process goals and long-term target metrics in columns F and G.'

    Project-client-centered approach to PPM process design improves client satisfaction and team confidence

    CASE STUDY

    Industry: Public Administration
    Source: IAG / Info-Tech Interview

    Challenge

    Reactive instead of proactive

    "We had no effective means of tracking project intake requests vs. capacity. We struggled using ad hoc processes and methods which worked to meet immediate needs, but we quickly realized that they were ineffective in tracking critical project metrics, key performance indicators (KPIs), or performance measures...In short, we were being reactive, instead of proactive."

    The result was a disorganized portfolio that led to low client satisfaction and team morale.

    Solution

    Examine processes “through the eyes of the client”

    With the guiding principle of “through the eyes of the client,” PPM processes and tools were developed to formalize project intake, prioritization, and capacity planning. All touchpoints between client and PPM processes were identified, and practices for managing client expectations were put in place. A client satisfaction survey was formulated as part of the post-project assessment and review.

    Results

    Client-centered processes improved client satisfaction and team confidence

    People, processes, and tools are now aligned to support client demand, manage client expectations, measure project KPIs, and perform post-project analysis. A standard for client satisfaction metrics was put in place. The overwhelmingly positive feedback has increased team confidence in their ability to deliver quality efforts.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    Photo of Barry Cousins.
    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    Sample of activity 1.1.2 'Determine your actual resource capacity for projects'. Determine your actual resource capacity for projects

    Work with Info-Tech analysts to define your project vs. non-project ratio to help define how much of your overall resource capacity is actual available for projects.

    Sample of activity 1.2.1 'Set realistic PPM process goals'. Set realistic PPM process goals

    Leverage Info-Tech facilitators to help walk you through our PPM framework and define achievable process goals that are rooted in your current PPM maturity levels and organizational culture.

    Develop a Project Portfolio Management Strategy

    PHASE 2

    Align PPM Processes to Your Strategic Goals

    Phase 2 outline

    Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 2: Align PPM processes to your strategic goals

    Proposed Time to Completion: 2-4 weeks
    Step 2.1: Develop intake & resource mgmt. processes Step 2.2: Define reporting, closure, & benefits processes
    Work with an analyst to:
    • Assess your current intake, prioritization, and resource management processes and wireframe a sustainable target state for each capability.
    Work with an analyst to:
    • Analyze your current portfolio reporting, project closure, and benefits realization processes and wireframe a sustainable target state for each capability.
    Then complete these activities…
    • Set near-term and long-term goals.
    • Draft high-level steps within your target-state processes.
    • Document your process steps and roles and responsibilities.
    Then complete these activities…
    • Set near-term and long-term goals.
    • Draft high-level steps within your target-state processes.
    • Document your process steps and roles and responsibilities.
    With these tools & templates:
    • PPM Strategy Development Tool
    • PPM Strategic Plan Template
    With these tools & templates:
    • PPM Strategy Development Tool
    • PPM Strategic Plan Template

    Phase 2 Results & Insights

    • The means of project and portfolio management (i.e. processes) shouldn’t eclipse the ends – strategic goals. Root your process in your PPM strategic goals to realize PPM benefits (e.g. optimized portfolio value, improved project throughput, increased stakeholder satisfaction).

    Read first: Overview of the methodology for articulating new strategy-aligned PPM processes

    In the previous step of the blueprint, key department stakeholders established the PPM process goals, metrics, and targets in a way that aligns with the overall PPM strategy. In this phase, we draft a high-level description of the five PPM processes that reflect those goals using the following methodology:

    Methodology at a glance

    1. Articulate the current state of the process.
    2. Examine the process against the strategy-aligned goals.
    3. Create short- and long-term action items to refine the current process and meet the strategy-aligned targets.
    4. Develop a high-level target-state description of the PPM process.
    5. Estimate costs-in-use of the target-state process.

    Out-of-scope topics

    • Draft a detailed target-state description of the PPM process. Avoid falling into the “analysis paralysis” trap and keep the discussion focused on the overall PPM strategy.
    • PPM tools to support the process. This discussion will take place in the next phase of the blueprint.

    INPUT

    –›

    PROCESS

    –›

    OUTPUT

    • Strategy-aligned process goals, metrics, and targets (Activity 1.2.1)
    • Knowledge of current process
    • Knowledge of organizational culture and structure
    • Capability level assessment
    • Table-top design planning activity
    • Start-stop-continue retrospective
    • High-level description of the target state
    • PPM Strategy Development Tool
    • High-level descriptions of current and target states
    • Short- and long-term action items for improving the process
    • Cost-in-use of the current- and target-state processes

    Download Info-Tech’s PPM Strategy Development Tool

    Build a sound business case for implementing the new PPM strategy with realistic costs and benefits of managing your project portfolio.

    Time spent on managing the project portfolio is an investment. Like any other business endeavors, the benefits must outweigh the costs to be worth doing.

    As you draft a high-level description of the PPM processes in this phase of the blueprint, use Info-Tech’s PPM Strategy Development Tool to track the estimate the cost-in-use of the process. In the next phase, this information will be inform a cost-benefit analysis, which will be used to support your plan to implement the PPM strategy.

    Download Info-Tech’s PPM Strategy Development Tool.

    Screenshots of Info-Tech's PPM Strategy Development Tool including a Cost-Benefit Analysis with tables and graphs.

    Step 2.1: Develop and refine project intake, prioritization, and resource management processes

    PHASE 1

    PHASE 2

    PHASE 3

    1.11.22.12.23.13.2
    Choose the right PPM strategyTranslate strategy into process goalsDefine intake & resource mgmt. processesDefine reporting, closure, & benefits mgmt. processesSelect a right-sized PPM solutionFinalize your PPM strategic plan

    This step will walk you through the following activities:

    • Determine your process maturity.
    • Benchmark current processes against strategy-aligned goals.
    • Set near- and long-term action items.
    • Draft a high-level description of your target state.
    • Document your new processes.

    This step involves the following participants:

    • PMO Director/Portfolio Manager
    • Project Managers
    • Resource Managers
    • Business Analysts

    Outcomes of this step

    • A definition of current and target state maturity levels for intake, prioritization, and resource management
    • Near-term and long-term process goals for intake, prioritization, and resource management
    • A high-level wireframe for your intake, prioritization, and resource management process steps

    Project intake, prioritization, and approval: Get projects with the highest value done first

    Give your organization the voice to say “no” (or “not yet”) to new projects.

    Questions

    • Who can request a project?
    • How do you request a project?
    • Who decides what to fund?
    • What is the target investment mix?
    • How will they decide?

    Benefits

    • Maximize value of time spent on project work by aligning projects with priorities and stakeholder needs.
    • Finish the projects you start by improving alignment of intake and prioritization with resource capacity.
    • Improve stakeholder satisfaction by managing expectations with consistent, streamlined processes.

    Challenges

    • Stakeholders who benefit from political or ad hoc prioritization processes will resist or circumvent formal intake processes.
    • Many organizations lack sufficient awareness of resource capacity necessary to align intake with availability.

    A graph highlighting the sweet spot of project intake decision making. The vertical axis is 'Rigor and Effort' increasing upward, and the horizontal axis is 'Quality and Effectiveness of Decisions' increasing to the right. The trend line starts at 'Gut Feel' with low 'Rigor and Effort', and gradually curves upward to 'Analysis Paralysis' at the top. A note with an arrow pointing to a midway point in the line reads 'The sweet spot changes between situations and types of decisions'.

    Info-Tech Insight

    This process aims to control the project demand. A balance between rigor and flexibility is critical in order to avoid the “analysis paralysis” as much as the “gut feel” approach.

    Funnel project requests into a triage system for project intake

    Info-Tech recommends following a four-step process for managing project intake.

    1. Requestor fills out form and submits the request into the funnel.
    2. Requests are triaged into the proper queue.
      1. Divert non-project request.
      2. Quickly assess value and urgency.
      3. Assign specialist to follow up on request.
      4. Inform the requestor.
    3. Business analyst starts to gather preliminary requirements.
      1. Follow up with sponsors to validate and define scope.
      2. Estimate size and determine project management rigor required.
      3. Start to develop an initial business case.
    4. Requestor is given realistic expectations for approval process.

    Info-Tech Best Practice

    An excess number of intake channels is the tell-tale sign of a project portfolio in distress. The PMO needs to exercise and enforce discipline on stakeholders. PMO should demand proper documentation and diligence from stakeholders before proceeding with requests.

    Maintain reliable resourcing data with a recurrent project intake, prioritization, and approval practice

    Info-Tech recommends following a five-step process for managing project intake, prioritization, and approval.

    A diagram of Info-Tech's five-step process for managing project intake. There are four groups that may be involved in any one step, they are laid out on the side as row headers that each step's columns may fall into, 'Resources', 'Business Analysts', 'PMO', and 'Governance Layer'. The first step is 'Collect project requests' which involves 'Resources'. Step 2 is 'Screen project requests' which involves 'Business Analysts' and 'PMO'. A part of the step that may be applicable to some organizations is 'Concept approval' involving 'Governance Layer'. Step 3 is 'Develop business case' which involves 'Business Analysts' and 'PMO'. A part of the step that may be applicable to some organizations is 'Get a project sponsor' involving 'Governance Layer'. Step 4 is 'Prioritize project' which involves 'Business Analysts' and 'PMO'. Step 5 is 'Approve (greenlight) project' which involves 'Business Analysts', 'PMO', and 'Governance Layer', with an attached note that reads 'Ensure that up-to-date project portfolio information is available (project status, resource forecast, etc.)'. All of these steps lead to 'Initiate project, commit resources, etc.'

    Info-Tech Insight

    “Approval” can be a dangerous word in project and portfolio management. Use it carefully. Clarify precisely what is being “approved” at each step in the process, what is required to pass each gate, and how long the process will take.

    Determine your project intake, prioritization, and approval process maturity

    Associated Activity icon 2.1.1a – 10 minutes

    INPUT: Organizational strategy and culture

    OUTPUT: Project intake, prioritization, and approval capability level

    Materials: PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Kick-off the discussion about the project intake, prioritization, and approval process by reading the capability level descriptions below and discussing which level currently applies to you the most.

    Capability Level Descriptions

    Capability Level 5: Optimized We have effective intake processes with right-sized administrative overhead. Work is continuously prioritized to keep up with emerging challenges and opportunities.
    Capability Level 4: Aligned We have very strong intake processes. Project approvals are based on business cases and aligned with future resource capacity.
    Capability Level 3: Engaged Processes are in place to track project requests and follow up on them. Priorities are periodically re-evaluated, based largely on the best judgment of one or several executives.
    Capability Level 2: Defined Some processes are in place, but there is no capacity to say no to new projects. There is a backlog, but little or no method for grooming it.
    Capability Level 1: Unmanaged Our organization has no formal intake processes in place. Most work is done reactively, with little ability to prioritize project work proactively.

    Benchmark the current project intake, prioritization, and approval process against strategy-aligned goals

    Associated Activity icon 2.1.1b – 1-2 hours

    INPUT: Documentation describing the current process (e.g. standard operating procedures), Process goals from activity 1.2.1

    OUTPUT: Retrospective review of current process

    Materials: 4x6” recipe cards, Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Conduct a table-top planning exercise to map out the process currently in place.

    1. Use white 4”x6” recipe cards to write unique steps of a process. Use the intake, prioritization, and approval process from the previous slides as a guide.
    2. Use green cards to write artifacts or deliverables that result from a step.
    3. Use pink cards to write issues, problems, or risks.
    4. Discuss how the process could better achieve the strategy-aligned goals from activity 1.2.1. Keep a list of possible changes in the form of a start-stop-continue retrospective (example below) on a whiteboard.
    Start Stop Continue
    • Simplify business cases
    • Send emails to requestor to manage expectations
    • Accept verbal project requests
    • Approve “pet projects”
    • Monthly prioritization meetings
    • Evaluate prioritization criteria

    Set near- and long-term action items for the project intake, prioritization, and approval process

    Associated Activity icon 2.1.1c – 30 minutes - 1 hour

    INPUT: Outcome of the retrospective review, Process goals and metrics from activity 1.2.1

    OUTPUT: Action items for evolving the process to a target state

    Materials: Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Analyze each item in the start-stop-continue retrospective to compile a set of near-term and long-term action items.

    The near-term plan should include steps that are within the authority of the PMO and do not require approval or investment outside of that authority. The long-term plan should include steps that may require a longer approval process, buy-in of external stakeholders, and the investment of time and money.
    Near-Term Action Items Long-Term Action Items
    For example:
    • Limit the number of channels available to request new projects.
    • Revise the intake form.
    • Establish a regular triage process.
    For example:
    • Establish a comprehensive scorecard and business case scoring process at the steering committee level.
    • Limit the rate of approval to be aligned with resource capacity.

    Review and customize slide 23, “Project intake, prioritization, and approval: action items,” in Info-Tech’s PPM Strategic Plan Template.

    Draft a high-level description of the intake, prioritization, and approval process at a target state

    Associated Activity icon 2.1.1d – 1-2 hours

    INPUT: Action items for evolving the process to a target state

    OUTPUT: High-level description of the process at the target state

    Materials: Whiteboard, PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    1. Break down the process into several tasks at a high level. Avoid getting into too much detail by limiting the number of steps.
    2. An example of high-level breakdown: project intake, prioritization, and approval
      Collect project requests –› Screen requests –› Develop business case –› Prioritize project –› Approve project

    3. Describe each task by answering the following questions. Document your response in the PPM Strategic Plan Template.
    4. Question

      Description

      Input What information do you need to perform the work?
      Output What artifacts/deliverables are produced as a result?
      Frequency/Timing How often, and when, will the work be performed?
      Responsibility Who will perform the work?
      Accountability Who will approve the work and assume the ownership of any decisions?

    5. Record the time cost of each process using the PPM Strategy Development Tool; see next slide for instructions.

    Use the PPM Strategy Development Tool to track the time cost of the process

    Supporting Tool icon 2.1.1 – PPM Strategy Development Tool, Tab 3: Costing Assumptions

    Record the time cost of each high-level process task from Activity 2.1.1d.

    Screenshot of tab 3 from Info-Tech's PPM Strategy Development Tool with notes overlaid. Columns are 'ID', 'Task Description', 'Who does the task?', a super-column titled 'Current State' which includes 'How many times per year?', 'How many people?', and 'For how long?', a super-column titled 'Near-Term Target State' with the same three sub columns, and a super-column titled 'Long-Term Target State' with the same three sub columns. Notes for 'Who does the task?' read 'Choose executive, management or resource' and 'If task is done by more than one party, duplicate the task'. Notes for the 3 recurring sub columns are 'Estimate how many times in a year the task is performed (e.g. 120 project requests per year)', 'Indicate the number of people needed to perform the task each time', 'Estimate the average work-hours for the task… either in minutes or in hours', 'If a task is not applicable to a state (e.g. currently PMO does not screen project requests), leave the row blank', and 'For meetings, remember to indicate the number of people'.

    Document the high-level description for the new intake, prioritization, and approval process

    Associated Activity icon 2.1.1e – 30 minutes - 1 hour

    INPUT: High-level description of the process at the target state

    OUTPUT: Updated PPM strategic plan

    Materials: Whiteboard, PPM Strategic Plan Template

    Participants: PMO Director/ Portfolio Manager

    Update your PPM strategic plan with the new high-level description for the new project intake, prioritization, and approval process. Depending on your current process capability level, you may wish to include additional information on your strategic document, for example:

    • Updated prioritization scorecard.
    • Roles and responsibility matrix, identifying consulted and informed parties.

    Info-Tech has a dedicated blueprint to help you develop the high-level process description into a fully operationalized process. Upon completion of this PPM strategy blueprint, speak to an Info-Tech account manager or analyst to get started.

    Read Info-Tech’s Optimize Project Intake, Prioritization, and Approval blueprint.

    Review and customize slide 24, “Project intake, prioritization, and approval: target state,” in Info-Tech’s PPM Strategic Plan Template.

    Clarity in project prioritization process leads to enterprise-wide buy-in

    CASE STUDY

    Industry: Public Administration
    Source: IAG / Info-Tech Interview

    Challenge

    "Our challenge from the start was to better understand the strategic perspective and priorities of our client departments.

    In addition, much of the work requested was not aligned to corporate goals and efforts, and seemed to be contradictory, redundant, and lacking strategic focus."

    Complicating this challenge was the fact that work requests were being received via all means of communication, which made the monitoring and controlling of requests more difficult.

    Solution

    Client departments were consulted to improve the understanding of their strategic goals and priorities. Based on the consultation:

    • A new, enterprise-wide project prioritization criteria was developed.
    • Priority of project requests from all business areas are evaluated on a quarterly basis.
    • A prioritized list of projects are made available to the senior leadership team.

    Results

    "By creating and implementing a tool for departments to prioritize strategic efforts, we helped them consider the important overall project criteria and measure them uniformly, across all anticipated projects. This set a standard of assessment, prioritization, and ranking, which helped departments clearly see which efforts were supportive and matched their strategic goals."

    Resource management process ensures that projects get the resources they need

    Reclaim project capacity: properly allocate project work and establish more stable project timelines.

    Questions

    • Who assigns the resources?
    • Who feeds the data on resources?
    • How do we make sure it’s valid?
    • How do we handle contingencies when projects are late, or if availability changes?

    Benefits

    • Ensure that approved projects can be completed by aligning intake with real project capacity.
    • Reduce over-allocation of resources by allocating based on their proportion of project vs. non-project work.
    • Forecast future resource requirements by maintaining accurate resource capacity data.

    Challenges

    • Time tracking can be difficult when project workers balance project work with “keep the lights on” activities and other administrative work.
    • Continuous partial attention, interruptions, and distractions are a part of today’s reality that makes it very difficult to maximize productivity.
    A see-saw balancing 'Resource availability' on one side and 'Ongoing projects, Operational work, Administrative work, and Resource absence' on the other side.

    Maintain reliable resourcing data with a recurrent resource management practice

    Info-Tech recommends following a five-step process for resource management.

    A diagram of Info-Tech's five-step process for resource management. There are five groups that may be involved in any one step, they are laid out on the side as row headers that each step's columns may fall into, 'Resources', 'Resource Managers', 'Project Managers', 'PMO', and 'Governance Layer'. The first step is 'Collect resource availability' which involves 'Resources' and 'Resource Managers'. Step 2 is 'Collect resource demand' which involves 'Resource Managers', 'Project Managers' and 'PMO'. Step 3 is 'Identify need for reconciliation' which involves 'PMO'. Step 4 is 'Resolve conflicts and smoothen resource allocations' which involves 'Resource Managers', 'Project Managers' and 'PMO'. Step 5 is 'Report resource allocations and forecast' which involves all groups, with an attached note that reads 'Ensure that up-to-date information is available for project approval, portfolio reporting, closure, etc.'

    Info-Tech Insight

    This process aims to control the resource supply to meet the demand – project and non-project alike. Coordinate this process with the intake, approval, and prioritization process.

    Determine your resource management process capability level

    Associated Activity icon 2.1.2a – 10 minutes

    INPUT: Organizational strategy and culture

    OUTPUT: Resource management capability level

    Materials: PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Kick-off the discussion about the resource management process by reading the capability level descriptions below and discussing which level currently applies to you the most.

    Capability Level Descriptions

    Capability Level 5: OptimizedOur organization has an accurate picture of project versus non-project work loads and allocates resources accordingly. We periodically reclaim lost capacity through organizational and behavioral change.
    Capability Level 4: AlignedWe have an accurate picture of how much time is spent on project versus non-project work. We allocate resources to these projects accordingly. We are checking in on project progress bi-weekly.
    Capability Level 3: PixelatedWe are allocating resources to projects and tracking progress monthly. We have a rough estimate of how much time is spent on project versus non-project work.
    Capability Level 2: OpaqueWe match resources teams to projects and check in annually, but we do not forecast future resource needs or track project versus non-project work.
    Capability Level 1: UnmanagedOur organization expects projects to be finished, but there is no process in place for allocating resources or tracking project progress.

    Benchmark the current resource management process against strategy-aligned goals

    Associated Activity icon 2.1.2b – 1-2 hours

    INPUT: Documentation describing the current process (e.g. standard operating procedures), Process goals from activity 1.2.1

    OUTPUT: Retrospective review of current process

    Materials: 4x6” recipe cards, Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Conduct a table-top planning exercise to map out the process currently in place.

    1. Use white 4”x6” recipe cards to write unique steps of a process. Use the resource management process from the previous slides as a guide.
    2. Use green cards to write artifacts or deliverables that result from a step.
    3. Use pink cards to write issues, problems, or risks.
    4. Discuss how the process could better achieve the strategy-aligned goals from activity 1.2.1. Keep a list of possible changes in the form of a start-stop-continue retrospective (example below) on a whiteboard.
    Start Stop Continue
    • Collect project actuals
    • Make enhancements to the PPM tool in use
    • Over allocating resources
    • “Around the room” reporting at monthly meeting
    • Send project updates before resource management meetings

    Set near- and long-term action items for the resource management process

    Associated Activity icon 2.1.2c – 30 minutes - 1 hour

    INPUT: Outcome of the retrospective review, Process goals and metrics from activity 1.2.1

    OUTPUT: Action items for evolving the process to a target state

    Materials: Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Analyze each item in the start-stop-continue retrospective to compile a set of near-term and long-term action items.

    The near-term plan should include steps that are within the authority of the PMO and do not require approval or investment outside of that authority. The long-term plan should include steps that may require a longer approval process, buy-in of external stakeholders, and the investment of time and money.
    Near-Term Action Items Long-Term Action Items
    For example:
    • Determine the percentage of project vs. non-project work through implementation of a weekly survey.
    For example:
    • Reduce resource waste to 6%.
    • Forecast resource requirements monthly.
    • Implement a mid-market PPM tool.

    Review and customize slide 26, “Resource management: action items,” in Info-Tech’s PPM Strategic Plan Template.

    Draft a high-level description of the resource management process at a target state

    Associated Activity icon 2.1.2d – 1-2 hours

    INPUT: Action items for evolving the process to a target state

    OUTPUT: High-level description of the process at the target state

    Materials: Whiteboard, PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    1. Break down the process into several tasks at a high level. Avoid getting into too much detail by limiting the number of steps.
    2. An example of high-level breakdown: resource management
      Collect resource availability –› Collect resource demand –› Identify need for reconciliation –› Resolve conflicts and over-allocation –› Update resource forecast


    3. Describe each task by answering the following questions. Document your response in the PPM Strategic Plan Template.
    4. Question

      Description

      Input What information do you need to perform the work?
      Output What artifacts/deliverables are produced as a result?
      Frequency/Timing How often, and when, will the work be performed?
      Responsibility Who will perform the work?
      Accountability Who will approve the work and assume the ownership of any decisions?


    5. Record the time cost of each process using the PPM Strategy Development Tool.

    Document the high-level description for the new resource management process

    Associated Activity icon 2.1.2e – 30 minutes - 1 hour

    INPUT: High-level description of the process at the target state

    OUTPUT: Updated PPM strategic plan

    Materials: PPM Strategic Plan Template

    Participants: PMO Director/ Portfolio Manager

    Update your PPM strategic plan with the new high-level description for the new resource management process. Depending on your current process capability level, you may wish to include additional information on your strategic plan, for example:

    • Resource management meeting agenda template
    • Roles and responsibility matrix, identifying consulted and informed parties

    Info-Tech has a dedicated blueprint to help you develop the high-level process description into a fully operationalized process. Upon completion of this PPM strategy blueprint, speak to an Info-Tech account manager or analyst to get started.

    Read Info-Tech’s Develop a Resource Management for the New Reality blueprint.

    Review and customize slide 27, “Resource management: target state,” in Info-Tech’s PPM Strategic Plan Template.

    Step 2.2: Develop and refine portfolio reporting, project closure, and benefits realization processes

    PHASE 1

    PHASE 2

    PHASE 3

    1.11.22.12.23.13.2
    Choose the right PPM strategyTranslate strategy into process goalsDefine intake & resource mgmt. processesDefine reporting, closure, & benefits mgmt. processesSelect a right-sized PPM solutionFinalize your PPM strategic plan

    This step will walk you through the following activities:

    • Determine your process maturity.
    • Benchmark current processes against strategy-aligned goals.
    • Set near- and long-term action items.
    • Draft a high-level description of your target state.
    • Document your new processes.

    This step involves the following participants:

    • PMO Director/Portfolio Manager
    • Project Managers
    • Business Analysts

    Outcomes of this step

    • A definition of current and target state maturity levels for portfolio reporting, project closure, and benefits realization
    • Near-term and long-term process goals for portfolio reporting, project closure, and benefits realization
    • A high-level wireframe for your portfolio reporting, project closure, and benefits realization process steps

    Portfolio reporting process makes trustworthy data accessible for informing decisions

    Giving stakeholders the ability to make informed decisions is the most important function of managing the project portfolio.

    Questions

    • What project information should be reported?
    • Who reports on project status?
    • When and how do we report on the status of the project portfolio?

    Benefits

    • Reporting is the linchpin of any successful PPM strategy.
    • Timely and accurate status reports enable decision makers to address issues risks and issues before they create bigger problems.
    • Executive visibility can be achieved with or without a commercial tool using spreadsheets, a content management system such as SharePoint, or a combination of tools you already have.

    Challenges

    • Trying to increase detailed visibility too fast leads to difficulty gathering and maintaining data. As a result, reporting is rarely accurate and people quickly lose trust in the portfolio.
    • If you are planning to adopt a commercial tool, Info-Tech strongly recommends validating your organization’s ability to maintain a consistent reporting process using simple tools before investing in a more sophisticated system.

    Info-Tech Insight

    If you can only do one thing, establish frequently current reporting on project status. Reporting doesn’t have to be detailed or precise, as long as it’s accurate.

    Maintain reliable portfolio status data with a recurrent status and progress reporting practice

    Info-Tech recommends following a four-step process for portfolio status and progress reporting.

    A diagram of Info-Tech's four-step process for portfolio status and progress reporting. There are four groups that may be involved in any one step, they are laid out on the side as row headers that each step's columns may fall into, 'Resources', 'Project Managers', 'PMO', and 'Governance Layer'. The first step is 'Create project status reports' which involves 'Resources' and 'Project Managers'. Step 2 is 'Create a project portfolio status report' which involves 'Project Managers' and 'PMO', with a note that reads 'Ensure that up-to-date information is available for project approval, resource management, closure, etc.' Step 3 is 'Report on project portfolio status' which involves 'PMO' and 'Governance layer'. Step 4 is 'Act on portfolio steering decisions' which involves 'Resources', 'Project Managers' and 'PMO'.

    Start by establishing a regular reporting cadence with lightweight project status KPIs:

    Red Issue or risk that requires intervention For projects that are red or yellow, high-level status reports should be elaborated on with additional comments on budget, estimated hours/days until completion, etc.
    Yellow Issue or risk that stakeholders should be aware of
    Green No significant risks or issues

    Determine your resource management process capability level

    Associated Activity icon 2.2.1a – 10 minutes

    INPUT: Organizational strategy and culture

    OUTPUT: Portfolio reporting capability level

    Materials: PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers

    Kick-off the discussion about the portfolio reporting process by reading the capability level descriptions below and discussing which level currently applies to you the most.

    Capability Level Descriptions

    Capability Level 5: OptimizedWith the right tools, we can ensure that all projects are planned and maintained at a detailed task level with high-quality estimates, and that actual task progress is updated at least weekly.
    Capability Level 4: AlignedWe have the skills, knowledge, and resources needed to prepare a detailed cost-benefit analysis for all proposed projects. We track the progress throughout project execution.
    Capability Level 3: InterventionWith the right tools, we can ensure that project issues and risks are identified and addressed on a regular basis (e.g. at least monthly) for all projects.
    Capability Level 2: OversightWith the right tools, we can ensure that project status updates are revised on a regular basis (e.g. at least monthly) for all ongoing projects.
    Capability Level 1: ReactiveProject managers escalate issues directly with their direct supervisor or project sponsor because there is no formal PPM practice.

    Benchmark the current portfolio reporting process against strategy-aligned goals

    Associated Activity icon 2.2.1b – 1-2 hours

    INPUT: Documentation describing the current process (e.g. standard operating procedures), Process goals from activity 1.2.1

    OUTPUT: Retrospective review of current process

    Materials: 4x6” recipe cards, Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers

    Conduct a table-top planning exercise to map out the process currently in place.

    1. Use white 4”x6” recipe cards to write unique steps of a process. Use the portfolio reporting process from the previous slides as a guide.
    2. Use green cards to write artifacts or deliverables that result from a step.
    3. Use pink cards to write issues, problems, or risks.
    4. Discuss how the process could better achieve the strategy-aligned goals from activity 1.2.1. Keep a list of possible changes in the form of a start-stop-continue retrospective (example below) on a whiteboard.
    Start Stop Continue
    • Report on lightweight KPIs
    • Standardize the status reports
    • Project managers waiting too long before declaring a red status
    • Produce weekly project portfolio-wide report for senior leadership

    Set near- and long-term action items for the portfolio reporting process

    Associated Activity icon 2.2.1c – 30 minutes - 1 hour

    INPUT: Outcome of the retrospective review, Process goals and metrics from activity 1.2.1

    OUTPUT: Action items for evolving the process to a target state

    Materials: Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers

    Analyze each item in the start-stop-continue retrospective to compile a set of near-term and long-term action items.

    The near-term plan should include steps that are within the authority of the PMO and do not require approval or investment outside of that authority. The long-term plan should include steps that may require a longer approval process, buy-in of external stakeholders, and the investment of time and money.
    Near-Term Action Items Long-Term Action Items
    For example:
    • Establish a reporting process that can be consistently maintained using lightweight KPIs.
    • Provide a simple dashboard that stakeholders can use to see their project status reports at a high level.
    For example:
    • Adopt a commercial tool for maintaining consistent status reports.
    • Support the tool with training and a mandate of adoption among all users.

    Review and customize slide 29, “Portfolio reporting: action items,” in Info-Tech’s PPM Strategic Plan Template.

    Draft a high-level description of the portfolio reporting process at a target state

    Associated Activity icon 2.2.1d – 1-2 hours

    INPUT: Action items for evolving the process to a target state

    OUTPUT: High-level description of the process at the target state

    Materials: Whiteboard, PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers

    1. Break down the process into several tasks at a high level. Avoid getting into too much detail by limiting the number of steps.
    2. An example of high-level breakdown: portfolio reporting
      Create project status reports –› Create a project portfolio status report –› Report on project portfolio status –› Act on portfolio steering decisions


    3. Describe each task by answering the following questions. Document your response in the PPM Strategic Plan Template.
    4. Question

      Description

      InputWhat information do you need to perform the work?
      OutputWhat artifacts/deliverables are produced as a result?
      Frequency/TimingHow often, and when, will the work be performed?
      ResponsibilityWho will perform the work?
      AccountabilityWho will approve the work and assume the ownership of any decisions?

    5. Record the time cost of each process using the PPM Strategy Development Tool.

    Document the high-level description for the new portfolio reporting process

    Associated Activity icon 2.2.1e – 30 minutes - 1 hour

    INPUT: High-level description of the process at the target state

    OUTPUT: Updated PPM strategic plan

    Materials: PPM Strategic Plan Template

    Participants: PMO Director/ Portfolio Manager

    Update your PPM strategic plan with the new high-level description for the new portfolio reporting process. Depending on your current process capability level, you may wish to include additional information on your strategic plan, for example:

    • Updated project status report template with new KPIs.
    • Documentation of requirements for improved PPM dashboards and reports.

    Info-Tech has a dedicated blueprint to help you develop the high-level process description into a fully operationalized process. Upon completion of this PPM strategy blueprint, speak to an Info-Tech account manager or analyst to get started.

    Read Info-Tech’s Enhance PPM Dashboards and Reports blueprint.

    Review and customize slide 30, “Portfolio reporting: target state,” in Info-Tech’s PPM Strategic Plan Template.

    Streamlined status reporting improves portfolio visibility for executives, enabling data-driven steering of the portfolio

    CASE STUDY

    Industry: Public Administration
    Source: IAG / Info-Tech Interview

    Challenge

    The client had no effective real-time reporting in place to summarize their work efforts. In addition, the client struggled with managing existing resources against the ability to deliver on the requested project workload.

    Existing project reporting processes were manually intensive and lacked mature reporting capabilities.

    Solution

    Through a short and effective engagement, IAG conducted surveys and facilitated interviews to identify the information needed by each stakeholder. From this analysis and industry best practices, IAG developed scorecards, dashboards, and project summary reports tailored to the needs of each stakeholder group. This integrated reporting tool was then made available on a central portal for PPM stakeholders.

    Results

    Stakeholders can access project scorecard and dashboard reports that are available at any given time.

    Resource reporting enabled the PMO to better balance client demand with available project capacity and forecast any upcoming deficiencies in resourcing that affect project delivery.

    Project closure at the portfolio level controls throughput and responsiveness of the portfolio

    Take control over projects that linger on, projects that don’t provide value, and projects that do not align with changing organizational priority.

    Questions

    • Who declares that a project is done?
    • Who validates it?
    • Who is this reported to?
    • Who terminates low-value projects?
    • How will they decide that a project is too low value to continue?

    Benefits

    • Minimize post-implementation problems by ensuring clean handoffs, with clear responsibilities for ongoing support and maintenance.
    • Drive continuous improvement by capturing and applying lessons learned.
    • Increase the project portfolio’s responsiveness to change by responding to emerging opportunities and challenges.

    Challenges

    • Completion criteria and “definition of done” need to be well defined and done so at project initiation.
    • Scope changes need to be managed and documented throughout the project.
    • Portfolio responsiveness requires deep cultural changes that will be met with confusion and resistance from some stakeholders.

    Info-Tech Insight

    Although “change in organizational priority” is the most frequently cited cause of project failure (PMI Pulse of Profession, 2017), closing projects that don’t align with organizational priority ought to be a key PPM goal. Therefore, don’t think of it as project failure; instead, think of it as PPM success.

    Maintain the health of the project portfolio with a repeatable project closure process

    Info-Tech recommends following a four-step process for project closure.

    A diagram of Info-Tech's four-step process for project closure. There are five groups that may be involved in any one step, they are laid out on the side as row headers that each step's columns may fall into, 'Resources', 'Resource Managers', 'Project Managers', 'PMO', and 'Governance Layer'. The first steps are 'Complete project' which involves 'Project Managers', and 'Terminate low value projects' which involves 'PMO' and 'Governance layer'. Step 2 is 'Validate project closure' which involves 'Project Managers' and 'PMO', with a note that reads 'This includes facilitating the project sponsor sign-off, accepting and archiving lessons learned documents, etc.' The third steps are 'Conduct post-project work' which involves 'Project Managers' and 'PMO', and 'Update resource availability' which includes 'Resource Managers'. Step 4 is 'Conduct post-implementation review' which involves all groups.

    Info-Tech Best Practice

    Post-implementation review checks which benefits (including those set out in the business case) have been achieved and identifies opportunities for further improvement. Without it, it can be difficult to demonstrate that investment in a project was worthwhile.

    Determine your project closure process capability level

    Associated Activity icon 2.2.2a – 10 minutes

    INPUT: Organizational strategy and culture

    OUTPUT: Project closure capability level

    Materials: PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, Business Analysts

    Kick-off the discussion about the project closure process by reading the capability level descriptions below and discussing which level currently applies to you the most.

    Capability Level Descriptions

    Capability Level 5: OptimizedProject closure is centrally managed and supports post-project benefits tracking.
    Capability Level 4: AlignedProject closure is centrally managed at the portfolio level to ensure completion/acceptance criteria are satisfied.
    Capability Level 3: EngagedProject closure is confirmed at the portfolio level, but with minimal enforcement of satisfaction of completion/acceptance criteria.
    Capability Level 2: EncouragedProject managers often follow handoff and closure procedures, but project closure is not confirmed or governed at the portfolio level.
    Capability Level 1: UnmanagedProject closure is not governed at either the project or portfolio level.

    Benchmark the current project closure process against strategy-aligned goals

    Associated Activity icon 2.2.2b – 1-2 hours

    INPUT: Documentation describing the current process (e.g. standard operating procedures), Process goals from activity 1.2.1

    OUTPUT: Retrospective review of current process

    Materials: 4x6” recipe cards, Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers, Business Analysts

    Conduct a table-top planning exercise to map out the process currently in place.

    1. Use white 4”x6” recipe cards to write unique steps of a process. Use the project closure process from the previous slides as a guide.
    2. Use green cards to write artifacts or deliverables that result from a step.
    3. Use pink cards to write issues, problems, or risks.
    4. Discuss how the process could better achieve the strategy-aligned goals from activity 1.2.1. Keep a list of possible changes in the form of a start-stop-continue retrospective (example below) on a whiteboard.
    Start Stop Continue
    • Conduct reprioritization of projects at a regular cadence
    • Prune projects every year
    • Waive post-implementation review for time-constrained projects
    • Collect project post-mortem reports and curate in PMO SharePoint

    Set near- and long-term action items for the project closure process

    Associated Activity icon 2.2.2c – 30 minutes - 1 hour

    INPUT: Outcome of the retrospective review, Process goals and metrics from activity 1.2.1

    OUTPUT: Action items for evolving the process to a target state

    Materials: Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Analyze each item in the start-stop-continue retrospective to compile a set of near-term and long-term action items.

    The near-term plan should include steps that are within the authority of the PMO and do not require approval or investment outside of that authority. The long-term plan should include steps that may require a longer approval process, buy-in of external stakeholders, and the investment of time and money.
    Near-Term Action Items Long-Term Action Items
    For example:
    • Begin establishing project closure criteria in the project initiation process.
    • Manage and document scope changes throughout the project.
    For example:
    • Institute a formal process to ensure that all projects are closed at the portfolio level and properly handed off to support and maintenance teams.

    Review and customize slide 32, “Project closure: action items,” in Info-Tech’s PPM Strategic Plan Template.

    Draft a high-level description of the project closure process at a target state

    Associated Activity icon 2.2.2d – 1-2 hours

    INPUT: Action items for evolving the process to a target state

    OUTPUT: High-level description of the process at the target state

    Materials: Whiteboard, PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    1. Break down the process into several tasks at a high level. Avoid getting into too much detail by limiting the number of steps.
    2. An example of high-level breakdown: project closure
      Complete or terminate projects –› Validate project closure –› Conduct post-project work –› Conduct post-implementation review


    3. Describe each task by answering the following questions. Document your response in the PPM Strategic Plan Template.
    4. Question

      Description

      Input What information do you need to perform the work?
      Output What artifacts/deliverables are produced as a result?
      Frequency/Timing How often, and when, will the work be performed?
      Responsibility Who will perform the work?
      Accountability Who will approve the work and assume the ownership of any decisions?


    5. Record the time cost of each process using the PPM Strategy Development Tool.

    Document the high-level description for the new project closure process

    Associated Activity icon 2.2.2e – 30 minutes - 1 hour

    INPUT: High-level description of the process at the target state

    OUTPUT: Updated PPM strategic plan

    Materials: PPM Strategic Plan Template

    Participants: PMO Director/ Portfolio Manager

    Update your PPM strategic plan with the new high-level description for the new project closure process. Depending on your current process capability level, you may wish to include additional information on your strategic plan, for example:

    • Updated project closure checklist.
    • Project value review meeting process document.
    • Post-implementation review process document.

    Info-Tech has several research notes that elaborate on aspects of project closure. Upon completion of this PPM strategy blueprint, speak to an Info-Tech account manager or analyst to get started.

    Read Info-Tech’s research notes on project closure:

    • The Importance of Conducting a Post Implementation Review
    • Five Key Steps to Mastering Project Closure
    • ‘Governance’ Will Kill Your Projects

    Review and customize slide 33, “Project closure: target state,” in Info-Tech’s PPM Strategic Plan Template.

    Validate the time and effort spent on projects with a benefits realization process

    Maximizing benefits from projects is the primary goal of PPM. Tracking and reporting on benefits post-project closes the loop on benefits.

    Questions

    • How do validate the project benefits from the original business case?
    • How do we track the benefits?
    • Who reports it? When?

    Benefits

    • Maximize benefits realization by identifying and addressing unforeseen issues or limitations to success.
    • Improve project approval and prioritization by improving validity of the business case definition process.

    Challenges

    • Project sponsors need to be willing to invest time – months and years post-project completion – to validate benefits realization.
    • Portfolio management needs to proactively work with sponsors to facilitate benefits tracking.
    • Business cases need to be well developed and documented to reflect real anticipated benefits.

    Too many projects fail to achieve the originally proposed benefits, and too few organizations are able to identify and address the root causes of those shortfalls.

    Info-Tech Insight

    In reality, benefits realization process extends across the entire project life cycle: during intake, during the execution of the project, and after project completion. Be mindful of this extended scope when you discuss benefits realization in the following activity.

    Keep project benefits front and center with a repeatable benefits realization process

    Info-Tech recommends following a four-step process for benefits realization.

    A diagram of Info-Tech's four-step process for benefits realization. There are four groups that may be involved in any one step, they are laid out on the side as row headers that each step's columns may fall into, 'Business Analysts', 'Project Managers', 'PMO', and 'Governance Layer'. The first step is 'Quantify and validate benefits in business case' which happens 'Before Project' and involves 'Business Analysts' and 'Project Managers'. Step 2 is 'Update projected project benefits' which happens 'During Project' and involves 'Project Managers' and 'PMO'. Step 3 is 'Hand-off benefits realization ownership' which happens at the end of project and involves 'Project Managers', 'PMO' and 'Governance layer'. Step 4 is 'Monitor and report on benefits' which happens 'After Project' and involves 'PMO' and 'Governance layer'.

    Info-Tech Insight

    At the heart of benefits realization is accountability: who is held accountable for projects that don’t realize the benefits and how? Without the buy-in from the entire executive layer team, addressing this issue is very difficult.

    Determine your benefits realization process capability level

    Associated Activity icon 2.2.3a – 10 minutes

    INPUT: Organizational strategy and culture

    OUTPUT: benefits realization capability level

    Materials: PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Kick-off the discussion about the benefits realization process by reading the capability level descriptions below and discussing which level currently applies to you the most.

    Capability Level Descriptions

    Capability Level 5: OptimizedProject sponsors and key stakeholders are accountable for stated project benefits before, during and after the project. There is a process to maximize the realization of project benefits.
    Capability Level 4: AlignedProject benefits are forecasted and taken into account for approval, updated when changes are made to the project, and monitored/reported after projects are completed.
    Capability Level 3: EngagedProject benefits are forecasted and taken into account for approval, and there is a loosely defined process to report on benefits realization.
    Capability Level 2: DefinedProject benefits are forecasted and taken into account for approval, but there is no process to monitor whether the said benefits are realized.
    Capability Level 1: UnmanagedProjects are approved and initiated without discussing benefits.

    Benchmark the current benefits realization process against strategy-aligned goals

    Associated Activity icon 2.2.3b – 1-2 hours

    INPUT: Documentation describing the current process (e.g. standard operating procedures), Process goals from activity 1.2.1

    OUTPUT: Retrospective review of current process

    Materials: 4x6” recipe cards, Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Conduct a table-top planning exercise to map out the process currently in place.

    1. Use white 4”x6” recipe cards to write unique steps of a process. Use the benefits realization process from the previous slides as a guide.
    2. Use green cards to write artifacts or deliverables that result from a step.
    3. Use pink cards to write issues, problems, or risks.
    4. Discuss how the process could better achieve the strategy-aligned goals from activity 1.2.1. Keep a list of possible changes in the form of a start-stop-continue retrospective (example below) on a whiteboard.
    StartStopContinue
    • Require “hard monetary value” in business benefits
    • Send project updates before resource management meetings

    Set near- and long-term action items for the benefits realization process

    Associated Activity icon 2.2.3c – 30 minutes - 1 hour

    INPUT: Outcome of the retrospective review, Process goals and metrics from activity 1.2.1

    OUTPUT: Action items for evolving the process to a target state

    Materials: Whiteboard

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Analyze each item in the start-stop-continue retrospective to compile a set of near-term and long-term action items.

    The near-term plan should include steps that are within the authority of the PMO and do not require approval or investment outside of that authority. The long-term plan should include steps that may require a longer approval process, buy-in of external stakeholders, and the investment of time and money.
    Near-Term Action Items Long-Term Action Items
    For example:
    • Create an “orientation for project sponsors” document.
    • Encourage project managers to re-validate project benefits on an ongoing basis and report any deviation.
    For example:
    • Recruit the finance department’s help in benefits tracking.
    • Require Finance’s sign-off on project benefits in business cases during intake.

    Review and customize slide 35, “Benefits realization: action items,” in Info-Tech’s PPM Strategic Plan Template.

    Draft a high-level description of the benefits realization process at a target state

    Associated Activity icon 2.2.3d – 1-2 hours

    INPUT: Action items for evolving the process to a target state

    OUTPUT: High-level description of the process at the target state

    Materials: Whiteboard, PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    1. Break down the process into several tasks at a high level. Avoid getting into too much detail by limiting the number of steps.
    2. An example of high-level breakdown: benefits realization
      Validate benefits in business case –› Update project benefits during execution –› Hand-off benefits ownership –› Monitor and report on benefits


    3. Describe each task by answering the following questions. Document your response in the PPM Strategic Plan Template.
    4. Question

      Description

      InputWhat information do you need to perform the work?
      OutputWhat artifacts/deliverables are produced as a result?
      Frequency/TimingHow often, and when, will the work be performed?
      ResponsibilityWho will perform the work?
      AccountabilityWho will approve the work and assume the ownership of any decisions?

    5. Record the time cost of each process using the PPM Strategy Development Tool.

    Document the high-level description for the new benefits realization process

    Associated Activity icon 2.2.3e – 30 minutes - 1 hour

    INPUT: High-level description of the process at the target state

    OUTPUT: Updated PPM strategic plan

    Materials: PPM Strategic Plan Template

    Participants: PMO Director/ Portfolio Manager

    Update your PPM strategic plan with the new high-level description for the new benefits realization process. Depending on your current process capability level, you may wish to include additional information on your strategic plan, for example:

    • Updated business plan templates.
    • Communication plan for project sponsors.

    Info-Tech has a dedicated blueprint to help you develop the high-level process description into a fully operationalized process. Upon completion of this PPM strategy blueprint, speak to an Info-Tech account manager or analyst to get started.

    Read Info-Tech’s Establish the Benefits Realization Process blueprint.

    Review and customize slide 36, “Benefits realization: target state,” in Info-Tech’s PPM Strategic Plan Template.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    Photo of Barry Cousins.
    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    Sample of activity 2.1.1 'Align your project intake, prioritization, and approval process to the PPM strategy'. Align your project intake, prioritization, and approval process to the PPM strategy

    Examine the process at the current state and develop an action plan to improve it, with a high-level description of the process at a target state and its overhead costs. The outcome of this activity feeds into the overall PPM strategic plan.

    Sample of activity 2.1.2 'Align your resource management process to the PPM strategy'. Align your resource management process to the PPM strategy

    Examine the process at the current state and develop an action plan to improve it, with a high-level description of the process at a target state and its overhead costs. The outcome of this activity feeds into the overall PPM strategic plan.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    Sample of activity 2.2.1 'Align your portfolio reporting process to the PPM strategy'.Align your portfolio reporting process to the PPM strategy

    Examine the process at the current state and develop an action plan to improve it, with a high-level description of the process at a target state and its overhead costs. The outcome of this activity feeds into the overall PPM strategic plan.

    Sample of activity 2.2.2 'Align your project closure process to the PPM strategy'.Align your project closure process to the PPM strategy

    Examine the process at the current state and develop an action plan to improve it, with a high-level description of the process at a target state and its overhead costs. The outcome of this activity feeds into the overall PPM strategic plan.

    Sample of activity 2.2.3 'Align your benefits realization process to the PPM strategy'.Align your benefits realization process to the PPM strategy

    Examine the process at the current state and develop an action plan to improve it, with a high-level description of the process at a target state and its overhead costs. The outcome of this activity feeds into the overall PPM strategic plan.

    Develop a Project Portfolio Management Strategy

    PHASE 3

    Complete Your PPM Strategic Plan

    Phase 2 outline

    Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 3: Complete your PPM strategic plan

    Proposed Time to Completion: 2 weeks
    Step 3.1: Select a right-sized PPM solutionStep 3.2: Finalize your PPM Strategic Plan Template
    Work with an analyst to:
    • Assess your PPM tool requirements to help support your processes.
    Review findings with analyst:
    • Determine the costs and potential benefits of your PPM strategy.
    Then complete these activities…
    • Determine the functionality requirements of the PPM solution.
    • Estimate your PPM tool budget.
    • Review the tool assessment.
    Then complete these activities…
    • Estimate the total cost-in-use of managing the project portfolio.
    • Estimate the benefits of the PPM strategy.
    • Refine and consolidate the near-term action items into a cohesive implementation plan.
    With these tools & templates:
    • PPM Strategy Development Tool
    With these tools & templates:
    • PPM Strategy Development Tool
    • PPM Strategic Plan Template

    Phase 3 Insight:

    • Approach PPM as an evolving discipline that requires adaptability and long-term organizational change. Near-term process improvements should create stakeholder desire for better portfolio visibility and agility over the long term.

    Step 3.1: Select a right-sized PPM solution for supporting your new processes

    PHASE 1

    PHASE 2

    PHASE 3

    1.11.22.12.23.13.2
    Choose the right PPM strategyTranslate strategy into process goalsDefine intake & resource mgmt. processesDefine reporting, closure, & benefits mgmt. processesSelect a right-sized PPM solutionFinalize your PPM strategic plan

    This step will walk you through the following activities:

    • Determine the functionality requirements of a PPM solution in the near and long terms.
    • Estimate your PPM tool budget.
    • Review tool assessment.

    This step involves the following participants:

    • CIO
    • PMO Director/ Portfolio Manager
    • Project Managers
    • IT Managers

    Outcomes of this step

    • List of functional requirements for a PPM solution
    • An estimate budget and cost for supporting a PPM tool in the near and long terms
    • PPM tool requirements for the near and long terms

    Right-size your PPM solution/tool to fit your PPM processes

    Avoid a common pitfall: the disconnect between PPM processes and PPM tools.

    PPM tools act as both a receptacle for portfolio data generated by your processes and a source of portfolio data to drive your processes forward. Therefore, choosing a suitable PPM tool is critical to the success of your PPM strategy:

    • PPM tool inputs must match the type, level of detail, and amount of portfolio data generated by your PPM processes.
    • PPM tool outputs must be useful, insightful, easy to access, and easy to understand for people who engage in your PPM processes.

    User adoption is an often cited cause of failed PPM tool implementation:

    "The biggest problem is getting the team to work with the tool. We need to make sure that we’re not wasting time delving too far down into the tool, yet putting enough information to get useful information back." (IT Director, Financial Services)

    This final step of the blueprint will discuss the choice of PPM tools to ensure the success of PPM strategy by avoiding the process-tool disconnect.

    Common pitfalls for PPM tools

    • Purchasing and implementing a PPM tool before the process is defined and accepted.
    • Poor expectation setting: inability of tools to perform the necessary analysis.
    • Underleveraged: low user/process adoption.
    • Poor integration with the corporate finance function.
    • (WGroup, 2017)

    Leverage PPM tools to get the information you need

    An optimized PPM solution is the vehicle that provides decision makers with four key pieces of information they require when making decisions for your project portfolio:

    • Historical Insight – inform decision makers about how much time and resources have been spent to date, and benchmark the accuracy of prior project estimates and resource allocations.
    • Forecasting – provide a trustworthy estimate of demand on resources and current projects.
    • Portfolio Analytics – analyze portfolio data and generate easy-to-consume reports that provide answers to questions such as:
      • How big is our overall portfolio?
      • How much money/resource time is available?
      • How efficiently are we using our resources?
    • Project Visibility – provide a trustworthy report on the status of current projects and the resources working on them.

    Info-Tech Insight

    Without the proper information, decision makers are driving blind and are forced to make gut feel decisions as opposed to data-informed decisions. Implement a PPM solution to allocate projects properly and ensure time and money don’t vanish without being accounted for.

    Commercial PPM tools have more functionality but are more costly, complex, and difficult to adopt

    • Granular timesheet management
    • Workflow and team collaboration
    • Robust data and application integration
    • Advanced what-if planning
    • Mobile usability
    A map comparing commercial PPM tools by 'Functionality', 'Cost', and 'Difficulty to implement/adopt'. 'Functionality' and 'Difficulty to implement/adopt' share an axis and can be assumed to have a linear relationship. 'Spreadsheets' are low functionality and low cost. 'Google Sites' are low to middling functionality and low cost. 'SharePoint' is middling functionality with a slightly higher cost. The next three start at middling cost and above-average functionality and trend higher in both categories: 'Commercial Entry-Level PPM', 'Commercial Mid-Market PPM', and 'Commercial Enterprise PPM'.
    • Business case scoring and prioritization
    • Multi-user reporting and request portal
    • High-level resource management
    • Project status, cost, and risk tracking

    "Price tags [for PPM tools] vary considerably. Expensive products don't always provide more capability. Inexpensive products are generally low cost for good reason." (Merkhofer)

    Your PPM tool options are not limited to commercial offerings

    Despite the rapid growth in the commercial PPM tool market today, homegrown approaches like spreadsheets and intranet sites continue to be used as PPM tools.

    Kinds of PPM solutions used by Info-Tech clients

    A pie chart visualizing the kinds of PPM solutions that are used by Info-Tech clients. There are three sections, the largest of which is 'Spreadsheet-based, 46%', then 'Commercial, 33%', then 'No solution, 21%'. (Source: Info-Tech Research Group (2016), N=433)

    Category

    Characteristics

    PPM maturity

    Enterprise tool
    • Higher professional services requirements for enterprise deployment
    • Larger reference customers
    High
    Mid-market tool
    • Lower expectation of professional services engaged in initial deployment contract
    • Fewer globally recognizable reference clients
    • Faster deployments
    High
    Entry-level tool
    • Lower cost than mid-market & enterprise PPM tools
    • Limited configurability, reporting, and resource management functionalities
    • Compelling solutions to the organizations that wants to get a fast start to a trial deployment
    Intermediate
    Spreadsheet based
    • Little/no up-front cost, highly customizable to suit your organization’s needs
    • Varying degrees of sophistication
    • Few people in the organization may understand the logic behind the tool; knowledge may not be easily transferrable
    Intermediate Low

    Determine the functional requirements of the PPM solution

    Associated Activity icon 3.1.1 – 20 minutes

    INPUT: PPM strategic plan

    OUTPUT: Modified PPM strategic plan with a proposed choice of PPM tool

    Materials: PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, IT Managers

    Use the Tool Assessment tab (tab 4) of Info-Tech’s PPM Strategy Development Tool to rate and analyze functional requirements of your PPM solution.

    • Review the list of PPM features provided on column B of tab 4. You can add any desired features not listed.
    • Rate your near-term and long-term feature requirements using the drop-down menus in columns C and D. Your selections here will inform the tool selection bubble chart to the right of the features list.

    Screenshot showing the features list on tab 4 of the PPM Strategy Development Tool.

    Estimate your PPM tool budget

    Associated Activity icon 3.1.2 – 20 minutes

    INPUT: PPM strategic plan

    OUTPUT: Modified PPM strategic plan with a proposed choice of PPM tool

    Materials: PPM Strategy Development Tool

    Participants: CIO, PMO Director/ Portfolio Manager, Project Managers, IT Managers

    Enter the PPM tool budget information on the Tool Assessment tab of Info-Tech’s PPM Strategy Development Tool.

    • As a starting point, it can help to know that low-priced PPM tools cost around $1,000 per user per year. High-priced PPM tools cost around $3,000 per user per year.
    • Software-as-a-Service (SaaS)-based pricing for PPM solutions is increasingly popular. If you plan to purchase perpetual licensing, divide the total implementation and licensing cost by three years to be comparable with a three-year SaaS total cost of ownership analysis.

    Screenshot showing the tool assessment from the PPM Strategy Development Tool with 'Near-Term' and 'Long-Term' budget columns. Notes include 'Enter the number of fully licensed PPM users you expect to provision for and your estimated annual budget for a PPM tool', 'The tool assessment automatically calculates your annual budget per user, which is reflected in the bubble chart analysis (see next slide)'.

    Review the tool assessment graphic

    Associated Activity icon 3.1.3 – 20 minutes

    The map comparing commercial PPM tools from before, this time overlaid with 'Near-Term' and 'Long-Term' budgets as coloured circles. The vertical axis is 'Functionality Rating' and the horizontal axis is now 'Annual Cost/Budget per User'. 'Spreadsheets' are low functionality and low cost. 'Google Sites' are low to middling functionality and low cost. 'SharePoint' is middling functionality with a slightly higher cost. The 'Near-Term' budget circle covers those three tools. The next three start at middling cost and above-average functionality and trend higher in both categories: 'Commercial Entry-Level PPM', 'Commercial Mid-Market PPM', and 'Commercial Enterprise PPM'. The 'Long-Term' budget circle covers 'Commercial Mid-Market PPM'.

    If you are in one of the non-covered areas, consider revisiting your functional requirements and PPM strategy. You may need to lessen your expectations to be able to stay within your budget, or find a way to get more money.

    Keep in mind that the long-term goal can be to work towards a commercial tool, while the short-term goal would be to be able to maintain your portfolio in a simple spreadsheet first.

    Info-Tech Insight

    If you choose a commercial solution, you will need to gain executive buy-in in order to implement the tool; proceed to near-term and long-term plans to get the ball rolling on this decision.

    Review and customize slide 37, “Tools for PPM: proposed near- and long-term solutions,” in Info-Tech’s PPM Strategic Plan Template.

    Grow your own, or select and implement, a PPM solution with Info-Tech

    Whether you choose spreadsheet-based or commercially available PPM solutions, use Info-Tech’s research for scoping, designing, and implementing them.

    Info-Tech’s Grow Your Own PPM Solution blueprint will help you implement a highly evolved spreadsheet-based PPM solution. It features the Portfolio Manager 2017, a Microsoft Excel-based workbook that leverages its business intelligence features to provide a basis for implementing a scalable, highly customizable PPM tool with useful and easy-to-manipulate analytics.

    Read Info-Tech’s Grow Your Own PPM Solution blueprint.

    Info-Tech’s Select and Implement a PPM Solution blueprint is part of our Vendor Landscape research. Make sense of the diversity of PPM solutions available in today’s market, and choose the most appropriate solutions for your organization’s size and level of PPM maturity.

    Read Info-Tech’s Select and Implement a PPM Solution blueprint.

    A right-sized PPM strategy leads to a right-sized portfolio management tool based on Info-Tech’s template

    CASE STUDY

    Industry: Energy
    Source: Info-Tech Client

    “The approach makes it easy to run the portfolio without taking time away from the project themselves.” (IT Manager, Energy Resources Firm)

    Situation

    • A small IT department struggled with balancing project work with ongoing operational management and support work.
    • The department includes experienced and successful project managers and a mature, skilled team.
    • However, the nature of the department’s role has evolved to the point where the project and operational work demands have exceeded the available time.
    • Prioritization needed to become more centralized and formalized while management control of the work assignments became increasingly decentralized.

    Complication

    • Agile projects offer clear advantages by lightening the requirement for proactive planning. However, getting the staff to adapt would be challenging because of the overall workload and competing priorities.
    • Some of the team’s time needed to be carefully tracked and reported for time & materials-based billing, but the time sheet system was unsuited to their portfolio management needs.
    • Commercial PPM systems were ruled out because strict task management seemed unlikely to gain adoption.

    Resolution

    • The team deployed Info-Tech’s Project Portfolio Workbook, based on a Microsoft Excel template, and the Grow Your Own PPM Solution blueprint.
    • For the first time, executive leadership was given a 12-month forecast of resource capacity based on existing and pending project commitments. The data behind the capacity forecast was based on allocating people to projects with a percentage of their time for each calendar month.
    • The data behind the forecast is high level but easily maintainable.

    Step 3.2: Finalize customizing your PPM Strategic Plan Template

    PHASE 1

    PHASE 2

    PHASE 3

    1.11.22.12.23.13.2
    Choose the right PPM strategyTranslate strategy into process goalsDefine intake & resource mgmt. processesDefine reporting, closure, & benefits mgmt. processesSelect a right-sized PPM solutionFinalize your PPM strategic plan

    This step will walk you through the following activities:

    • Determine the costs of support your PPM strategic plan.
    • Estimate some of the benefits of your PPM strategic plan.
    • Perform a cost-benefit analysis.
    • Refine and consolidate the near-term action items into a cohesive plan.

    This step involves the following participants:

    • CIO
    • PMO Director/ Portfolio Manager
    • Project Managers
    • IT Managers

    Outcomes of this step

    • A cost/benefit analyst
    • An implementation action plan
    • A finalized PPM Strategic Plan Template

    Estimate the total cost-in-use of managing the project portfolio

    Supporting Tool icon 3.2.1 – PPM Strategy Development Tool, Tab 5: Costing Summary

    The time cost of PPM processes (tab 3) and PPM tool costs (tab 4) are summarized in this tab. Enter additional data to estimate the total PPM cost-in-use: the setup information and the current cost of PPM software tools.

    Screenshot of the PPM Strategy Development Tool, Tab 5: Costing Summary. Notes include 'If unknown, the overall HR budget of your project portfolio can be estimated as: (# FTEs) * (fully-loaded FTE cost per hour) * 1800', 'This is your total PPM cost-in-use'.

    Estimate the benefits of managing the project portfolio

    Supporting Tool icon 3.2.2 – PPM Strategy Development Tool, Tab 6: Benefits Assumptions

    The benefits of PPM processes are estimated by projecting the sources of waste on your resource capacity.

    1. Estimate the current extent of waste on your resource capacity. If you have completed Info-Tech’s PPM Current Score Scorecard, enter the data from the report.
    2. Screenshot of a Waste Assessment pie chart from the PPM Strategy Development Tool, Tab 6: Benefits Assumptions.
    3. Given your near- and long-term action items for improving PPM processes, estimate how each source of waste on your resource capacity will change.
    4. Screenshot of a Waste Assessment table titled 'These inputs represent the percentage of your overall portfolio budget that is wasted in each scenario' from the PPM Strategy Development Tool, Tab 6: Benefits Assumptions.

    Review the cost-benefit analysis results and update the PPM Strategic Plan Template

    Supporting Tool icon 3.2.3 – PPM Strategy Development Tool, Tab 7: Conclusion Screenshot of a 'PPM Strategy Cost-Benefit Analysis' from the PPM Strategy Development Tool, Tab 7: Conclusion. It has tables on top and bar charts underneath.

    This tab summarizes the costs and benefits of your PPM strategic plan.

    • Costs are estimated from wasted project capacity and time spent on PPM process work.
    • Benefits are estimated from the project capacity to be reclaimed as a result of improvements in PPM.
    • Return on investment is calculated by dividing the value of project capacity to be reclaimed by investment in PPM in addition to the current-state cost.

    Capture this summary in your PPM strategic plan.

    Customize slides 40 and 41, “Return on PPM investment,” in Info-Tech’s PPM Strategic Plan Template.

    Determine who will be responsible for coordinating the flow, collection, and reporting of portfolio data

    Supporting Tool icon 3.2.3 – Project Portfolio/PMO Analyst Job Description

    You will need to determine responsibilities and accountabilities for portfolio management functions within your team.

    If you do not have a clearly identifiable portfolio manager at this time, you will need to clarify who will wear which hats in terms of facilitating intake and prioritization, high-level capacity awareness, and portfolio reporting.

    • Use Info-Tech’s Project Portfolio Analyst Job Description Template to help clarify some of the required responsibilities to support your PPM strategy.
      • If you need to bring in an additional staff member to help support the strategy, you can customize the job description template to help advertise the position. Simply edit the text in grey within the template.
    • If you have other PPM tasks that you need to define responsibilities for, you can use the RASCI chart on the final tab of the PPM Strategy Develop Tool.

    Download Info-Tech’s Project Portfolio Analyst Job Description Template.

    Sample of Info-Tech's Project Portfolio Analyst Job Description Template.

    Refine and consolidate the near-term action items into a cohesive plan

    Associated Activity icon 3.2.4 – 30 minutes

    INPUT: Near-term action items

    OUTPUT: Near-term action plan

    Materials: PPM Strategy Development Tool

    Participants: PMO Director/ Portfolio Manager, Project Managers, Resource Managers, Business Analysts

    Collect the near-term action items for each of the five PPM processes and arrange them into a table that outlines the near-term action plan. Once it is compiled, adjust the timeline and responsibility so that the plan is coherent and realistic as a whole.

    Example:

    Outcome

    Action required

    Timeline

    Responsibility

    Determine the percentage distribution of project vs. non-project work Run a time audit survey with all project resources 2 weeks Resource managers
    Test a simple dashboard for project status Pilot Info-Tech’s Portfolio Manager 2017 workbook 2 weeks PMO Director

    "There is a huge risk of taking on too much too soon, especially with the introduction of specific tools and tool sets. There is also an element of risk involved that can lead to failure and disappointment with PPM if these tools are not properly introduced and supported." (Jim Carse, Director of the Portfolio Office, Queen’s University)

    Review and customize slide 43, “Summary of near-term action plan,” in Info-Tech’s PPM Strategic Plan Template.

    Finalize and publish your PPM strategic plan

    Table of Contents

    Read over the document to ensure its completeness and consistency.

    At this point, you have a PPM strategic plan that is actionable and realistic, which addresses the goals set by the senior leadership.

    The executive brief establishes the need for PPM strategy, the goals and metrics are set by members of the senior leadership that gave the initial buy-in, and the target states of PPM processes that meet those goals are described. Finally, the costs and benefits of the improved PPM practice are laid out in a way that can be validated.

    The next step for your PPM strategy is to use this document as a foundation for implementing and operationalizing the target-state PPM processes.

    Review and publish the document for your executive layer and key project stakeholders. Solicit their feedback.

    Info-Tech has a library of blueprints that will guide you through each of the five processes. Contact your Info-Tech account manager or Info-Tech analyst to get started.

    • Project Portfolio Management Strategy
      • Strategic Expectations
      • Overview
    • Leadership Mandate
    • Project Demand and Resource Supply
    • The Current State of Resource Utilization
    • PPM Processes
      • Project intake, prioritization, and approval
      • Resource management
      • Portfolio reporting
      • Project closure
      • Benefits realization
      • Tools for PPM
    • The Economic Impact of PPM
    • PPM Strategy Next Steps

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

    Book a workshop with our Info-Tech analysts:

    Photo of Barry Cousins.
    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    Sample of activity 3.1 'Scope the right-sized PPM solution for your PPM strategy'. Scope the right-sized PPM solution for your PPM strategy

    Use the PPM Strategy Development Tool to quickly determine our near- and long-term recommendation for your PPM solution.

    Sample of activity 3.2 'Conduct a cost-benefit analysis of your PPM strategic plan'. Conduct a cost-benefit analysis of your PPM strategic plan

    Using the time cost estimates of each process and the requirement for a PPM tool, Info-Tech helps you quantify the overhead costs of PPM and estimate the monetary benefits of reclaimed project capacity for your project portfolio.

    Insight breakdown

    Insight 1

    • Executive layer buy-in is a critical prerequisite for the success of a top-down PPM strategy. Ensure your executives are on board before preceding to implement your PPM strategy.

    Insight 2

    • The means of project and portfolio management (i.e. processes) shouldn’t eclipse the ends – strategic goals. Root your process in your PPM strategic goals to realize PPM benefits (e.g. optimized portfolio value, improved project throughput, increased stakeholder satisfaction).

    Insight 3

    • Without the proper information, decision makers are driving blind and are forced to make gut-feel decisions as opposed to data-informed decisions. Implement a PPM solution to allocate projects properly and ensure time and money don’t vanish without being accounted for.

    Summary of accomplishment

    Knowledge Gained

    • Info-Tech’s thought model on PPM processes that create an infrastructure around projects
    • Your current state of project portfolio: project capacity vs. project demand
    • Importance of gaining executive buy-in for installing the PPM practice

    Processes Optimized

    • Project intake, prioritization, and approval process
    • Resource management process
    • Portfolio reporting process
    • Project closure process
    • Benefits realization process

    Deliverables Completed

    • Choice of PPM strategy and the leadership mandate
    • Analysis of current project capacity and demand
    • PPM process goals and metrics, aligned to meet PPM strategic expectations
    • PPM process capability levels
    • Retrospective examination of current state, near/long-term action items for improvement, and high-level descriptions of the five PPM processes
    • Recommendation of PPM tools to support the processes
    • Estimate of PPM overhead costs
    • Cost-benefit analysis of PPM practice
    • PPM strategic plan

    Related Info-Tech Research

    • Develop a Project Portfolio Management Strategy
    • Grow Your Own PPM Solution
    • Optimize Project Intake, Approval, and Prioritization
    • Develop a Resource Management Strategy for the New Reality
    • Manage a Minimum-Viable PMO
    • Establish the Benefits Realization Process
    • Manage an Agile Portfolio
    • Establish the Benefits Realization Process
    • Project Portfolio Management Diagnostic Program
      The Project Portfolio Management Diagnostic Program is a low-effort, high-impact program designed to help project owners assess and improve their PPM practices. Gather and report on all aspects of your PPM environment in order to understand where you stand and how you can improve.

    Research contributors and experts

    Photo of Kiron D. Bondale PMP, PMI-RMP, CDAP, CDAI, Senior Project Portfolio Management Professional Kiron D. Bondale PMP, PMI-RMP, CDAP, CDAI
    Senior Project Portfolio Management Professional

    Kiron has worked in the project management domain for more than fifteen years managing multiple projects, leading Project Management Offices (PMO) and providing project portfolio management consulting services to over a hundred clients across multiple industries. He has been an active member of the Project Management Institute (PMI) since 1999 and served as a volunteer director on the Board of the PMI Lakeshore Chapter for six years. Kiron has published articles on project and project portfolio management in multiple journals and has delivered over a hundred webinar presentations on a variety of PPM and PM topics and has presented at multiple industry conferences. Since 2009, Kiron has been blogging on a weekly basis on project management topics and responds to questions daily in the LinkedIn PMI Project, Program and Portfolio Management discussion group.

    Photo of Shaun Cahill, Project Manager, Queen’s University Shaun Cahill, Project Manager &
    Jim Carse, Director of the Project Portfolio Office
    Queen’s University

    Research contributors and experts

    Photo of Amy Fowler Stadler, Managing Partner, Lewis Fowler Amy Fowler Stadler, Managing Partner
    Lewis Fowler

    Amy has more than 20 years of experience in business and technology, most recently owning her own management consulting firm since 2002, focused on business transformation, technology enablement, and operational improvement. Prior to that, she was at CenturyLink (formerly Qwest) as an IT Director, Perot Systems in various roles, and Information Handling Services, Inc. as a Software Development Product Manager.

    Amy holds a bachelor’s degree in Computer Science with a minor in Business Communications and is also a 2015 Hall of Fame inductee to Illinois State University College of Applied Science and Technology.

    Photo of Rick Morris, President, R2 Consulting LLC Rick Morris, President
    R2 Consulting LLC

    Rick A. Morris, PMP, is a certified Scrum Agile Master, Human Behavior Consultant, best-selling author, mentor, and evangelist for project management. Rick is an accomplished project manager and public speaker. His appetite for knowledge and passion for the profession makes him an internationally sought after speaker delivering keynote presentations for large conferences and PMI events around the world. He holds the PMP (Project Management Professional), MPM (Masters of Project Management), Scrum Agile Master, OPM3, Six Sigma Green Belt, MCITP, MCTS, MCSE, TQM, ATM-S, ITIL, and ISO certifications, and is a John Maxwell Certified Speaker, Mentor, and Coach. Rick is the Owner of R2 Consulting, LLC and has worked for organizations such as GE, Xerox, and CA, and has consulted with numerous clients in a wide variety of industries including financial services, entertainment, construction, non-profit, hospitality, pharmaceutical, retail, and manufacturing.

    Research contributors and experts

    Photo of Terry Lee Ricci PgMP, PfMP, PMP, PPM Practice Lead, IAG Consulting Terry Lee Ricci PgMP, PfMP, PMP, PPM Practice Lead
    IAG Consulting

    Terry is passionate and highly skilled at PMO transformation, developing high-performing teams that sustain long-term business results. Terry has a reputation built upon integrity, resourcefulness, and respect. She has the vision to implement long and short-term strategies, meeting both current and evolving business needs.

    Change Management/Business transformation: Terry has extensive background in PMO strategy development aligned to corporate goals. Many years in the PMO organization integration/transformation building or overhauling programs and processes.

    Governance: Terry loves to monitor and measure performance and outcomes and uses her collaborative style to successfully bring simplicity to complexity (technology – people – process). Performance optimization results are easy to use and clearly define who is doing what across functions. End results consistently align to business strategy while mitigating risks effectively.

    Comprehensive: A “through the ranks” executive with a comprehensive understanding of PMO operations, high-performance teams, and the respective business units they support.

    Photo of Alana Ruckstuhl MSc, IT Project Officer, Federal Economic Development Agency for Southern Ontario Alana Ruckstuhl MSc, IT Project Officer
    Federal Economic Development Agency for Southern Ontario

    Research contributors and experts

    Photo of Jay Wardle, Director of the PMO, Red Wing Shoes Co. Jay Wardle, Director of the PMO
    Red Wing Shoes Co.
    Photo of Bob White, Vice President/Chief Information Officer, ALM Holding Company Bob White, Vice President/Chief Information Officer
    ALM Holding Company

    As vice president and chief information officer for ALM Holding Company, Bob White directs all technology activity and support for three main verticals: road construction, energy management, and delivery and transportation. He has been with ALM Holding Company for one and a half years, focusing on PPM process improvement, cybersecurity initiatives, and IT service management.

    Prior to joining ALM, Bob was executive vice president/chief information officer at Ashley Furniture Industries, Inc. where he led the strategic direction, implementation, and management of information technology throughout the company’s global operations. Bob has also held VP/CIO positions at the Stride Rite Corporation and Timex Corporation.

    Bob holds a Master’s degree in Operations Management from the University of Arkansas and a Bachelor of Science degree in Industrial Engineering from Southern Illinois University.

    Bibliography

    Bersin, Josh. “Time to Scrap Performance Appraisals?” Forbes Magazine, 5 June 2013. Web. 30 Oct 2013.

    Cheese, Peter et al. “Creating an Agile Organization.” Accenture, Oct. 2009. Web. Nov. 2013.

    Croxon, Bruce et al. “Dinner Series: Performance Management with Bruce Croxon from CBC's 'Dragon's Den'” HRPA Toronto Chapter. Sheraton Hotel, Toronto, ON. 12 Nov. 2013. Panel discussion.

    Culbert, Samuel. “10 Reasons to Get Rid of Performance Reviews.” Huffington Post Business, 18 Dec. 2012. Web. 28 Oct. 2013.

    Denning, Steve. “The Case Against Agile: Ten Perennial Management Objections.” Forbes Magazine, 17 Apr. 2012. Web. Nov. 2013.

    Estis, Ryan. “Blowing up the Performance Review: Interview with Adobe’s Donna Morris.” Ryan Estis & Associates, 17 June 2013. Web. Oct. 2013.

    Gallup, Inc. “Gallup Study: Engaged Employees Inspire Company Innovation.” Gallup Management Journal, 12 Oct. 2006. Web. 12 Jan 2012.

    Gartside, David et al. “Trends Reshaping the Future of HR.” Accenture, 2013. Web. 5 Nov. 2013.

    KeyedIn Solutions. “Why PPM and PMOs Fail.” KeyedIn Projects, 2013. Ebook.

    Lessing, Lawrence. Free Culture. Lulu Press Inc.: 30 July 2016.

    Merkhofer, Lee. “Keys to Implementing Project Portfolio Management.” Lee Merkhofer Consulting, 2017.

    Perry, Mark Price. Business Driven Project Portfolio Management. J Ross Pub: 17 May 2011.

    Project Management Institute. “Pulse of the Profession 2015: Capturing the Value of Project Management.” PMI, Feb. 2015. Web.

    Project Management Institute. “Pulse of the Profession 2016: The High Cost of Low Performance.” PMI, 2016. Web.

    Project Management Institute. “Pulse of the Profession 2017: Success Rates Rise.” PMI, 2017. Web.

    Project Management Institute. The Standard for Portfolio Management – Third Edition. PMI: 1 Dec. 2012.

    WGroup. “Common Pitfalls in Project Portfolio Management – Part 2.” WGroup, 24 Jan. 2017. Web.

    Tactics to Retain IT Talent

    • Buy Link or Shortcode: {j2store}549|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Engage
    • Parent Category Link: /engage
    • Regrettable turnover is impacting organizational productivity and leading to significant costs associated with employee departures and the recruitment required to replace them.
    • Many organizations focus on increasing engagement to improve retention, but this approach doesn’t address the entire problem.

    Our Advice

    Critical Insight

    • Engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

    Impact and Result

    • Build the case for creating retention plans by leveraging employee data and feedback to identify the key reasons for turnover that need to be addressed.
    • Target employee segments and work with management to develop solutions to retain top talent.

    Tactics to Retain IT Talent Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Tactics to Retain IT Talent Storyboard – Use this storyboard to develop a targeted talent retention plan to retain top and core talent in the organization.

    Integrate data from exit surveys and interviews, engagement surveys, and stay interviews to understand the most commonly cited reasons for employee departure in order to select and prioritize tactics that improve retention. This blueprint will help you identify reasons for regrettable turnover, select solutions, and create an action plan.

    • Tactics to Retain IT Talent Storyboard

    2. Retention Plan Workbook – Capture key information in one place as you work through the process to assess and prioritize solutions.

    Use this tool to document and analyze turnover data to find suitable retention solutions.

    • Retention Plan Workbook

    3. Stay Interview Guide – Managers will use this guide to conduct regular stay interviews with employees to anticipate and address turnover triggers.

    The Stay Interview Guide helps managers conduct interviews with current employees, enabling the manager to understand the employee's current engagement level, satisfaction with current role and responsibilities, suggestions for potential improvements, and intent to stay with the organization.

    • Stay Interview Guide

    4. IT Retention Solutions Catalog – Use this catalog to select and prioritize retention solutions across the employee lifecycle.

    Review best-practice solutions to identify those that are most suitable to your organizational culture and employee needs. Use the IT Retention Solutions Catalog to explore a variety of methods to improve retention, understand their use cases, and determine stakeholder responsibilities.

    • IT Retention Solutions Catalog
    [infographic]

    Workshop: Tactics to Retain IT Talent

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Identify Reasons for Regrettable Turnover

    The Purpose

    Identify the main drivers of turnover at the organization.

    Key Benefits Achieved

    Find out what to explore during focus groups.

    Activities

    1.1 Review data to determine why employees join, stay, and leave.

    1.2 Identify common themes.

    1.3 Prepare for focus groups.

    Outputs

    List of common themes/pain points recorded in the Retention Plan Workbook.

    2 Conduct Focus Groups

    The Purpose

    Conduct focus groups to explore retention drivers.

    Key Benefits Achieved

    Explore identified themes.

    Activities

    2.1 Conduct four 1-hour focus groups with the employee segment(s) identified in the pre-workshop activities.

    2.2 Info-Tech facilitators independently analyze results of focus groups and group results by theme.

    Outputs

    Focus group feedback.

    Focus group feedback analyzed and organized by themes.

    3 Identify Needs and Retention Initiatives

    The Purpose

    Home in on employee needs that are a priority.

    Key Benefits Achieved

    A list of initiatives to address the identified needs

    Activities

    3.1 Create an empathy map to identify needs.

    3.2 Shortlist retention initiatives.

    Outputs

    Employee needs and shortlist of initiatives to address them.

    4 Prepare to Communicate and Launch

    The Purpose

    Prepare to launch your retention initiatives.

    Key Benefits Achieved

    A clear action plan for implementing your retention initiatives.

    Activities

    4.1 Select retention initiatives.

    4.2 Determine goals and metrics.

    4.3 Plan stakeholder communication.

    4.4 Build a high-level action plan.

    Outputs

    Finalized list of retention initiatives.

    Goals and associated metrics recorded in the Retention Plan Workbook.

    Further reading

    Tactics to Retain IT Talent

    Keep talent from walking out the door by discovering and addressing moments that matter and turnover triggers.

    Executive Summary

    Your Challenge

    Many organizations are facing an increase in voluntary turnover as low unemployment, a lack of skilled labor, and a rise in the number of vacant roles have given employees more employment choices.

    Common Obstacles

    Regrettable turnover is impacting organizational productivity and leading to significant costs associated with employee departures and the recruitment required to replace them.

    Many organizations tackle retention from an engagement perspective: Increase engagement to improve retention. This approach doesn't consider the whole problem.

    Info-Tech's Approach

    Build the case for creating retention plans by leveraging employee data and feedback to identify the key reasons for turnover that need to be addressed.

    Target employee segments and work with management to develop solutions to retain top talent.

    Info-Tech Insight

    Engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

    This research addresses regrettable turnover

    This is an image of a flow chart with three levels. The top level has only one box, labeled Turnover.  the Second level has 2 boxes, labeled Voluntary, and Involuntary.  The third level has two boxes under Voluntary, labeled Non-regrettable: The loss of employees that the organization did not wish to keep, e.g. low performers, and Regrettable:  The loss of employees that the organization wishes it could have kept.

    Low unemployment and rising voluntary turnover makes it critical to focus on retention

    As the economy continues to recover from the pandemic, unemployment continues to trend downward even with a looming recession. This leaves more job openings vacant, making it easier for employees to job hop.

    This image contains a graph of the US Employment rate between 2020 - 2022 from the US Bureau of Economic Analysis and Bureau of Labor Statistics (BLS), 2022, the percentage of individuals who change jobs every one to five years from 2022 Job Seeker Nation Study, Jobvite, 2022, and voluntary turnover rates from BLS, 2022

    With more employees voluntarily choosing to leave jobs, it is more important than ever for organizations to identify key employees they want to retain and put plans in place to keep them.

    Retention is a challenge for many organizations

    The number of HR professionals citing retention/turnover as a top workforce management challenge is increasing, and it is now the second highest recruiting priority ("2020 Recruiter Nation Survey," Jobvite, 2020).

    65% of employees believe they can find a better position elsewhere (Legaljobs, 2021). This is a challenge for organizations in that they need to find ways to ensure employees want to stay at the organization or they will lose them, which results in high turnover costs.

    Executives and IT are making retention and turnover – two sides of the same coin – a priority because they cost organizations money.

    • 87% of HR professionals cited retention/turnover as a critical and high priority for the next few years (TINYpulse, 2020).
    • $630B The cost of voluntary turnover in the US (Work Institute, 2020).
    • 66% of organizations consider employee retention to be important or very important to an organization (PayScale, 2019).

    Improving retention leads to broad-reaching organizational benefits

    Cost savings: the price of turnover as a percentage of salary

    • 33% Improving retention can result in significant cost savings. A recent study found turnover costs, on average, to be around a third of an employee's annual salary (SHRM, 2019).
    • 37.9% of employees leave their organization within the first year. Employees who leave within the first 90 days of being hired offer very little or no return on the investment made to hire them (Work Institute, 2020).

    Improved performance

    Employees with longer tenure have an increased understanding of an organization's policies and processes, which leads to increased productivity (Indeed, 2021).

    Prevents a ripple effect

    Turnover often ripples across a team or department, with employees following each other out of the organization (Mereo). Retaining even one individual can often have an impact across the organization.

    Transfer of knowledge

    Retaining key individuals allows them to pass it on to other employees through communities of practice, mentoring, or other knowledge-sharing activities.

    Info-Tech Insight

    Improving retention goes beyond cost savings: Employees who agree with the statement "I expect to be at this organization a year from now" are 71% more likely to put in extra hours and 32% more likely to accomplish more than what is expected of their role (McLean & Company Engagement Survey, 2021; N=77,170 and 97,326 respectively).

    However, the traditional engagement-focused approach to retention is not enough

    Employee engagement is a strong driver of retention, with only 25% of disengaged employees expecting to be at their organization a year from now compared to 92% of engaged employees (McLean & Company Engagement Survey, 2018-2021; N=117,307).

    Average employee Net Promoter Score (eNPS)

    This image contains a graph of the Average employee Net Promoter Score (eNPS)

    Individual employee Net Promoter Scores (eNPS)

    This image contains a graph of the Individual employee Net Promoter Scores (eNPS)

    However, engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave.

    This analysis of McLean & Company's engagement survey results shows that while an organization's average employee net promoter score (eNPS) stays relatively static, at an individual level there is a huge amount of volatility.

    This demonstrates the need for an approach that is more capable of responding to or identifying employees' in-the-moment needs, which an annual engagement survey doesn't support.

    Turnover triggers and moments that matter also have an impact on retention

    Retention needs to be monitored throughout the employee lifecycle. To address the variety of issues that can appear, consider three main paths to turnover:

    1. Employee engagement – areas of low engagement.
    2. Turnover triggers that can quickly lead to departures.
    3. Moments that matter in the employee experience (EX).

    Employee engagement

    Engagement drivers are strong predictors of turnover.

    Employees who are highly engaged are 3.6x more likely to believe they will be with the organization 12 months from now than disengaged employees (McLean & Company Engagement Survey, 2018-2021; N=117,307).

    Turnover triggers

    Turnover triggers are events that act as shocks or catalysts that quickly lead to an employee's departure.

    Turnover triggers are a cause for voluntary turnover more often than accumulated issues (Lee et al.).

    Moments that matter

    Employee experience is the employee's perception of the accumulation of moments that matter within their employee lifecycle.

    Retention rates increase from 21% to 44% when employees have positive experiences in the following categories: belonging, purpose, achievement, happiness, and vigor at work. (Workhuman, 2020).

    While managers do not directly impact turnover, they do influence the three main paths to turnover

    Research shows managers do not appear as one of the common reasons for employee turnover.

    Top five most common reasons employees leave an organization (McLean & Company, Exit Survey, 2018-2021; N=107 to 141 companies,14,870 to 19,431 responses).

    Turnover factorsRank
    Opportunities for career advancement1
    Satisfaction with my role and responsibilities2
    Base pay3
    Opportunities for career-related skill development4
    The degree to which my skills were used in my job5

    However, managers can still have a huge impact on the turnover of their team through each of the three main paths to turnover:

    Employee engagement

    Employees who believe their managers care about them as a person are 3.3x more likely to be engaged than those who do not (McLean & Company, 2021; N=105,186).

    Turnover triggers

    Managers who are involved with and aware of their staff can serve as an early warning system for triggers that lead to turnover too quickly to detect with data.

    Moments that matter

    Managers have a direct connection with each individual and can tailor the employee experience to meet the needs of the individuals who report to them.

    Gallup has found that 52% of exiting employees say their manager could have done something to prevent them from leaving (Gallup, 2019). Do not discount the power of managers in anticipating and preventing regrettable turnover.

    Addressing engagement, turnover triggers, and moments that matter is the key to retention

    This is an image of a flow chart with four levels. The top level has only one box, labeled Turnover.  the Second level has 2 boxes, labeled Voluntary, and Involuntary.  The third level has two boxes under Voluntary, labeled Non-regrettable, and Regrettable.  The fourth level has three boxes under Regrettable, labeled Employee Engagement, Turnover triggers, and Moments that matter

    Info-Tech Insight

    HR traditionally seeks to examine engagement levels when faced with retention challenges, but engagement is only a part of the full picture. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

    Follow Info-Tech's two-step process to create a retention plan

    1. Identify Reasons for Regrettable Turnover

    2. Select Solutions and Create an Action Plan

    Step 1

    Identify Reasons for Regrettable Turnover

    After completing this step you will have:

    • Analyzed and documented why employees join, stay, and leave your organization.
    • Identified common themes and employee needs.
    • Conducted employee focus groups and prioritized employee needs.

    Step 1 focuses on analyzing existing data and validating it through focus groups

    Employee engagement

    Employee engagement and moments that matter are easily tracked by data. Validating employee feedback data by speaking and empathizing with employees helps to uncover moments that matter. This step focuses on analyzing existing data and validating it through focus groups.

    Engagement drivers such as compensation or working environment are strong predictors of turnover.
    Moments that matter
    Employee experience (EX) is the employee's perception of the accumulation of moments that matter with the organization.
    Turnover triggers
    Turnover triggers are events that act as shocks or catalysts that quickly lead to an employee's departure.

    Turnover triggers

    This step will not touch on turnover triggers. Instead, they will be discussed in step 2 in the context of the role of the manager in improving retention.

    Turnover triggers are events that act as shocks or catalysts that quickly lead to an employee's departure.

    Info-Tech Insight

    IT managers often have insights into where and why retention is an issue through their day-to-day work. Gathering detailed quantitative and qualitative data provides credibility to these insights and is key to building a business case for action. Keep an open mind and allow the data to inform your gut feeling, not the other way around.

    Gather data to better understand why employees join, stay, and leave

    Start to gather and examine additional data to accurately identify the reason(s) for high turnover. Begin to uncover the story behind why these employees join, stay, and leave your organization through themes and trends that emerge.

    Look for these icons throughout step 2.

    Join

    Why do candidates join your organization?

    Stay

    Why do employees stay with your organization?

    Leave

    Why do employees leave your organization?

    For more information on analysis, visualization, and storytelling with data, see Info-Tech's Start Making Data-Driven People Decisions blueprint.

    Employee feedback data to look at includes:

    Gather insights through:

    • Focus groups
    • Verbatim comments
    • Exit interviews
    • Using the employee value proposition (EVP) as a filter (does it resonate with the lived experience of employees?)

    Prepare to draw themes and trends from employee data throughout step 1.

    Uncover employee needs and reasons for turnover by analyzing employee feedback data.

    • Look for trends (e.g. new hires join for career opportunities and leave for the same reason, or most departments have strong work-life balance scores in engagement data).
    • Review if there are recurring issues being raised that may impact turnover.
    • Group feedback to highlight themes (e.g. lack of understanding of EVP).
    • Identify which key employee needs merit further investigation or information.

    This is an image showing how you can draw out themes and trends using employee data throughout step 1.

    Classify where key employee needs fall within the employee lifecycle diagram in tab 2 of the Retention Plan Workbook. This will be used in step 2 to pinpoint and prioritize solutions.

    Info-Tech Insight

    The employee lifecycle is a valuable way to analyze and organize engagement pain points, moments that matter, and turnover triggers. It ensures that you consider the entirety of an employee's tenure and the different factors that lead to turnover.

    Examine new hire data and begin to document emerging themes

    Join

    While conducting a high-level analysis of new hire data, look for these three key themes impacting retention:

    Issues or pain points that occurred during the hiring process.

    Reasons why employees joined your organization.

    The experience of their first 90 days. This can include their satisfaction with the onboarding process and their overall experience with the organization.

    Themes will help to identify areas of strength and weakness organization-wide and within key segments. Document in tab 3 of the Retention Plan Workbook.

    1. Start by isolating the top reasons employees joined your organization. Ask:
      • Do the reasons align with the benefits you associate with working at your organization?
      • How might this impact your EVP?
      • If you use a new hire survey, look at the results for the following questions:
      • For which of the following reasons did you apply to this organization?
      • For what reasons did you accept the job offer with this organization?
    2. then, examine other potential problem areas that may not be covered by your new hire survey, such as onboarding or the candidate experience during the hiring process.
      • If you conduct a new hire survey, look at the results in the following sections:
        • Candidate Experience
        • Acclimatization
        • Training and Development
        • Defining Performance Expectations

      Analyze engagement data to identify areas of strength that drive retention

      Employees who are engaged are 3.6x more likely to believe they will be with the organization 12 months from now (McLean & Company Engagement Survey, 2018-2021; N=117,307). Given the strength of this relationship, it is essential to identify areas of strength to maintain and leverage.

      1. Look at the highest-performing drivers in your organization's employee engagement survey and drivers that fall into the "leverage" and "maintain" quadrants of the priority matrix.
        • These drivers provide insight into what prompts broader groups of employees to stay.

      This is an image of a quadrant analysis, with the following quadrants in order from left to right, top to bottom.  Improve; Leverage; Evaluate; Maintain.

      1. Look into what efforts have been made to maintain programs, policies, and practices related to these drivers and ensure they are consistent across the entire organization.
      2. Document trends and themes related to engagement strengths in tab 2 of the Retention Plan Workbook.

      If you use Info-Tech's Engagement Survey, look in detail at what are classified as "Retention Drivers": total compensation, working environment, and work-life balance.

      Identify areas of weakness that drive turnover in your engagement data

      1. Look at the lowest-performing drivers in your organization's employee engagement survey and drivers that fall into the "improve" and "evaluate" quadrants of the priority matrix.
        • These drivers provide insight into what pushes employees to leave the organization.
      2. Delve into organizational efforts that have been made to address issues with the programs, policies, and practices related to these drivers. Are there any projects underway to improve them? What are the barriers preventing improvements?
      3. Document trends and themes related to engagement weaknesses in tab 2 of the Retention Plan Workbook.

      If you use a product other than Info-Tech's Engagement Survey, your results will look different. The key is to look at areas of weakness that emerge from the data.

      This is an image of a quadrant analysis, with the following quadrants in order from left to right, top to bottom.  Improve; Leverage; Evaluate; Maintain.

      If you use Info-Tech's Engagement Survey, look in detail at what are classified as "Retention Drivers": total compensation, working environment, and work-life balance.

      Mine exit surveys to develop an integrated, holistic understanding of why employees leave

      Conduct a high-level analysis of the data from your employee exit diagnostic. While analyzing this data, consider the following:

      • What are the trends and quantitative data about why employees leave your organization that may illuminate employee needs or issues at specific points throughout the employee lifecycle?
      • What are insights around your key segments? Data on key segments is easily sliced from exit survey results and can be used as a starting point for digging deeper into retention issues for specific groups.
      • Exit surveys are an excellent starting point. However, it is valuable to validate the data gathered from an exit survey using exit interviews.
      1. Isolate results for key segments of employees to target with retention initiatives (e.g. by age group or by department).
      2. Identify data trends or patterns over time; for example, that compensation factors have been increasing in importance.
      3. Document trends and themes taken from the exit survey results in tab 2 of the Retention Plan Workbook.

      If your organization conducts exit interviews, analyze the results alongside or in lieu of exit survey data.

      Compare new hire data with exit data to identify patterns and insights

      Determine if new hire expectations weren't met, prompting employees to leave your organization, to help identify where in the employee lifecycle issues driving turnover may be occurring.

      1. Look at your new hire data for the top reasons employees joined your organization.
        • McLean & Company's New Hire Survey database shows that the top three reasons candidates accept job offers on average are:
          1. Career opportunities
          2. Nature of the job
          3. Development opportunities
      2. Next, look at your exit data and the top reasons employees left your organization.
        1. McLean & Company's Exit Survey database shows that the top three reasons employees leave on average are:
          1. Opportunities for career advancement
          2. Base pay
          3. Satisfaction with my role and responsibilities
      3. Examine the results and ask:
        • Is there a link between why employees join and leave the organization?
        • Did they cite the same reasons for joining and for leaving?
        • What do the results say about what your employees do and do not value about working at your organization?
      4. Document the resulting insights in tab 2 of the Retention Plan Workbook.

      Example:

      A result where employees are leaving for the same reason they're joining the organization could signal a disconnect between your organization's employee value proposition and the lived experience.

      Revisit your employee value proposition to uncover misalignment

      Your employee value proposition (EVP), formal or informal, communicates the value your organization can offer to prospective employees.

      If your EVP is mismatched with the lived experience of your employees, new hires will be in for a surprise when they start their new job and find out it isn't what they were expecting.

      Forty-six percent of respondents who left a job within 90 days of starting cited a mismatch of expectations about their role ("Job Seeker Nation Study 2020," Jobvite, 2020).

      1. Use the EVP as a filter through which you look at all your employee feedback data. It will help identify misalignment between the promised and the lived experience.
      2. If you have EVP documentation, start there. If not, go to your careers page and put yourself in the shoes of a candidate. Ask what the four elements of an EVP look like for candidates:
        • Compensation and benefits
        • Day-to-day job elements
        • Working conditions
        • Organizational elements
      3. Next, compare this to your own day-to-day experiences. Does it differ drastically? Are there any contradictions with the lived experience at your organization? Are there misleading statements or promises?
      4. Document any insights or patterns you uncover in tab 2 of the Retention Plan Workbook.

      Conduct focus groups to examine themes

      Through focus groups, explore the themes you have uncovered with employees to discover employee needs that are not being met. Addressing these employee needs will be a key aspect of your retention plan.

      Identify employee groups who will participate in focus groups:

      • Incorporate diverse perspectives (e.g. employees, managers, supervisors).
      • Include employees from departments and demographics with strong and weak engagement for a full picture of how engagement impacts your employees.
      • Invite boomerang employees to learn why an individual might return to your organization after leaving.

      image contains two screenshots Mclean & Company's Standard Focus Group Guide.

      Customize Info-Tech's Standard Focus Group Guide based on the themes you have identified in tab 3 of the Retention Plan Workbook.

      The goal of the focus group is to learn from employees and use this information to design or modify a process, system, or other solution that impacts retention.

      Focus questions on the employees' personal experience from their perspective.

      Key things to remember:

      • It is vital for facilitators to be objective.
      • Keep an open mind; no feelings are wrong.
      • Beware of your own biases.
      • Be open and share the reason for conducting the focus groups.

      Info-Tech Insight

      Maintaining an open dialogue with employees will help flesh out the context behind the data you've gathered and allow you to keep in mind that retention is about people first and foremost.

      Empathize with employees to identify moments that matter

      Look for discrepancies between what employees are saying and doing.

      1. Say

      "What words or quotes did the employee use?"

      3.Think

      "What might the employee be thinking?"

      Record feelings and thoughts discussed, body language observed, tone of voice, and words used.

      Look for areas of negative emotion to determine the moments that matter that drive retention.

      2. Do

      "What actions or behavior did the employee demonstrate?"

      4. Feel

      "What might the employee be feeling?"

      Record them in tab 3 of the Retention Plan Workbook.

      5. Identify Needs

      "Needs are verbs (activities or desires), not nouns (solutions)"

      Synthesize focus group findings using Info-Tech's Empathy Map Template.

      6. Identify Insights

      "Ask yourself, why?"

      (Based on Stanford d.school Empathy Map Method)

      Distill employee needs into priority issues to address first

      Take employee needs revealed by your data and focus groups and prioritize three to five needs.

      Select a limited number of employee needs to develop solutions to ensure that the scope of the project is feasible and that the resources dedicated to this project are not stretched too thin. The remaining needs should not be ignored – act on them later.

      Share the needs you identify with stakeholders so they can support prioritization and so you can confirm their buy-in and approval where necessary.

      Ask yourself the following questions to determine your priority employee needs:

      • Which needs will have the greatest impact on turnover?
      • Which needs have the potential to be an easy fix or quick win?
      • Which themes or trends came up repeatedly in different data sources?
      • Which needs evoked particularly strong or negative emotions in the focus groups?

      This image contains screenshots of two table templates found in tab 5 of the Retention Plan Workbook

      In the Retention Plan Workbook, distill employee needs on tab 2 into three to five priorities on tab 5.

      Step 2

      Select Solutions and Create an Action Plan

      After completing this step, you will have:

      • Selected and prioritized solutions to address employee needs.
      • Created a plan to launch stay interviews.
      • Built an action plan to implement solutions.

      Select IT-owned solutions and implement people leader–driven initiatives

      Solutions

      First, select and prioritize solutions to address employee needs identified in the previous step. These solutions will address reasons for turnover that influence employee engagement and moments that matter.

      • Brainstorm solutions using the Retention Solutions Catalog as a starting point. Select a longlist of solutions to address your priority needs.
      • Prioritize the longlist of solutions into a manageable number to act on.

      People leaders

      Next, create a plan to launch stay interviews to increase managers' accountability in improving retention. Managers will be critical to solving issues stemming from turnover triggers.

      • Clarify the importance of harnessing the influence of people leaders in improving retention.
      • Discover what might cause individual employees to leave through stay interviews.
      • Increase trust in managers through training.

      Action plan

      Finally, create an action plan and present to senior leadership for approval.

      Look for these icons in the top right of slides in this step.

      Select solutions to employee needs, starting with the Retention Solutions Catalog

      Based on the priority needs you have identified, use the Retention Solutions Catalog to review best-practice solutions for pain points associated with each stage of the lifecycle.

      Use this tool as a starting point, adding to it and iterating based on your own experience and organizational culture and goals.

      This image contains three screenshots from Info-Tech's Retention Solutions Catalog.

      Use Info-Tech's Retention Solutions Catalog to start the brainstorming process and produce a shortlist of potential solutions that will be prioritized on the next slide.

      Info-Tech Insight

      Unless you have the good fortune of having only a few pain points, no single initiative will completely solve your retention issues. Combine one or two of these broad solutions with people-leader initiatives to ensure employee needs are addressed on an individual and an aggregate level.

      Prioritize solutions to be implemented

      Target efforts accordingly

      Quick wins are high-impact, low-effort initiatives that will build traction and credibility within the organization.

      Long-term initiatives require more time and need to be planned for accordingly but will still deliver a large impact. Review the planning horizon to determine how early these need to begin.

      Re-evaluate low-impact and low-effort initiatives and identify ones that either support other higher impact initiatives or have the highest impact to gain traction and credibility. Look for low-hanging fruit.

      Deprioritize initiatives that will take a high degree of effort to deliver lower-value results.

      When assessing the impact of potential solutions, consider:

      • How many critical segments or employees will this solution affect?
      • Is the employee need it addresses critical, or did the solution encompass several themes in the data you analyzed?
      • Will the success of this solution help build a case for further action?
      • Will the solution address multiple employee needs?

      Info-Tech Insight

      It's better to master a few initiatives than under-deliver on many. Start with a few solutions that will have a measurable impact to build the case for further action in the future.

      Solutions

      Low ImpactMedium ImpactLarge Impact
      Large EffortThis is an image of the used to help you prioritize solutions to be implemented.
      Medium Effort
      Low Effort

      Use tab 3 of the Retention Plan Workbook to prioritize your shortlist of solutions.

      Harness the influence of people leaders to improve employee retention

      Leaders at all levels have a huge impact on employees.

      Effective people leaders:

      • Manage work distribution.
      • Create a motivating work environment.
      • Provide development opportunities.
      • Ensure work is stimulating and challenging, but not overwhelming.
      • Provide clear, actionable feedback.
      • Recognize team member contributions.
      • Develop positive relationships with their teams.
      • Create a line of sight between what the employee is doing and what the organization's objectives are.

      Support leaders in recommitting to their role as people managers through Learning & Development initiatives with particular emphasis on coaching and building trust.

      For coaching training, see Info-Tech's Build a Better Manager: Team Essentials – Feedback and Coaching training deck.

      For more information on supporting managers to become better people leaders, see Info-Tech's Build a Better Manager: Manage Your People blueprint.

      "HR can't fix turnover. But leaders on the front line can."
      – Richard P. Finnegan, CEO, C-Suite Analytics

      Equip managers to conduct regular stay interviews to address turnover triggers

      Managers often have the most visibility into their employees' personal and work lives and have a key opportunity to anticipate and address turnover triggers.

      Stay interviews are an effective way of uncovering potential retention issues and allowing managers to act as an early warning system for turnover triggers.

      Examples of common turnover triggers and potential manager responses:

      • Moving, creating a long commute to the office.
        • Through stay interviews, a manager can learn that a long commute is an issue and can help find workarounds such as flexible/remote work options.
      • Not receiving an expected promotion.
        • A trusted manager can anticipate issues stemming from this, discuss why the decision was made, and plan development opportunities for future openings.

      Stay interview best practices

      1. Conducted by an employee's direct manager.
      2. Happen regularly as a part of an ongoing process.
      3. Based on the stay interview, managers produce a turnover forecast for each direct report.
        1. The method used by stay interview expert Richard P. Finnegan is simple: red for high risk, yellow for medium, and green for low.
      4. Provide managers with training and a rough script or list of questions to follow.
        1. Use and customize Info-Tech's Stay Interview Guide to provide a guide for managers on how to conduct a stay interview.
      5. Managers use the results to create an individualized retention action plan made up of concrete actions the manager and employee will take.

      Sources: Richard P. Finnegan, CEO, C-Suite Analytics; SHRM

      Build an action plan to implement the retention plan

      For each initiative identified, map out timelines and actions that need to be taken.

      When building actions and timelines:

      • Refer to the priority needs you identified in tab 4 of the Retention Plan Workbook and ensure they are addressed first.
      • Engage internal stakeholders who will be key to the development of the initiatives to ensure they have sufficient time to complete their deliverables.
        • For example, if you conduct manager training, Learning & Development needs to be involved in the development and launch of the program.
      • Include a date to revisit your baseline retention and engagement data in your project milestones.
      • Designate process owners for new processes such as stay interviews.

      Plan for stay interviews by determining:

      • Whether stay interviews will be a requirement for all employees.
      • How much flexibility managers will have with the process.
      • How you will communicate the stay interview approach to managers.
      • If manager training is required.
      • How managers should record stay interview data and how you will collect this data from them as a way to monitor retention issues.
        • For example, managers can share their turnover forecasts and action plans for each employee.

      Be clear about manager accountabilities for initiatives they will own, such as stay interviews. Plan to communicate the goals and timelines managers will be asked to meet, such as when they must conduct interviews or their responsibility to follow up on action items that come from interviews.

      Track project success to iterate and improve your solutions

      Analyze measurements

      • Regularly remeasure your engagement and retention levels to identify themes and trends that provide insights into program improvements.
      • For example, look at the difference in manager relationship score to see if training has had an impact, or look at changes in critical segment turnover to calculate cost savings.

      Revisit employee and manager feedback

      • After three to six months, conduct additional surveys or focus groups to determine the success of your initiatives and opportunities for improvement. Tweak the program, including stay interviews, based on manager and employee feedback.

      Iterate frequently

      • Revisit your initiatives every two or three years to determine if a refresh is necessary to meet changing organizational and employee needs and to update your goals and targets.

      Key insights

      Insight 1Insight 2Insight 3

      Retention and turnover are two sides of the same coin. You can't fix retention without first understanding turnover.

      Engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

      Improving retention isn't just about lowering turnover, it's about discovering what healthy retention looks like for your organization.

      Insight 4Insight 5Insight 6

      HR professionals often have insights into where and why retention is an issue. Gathering detailed employee feedback data through surveys and focus groups provides credibility to these insights and is key to building a case for action. Keep an open mind and allow the data to inform your gut feeling, not the other way around.

      Successful retention plans must be owned by both IT leaders and HR.

      IT leaders often have the most visibility into their employees' personal and work lives and have a key opportunity to anticipate and address turnover triggers.

      Stay interviews help managers anticipate potential retention issues on their teams.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Info-Tech AnalystsPre-workPost-work
      Client Data Gathering and PlanningImplementation Supported Through Analyst Calls

      1.1 Discuss participants, logistics, overview of workshop activities

      1.2 Provide support to client for below activities through calls.

      2.1 Schedule follow-up calls to work through implementation of retention solutions based on identified needs.
      Client

      1.Gather results of engagement survey, new hire survey, exit survey, and any exit and stay interview feedback.

      2.Gather and analyze turnover data.

      3.Identify key employee segment(s) and identify and organize participants for focus groups.

      4.Complete cost of turnover analysis.

      5.Review turnover data and prioritize list of employee segments.

      1.Obtain senior leader approval to proceed with retention plan.

      2.Finalize and implement retention solutions.

      3.Prepare managers to conduct stay interviews.

      4.Communicate next steps to stakeholders.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      ActivitiesDay 1Day 2Day 3Day 4
      Assess Current StateConduct Focus GroupsIdentify Needs and Retention InitiativesPrepare to Communicate and Launch

      1.1 Review data to determine why employees join, stay, and leave.

      1.2 Identify common themes.

      1.3 Prepare for focus groups.

      2.1 Conduct four 1-hour focus groups with the employee segment(s) identified in the pre-workshop activities..

      2.2 Info-Tech facilitators independently analyze results of focus groups and group results by theme.

      3.1 Create an empathy map to identify needs

      3.2 Shortlist retention initiatives

      4.1 Select retention initiatives

      4.2 Determine goals and metrics

      4.3 Plan stakeholder communication4.4 Build a high-level action plan

      Deliverables

      1.List of common themes/pain points recorded in the Retention Plan Workbook

      2.Plan for focus groups documented in the Focus Group Guide

      1.Focus group feedback

      2.Focus group feedback analyzed and organized by themes

      1.Employee needs and shortlist of initiatives to address them1.Finalized list of retention initiatives

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Research Contributors and Experts

      Jeff Bonnell
      VP HR
      Info-Tech Research Group

      Phillip Kotanidis
      CHRO
      Michael Garron Hospital

      Michael McGuire
      Director, Organizational Development
      William Osler Health System

      Dr. Iris Ware
      Chief Learning Officer
      City of Detroit

      Richard P. Finnegan
      CEO
      C-Suite Analytics

      Dr. Thomas Lee
      Professor of Management
      University of Washington

      Jane Moughon
      Specialist in increasing profits, reducing turnover, and maximizing human potential in manufacturing companies

      Lisa Kaste
      Former HR Director
      Citco

      Piyush Mathur
      Head of Workforce Analytics
      Johnson & Johnson

      Gregory P. Smith
      CEO
      Chart Your Course

      Works Cited

      "17 Surprising Statistics about Employee Retention." TINYpulse, 8 Sept. 2020. Web.
      "2020 Job Seeker Nation Study." Jobvite, April 2020. Web.
      "2020 Recruiter Nation Survey." Jobvite, 2020. Web.
      "2020 Retention Report: Insights on 2019 Turnover Trends, Reasons, Costs, & Recommendations." Work Institute, 2020. Web.
      "25 Essential Productivity Statistics for 2021." TeamStage, 2021. Accessed 22 Jun. 2021.
      Agovino, Theresa. "To Have and to Hold." SHRM, 23 Feb. 2019. Web.
      "Civilian Unemployment Rate." Bureau of Labor Statistics, June 2020. Web.
      Foreman, Paul. "The domino effect of chief sales officer turnover on salespeople." Mereo, 19 July 2018. Web.
      "Gross Domestic Product." U.S. Bureau of Economic Analysis, 27 May 2021. Accessed 22 Jun. 2020.
      Kinne, Aaron. "Back to Basics: What is Employee Experience?" Workhuman, 27August 2020. Accessed 21 Jun. 2021.
      Lee, Thomas W, et al. "Managing employee retention and turnover with 21st century ideas." Organizational Dynamics, vol 47, no. 2, 2017, pp. 88-98. Web.
      Lee, Thomas W. and Terence R. Mitchell. "Control Turnover by Understanding its Causes." The Blackwell Handbook of Principles of Organizational Behaviour. 2017. Print.
      McFeely, Shane, and Ben Wigert. "This Fixable Problem Costs U.S. Businesses $1 Trillion." Gallup. 13 March 2019. Web.
      "Table 18. Annual Quit rates by Industry and Region Not Seasonally Adjusted." Bureau of Labor Statistics. June 2021. Web.
      "The 2019 Compensation Best Practices Report: Will They Stay or Will They Go? Employee Retention and Acquisition in an Uncertain Economy." PayScale. 2019. Web.
      Vuleta, Branka. "30 Troubling Employee Retention Statistics." Legaljobs. 1 Feb. 2021. Web.
      "What is a Tenured Employee? Top Benefits of Tenure and How to Stay Engaged as One." Indeed. 22 Feb. 2021. Accessed 22 Jun. 2021.

      Build a Security Compliance Program

      • Buy Link or Shortcode: {j2store}257|cart{/j2store}
      • member rating overall impact: 9.6/10 Overall Impact
      • member rating average dollars saved: $23,879 Average $ Saved
      • member rating average days saved: 15 Average Days Saved
      • Parent Category Name: Governance, Risk & Compliance
      • Parent Category Link: /governance-risk-compliance
      • Most organizations spend between 25 and 40 percent of their security budget on compliance-related activities.
      • Despite this growing investment in compliance, only 28% of organizations believe that government regulations help them improve cybersecurity.
      • The cost of complying with cybersecurity and data protection requirements has risen to the point where 58% of companies see compliance costs as barriers to entering new markets.
      • However, recent reports suggest that while the costs of complying are higher, the costs of non-compliance are almost three times greater.

      Our Advice

      Critical Insight

      • Test once, attest many. Having a control framework allows you to satisfy multiple compliance requirements by testing a single control.
      • Choose your own conformance adventure. Conformance levels allow your organization to make informed business decisions on how compliance resources will be allocated.
      • Put the horse before the cart. Take charge of your audit costs by preparing test scripts and evidence repositories in advance.

      Impact and Result

      • Reduce complexity within the control environment by using a single framework to align multiple compliance regimes.
      • Provide senior management with a structured framework for making business decisions on allocating costs and efforts related to cybersecurity and data protection compliance obligations.
      • Reduces costs and efforts related to managing IT audits through planning and preparation.
      • This blueprint can help you comply with NIST, ISO, CMMC, SOC2, PCI, CIS, and other cybersecurity and data protection requirements.

      Build a Security Compliance Program Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should manage your security compliance obligations, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      Infographic

      Workshop: Build a Security Compliance Program

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish the Program

      The Purpose

      Establish the security compliance management program.

      Key Benefits Achieved

      Reviewing and adopting an information security control framework.

      Understanding and establishing roles and responsibilities for security compliance management.

      Identifying and scoping operational environments for applicable compliance obligations.

      Activities

      1.1 Review the business context.

      1.2 Review the Info-Tech security control framework.

      1.3 Establish roles and responsibilities.

      1.4 Define operational environments.

      Outputs

      RACI matrix

      Environments list and definitions

      2 Identify Obligations

      The Purpose

      Identify security and data protection compliance obligations.

      Key Benefits Achieved

      Identifying the security compliance obligations that apply to your organization.

      Documenting obligations and obtaining direction from management on conformance levels.

      Mapping compliance obligation requirements into your control framework.

      Activities

      2.1 Identify relevant security and data protection compliance obligations.

      2.2 Develop conformance level recommendations.

      2.3 Map compliance obligations into control framework.

      2.4 Develop process for operationalizing identification activities.

      Outputs

      List of compliance obligations

      Completed Conformance Level Approval forms

      (Optional) Mapped compliance obligation

      (Optional) Identification process diagram

      3 Implement Compliance Strategy

      The Purpose

      Understand how to build a compliance strategy.

      Key Benefits Achieved

      Updating security policies and other control design documents to reflect required controls.

      Aligning your compliance obligations with your information security strategy.

      Activities

      3.1 Review state of information security policies.

      3.2 Recommend updates to policies to address control requirements.

      3.3 Review information security strategy.

      3.4 Identify alignment points between compliance obligations and information security strategy.

      3.5 Develop compliance exception process and forms.

      Outputs

      Recommendations and plan for updates to information security policies

      Compliance exception forms

      4 Track and Report

      The Purpose

      Track the status of your compliance program.

      Key Benefits Achieved

      Tracking the status of your compliance obligations.

      Managing exceptions to compliance requirements.

      Reporting on the compliance management program to senior stakeholders.

      Activities

      4.1 Define process and forms for self-attestation.

      4.2 Develop audit test scripts for selected controls.

      4.3 Review process and entity control types.

      4.4 Develop self-assessment process.

      4.5 Integrate compliance management with risk register.

      4.6 Develop metrics and reporting process.

      Outputs

      Self-attestation forms

      Completed test scripts for selected controls

      Self-assessment process

      Reporting process

      Recommended metrics

      Understand Common IT Contract Provisions to Negotiate More Effectively

      • Buy Link or Shortcode: {j2store}234|cart{/j2store}
      • member rating overall impact: 9.5/10 Overall Impact
      • member rating average dollars saved: $31,716 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: Vendor Management
      • Parent Category Link: /vendor-management
      • Contract reviews are tedious, and reviewers may lack the skills and experience to effectively complete the process.
      • Vendors have a repository of contract terms and conditions that are road-tested and often biased in their favor.
      • Vendors change their contracts frequently through hyperlinked documents without notifying customers, and the onus is on you to stay compliant.

      Our Advice

      Critical Insight

      • Focus on the terms and conditions, not just the price. Too often, organizations focus on the price contained within their contracts, neglecting to address core terms and conditions that can end up costing multiples of the initial price.
      • Lawyers can’t ensure you get the best business deal. Lawyers tend to look at general terms and conditions for legal risk and may not understand IT-specific components and business needs.

      Impact and Result

      • Align contract language to meet IT and business needs.
      • Communicate more effectively with Legal and the vendors.
      • Identify and reduce contractual and performance risk.
      • Understand the relationship between contract provisions.
      • Negotiate more effectively.

      Understand Common IT Contract Provisions to Negotiate More Effectively Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should employ a systematic process for reviewing contracts, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Assess contract terms and conditions

      Review and assess your IT contracts for vendor-biased terms and conditions, and gain tips for getting vendors to take on their fair share of risk and become more accountable.

      • Contract Review Tool
      • Contract Playbook
      [infographic]

      Workshop: Understand Common IT Contract Provisions to Negotiate More Effectively

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Assess Contract Terms and Conditions

      The Purpose

      Understand IT contract clauses, improve risk identification, and be more effective at negotiating contract terms.

      Key Benefits Achieved

      Increased awareness of how contract provisions relate to each other.

      Demystification of legalese and legal concepts.

      Increased ability to seek assistance from internal parties (e.g. Legal, Risk, and Procurement).

      Activities

      1.1 Review the Contract Review Tool.

      1.2 Review the Contract Playbook template.

      1.3 Review 35 contract provisions and reinforce key learnings with exercises (spread across three days)

      Outputs

      Partial completion of the template

      Exercise results and debrief

      Implement Risk-Based Vulnerability Management

      • Buy Link or Shortcode: {j2store}296|cart{/j2store}
      • member rating overall impact: 9.2/10 Overall Impact
      • member rating average dollars saved: $122,947 Average $ Saved
      • member rating average days saved: 34 Average Days Saved
      • Parent Category Name: Threat Intelligence & Incident Response
      • Parent Category Link: /threat-intelligence-incident-response
      • Vulnerability scanners, industry alerts, and penetration tests are revealing more and more vulnerabilities, and it is unclear how to manage them.
      • Organizations are struggling to prioritize the vulnerabilities for remediation, as there are many factors to consider, including the threat of the vulnerability and the potential remediation option itself.

      Our Advice

      Critical Insight

      • Patches are often considered the only answer to vulnerabilities, but these are not always the most suitable solution.
      • Vulnerability management does not equal patch management. It includes identifying and assessing the risk of the vulnerability, and then selecting a remediation option which goes beyond just patching alone.
      • There is more than one way to tackle the problem. Leverage your existing security controls to protect the organization.

      Impact and Result

      • After this blueprint, you will have created a full vulnerability management program that allows you to take a risk-based approach to vulnerability remediation.
      • Assessing a vulnerability’s risk will enable you to properly determine the true urgency of a vulnerability within the context of your organization; this ensures you are not just blindly following what the tool is reporting.
      • The risk-based approach allows you to prioritize your discovered vulnerabilities and take immediate action on critical and high vulnerabilities, while allowing your standard remediation cycle to address the medium to low vulnerabilities.
      • With your program defined and developed, you now need to configure your vulnerability scanning tool, or acquire one if you don’t already have a tool in place.
      • Lastly, while vulnerability management will help address your systems and applications, how do you know if you are secure from external malicious actors? Penetration testing will offer visibility, allowing you to plug those holes and attain an environment with a smaller risk surface.

      Implement Risk-Based Vulnerability Management Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should design and implement a vulnerability management program, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Implement Risk-Based Vulnerability Management – Phases 1-4

      1. Identify vulnerability sources

      Begin the project by creating a vulnerability management team and determine how vulnerabilities will be identified through scanners, penetration tests, third-party sources, and incidents.

      • Vulnerability Management SOP Template

      2. Triage vulnerabilities and assign priorities

      Determine how vulnerabilities will be triaged and evaluated based on intrinsic qualities and how they may compromise business functions and data sensitivity.

      • Vulnerability Tracking Tool
      • Vulnerability Management Risk Assessment Tool
      • Vulnerability Management Workflow (Visio)
      • Vulnerability Management Workflow (PDF)

      3. Remediate vulnerabilities

      Address the vulnerabilities based on their level of risk. Patching isn't the only risk mitigation action; some systems simply cannot be patched, but other options are available. Reduce the risk down to medium/low levels and engage your regular operational processes to deal with the latter.

       

      4. Measure and formalize

      Evolve the program continually by developing metrics and formalizing a policy.

      • Vulnerability Management Policy Template
      • Vulnerability Scanning Tool RFP Template
      • Penetration Test RFP Template

      Infographic

      Workshop: Implement Risk-Based Vulnerability Management

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify Vulnerability Sources

      The Purpose

      Establish a common understanding of vulnerability management, and define the roles, scope, and information sources of vulnerability detection.

      Key Benefits Achieved

      Attain visibility on all of the vulnerability information sources, and a common understanding of vulnerability management and its scope.

      Activities

      1.1 Define the scope & boundary of your organization’s security program.

      1.2 Assign responsibility for vulnerability identification and remediation.

      1.3 Develop a monitoring and review process of third-party vulnerability sources.

      1.4 Review incident management and vulnerability management

      Outputs

      Defined scope and boundaries of the IT security program

      Roles and responsibilities defined for member groups

      Process for review of third-party vulnerability sources

      Alignment of vulnerability management program with existing incident management processes

      2 Triage and Prioritize

      The Purpose

      We will examine the elements that you will use to triage and analyze vulnerabilities, prioritizing using a risk-based approach and prepare for remediation options.

      Key Benefits Achieved

      A consistent, documented process for the evaluation of vulnerabilities in your environment.

      Activities

      2.1 Evaluate your identified vulnerabilities.

      2.2 Determine high-level business criticality.

      2.3 Determine your high-level data classifications.

      2.4 Document your defense-in-depth controls.

      2.5 Build a classification scheme to consistently assess impact.

      2.6 Build a classification scheme to consistently assess likelihood.

      Outputs

      Adjusted workflow to reflect your current processes

      List of business operations and their criticality and impact to the business

      Adjusted workflow to reflect your current processes

      List of defense-in-depth controls

      Vulnerability Management Risk Assessment tool formatted to your organization

      Vulnerability Management Risk Assessment tool formatted to your organization

      3 Remediate Vulnerabilities

      The Purpose

      Identifying potential remediation options.

      Developing criteria for each option in regard to when to use and when to avoid.

      Establishing exception procedure for testing and remediation.

      Documenting the implementation of remediation and verification.

      Key Benefits Achieved

      Identifying and selecting the remediation option to be used

      Determining what to do when a patch or update is not available

      Scheduling and executing the remediation activity

      Planning continuous improvement

      Activities

      3.1 Develop risk and remediation action.

      Outputs

      List of remediation options sorted into “when to use” and “when to avoid” lists

      4 Measure and Formalize

      The Purpose

      You will determine what ought to be measured to track the success of your vulnerability management program.

      If you lack a scanning tool this phase will help you determine tool selection.

      Lastly, penetration testing is a good next step to consider once you have your vulnerability management program well underway.

      Key Benefits Achieved

      Outline of metrics that you can then configure your vulnerability scanning tool to report on.

      Development of an inaugural policy covering vulnerability management.

      The provisions needed for you to create and deploy an RFP for a vulnerability management tool.

      An understanding of penetration testing, and guidance on how to get started if there is interest to do so.

      Activities

      4.1 Measure your program with metrics, KPIs, and CSFs.

      4.2 Update the vulnerability management policy.

      4.3 Create an RFP for vulnerability scanning tools.

      4.4 Create an RFP for penetration tests.

      Outputs

      List of relevant metrics to track, and the KPIs, CSFs, and business goals for.

      Completed Vulnerability Management Policy

      Completed Request for Proposal (RFP) document that can be distributed to vendor proponents

      Completed Request for Proposal (RFP) document that can be distributed to vendor proponents

      Further reading

      Implement Risk-Based Vulnerability Management

      Get off the patching merry-go-round and start mitigating risk!

      Table of Contents

      4 Analyst Perspective

      5 Executive Summary

      6 Common Obstacles

      8 Risk-based approach to vulnerability management

      16 Step 1.1: Vulnerability management defined

      24 Step 1.2: Defining scope and roles

      34 Step 1.3: Cloud considerations for vulnerability management

      33 Step 1.4: Vulnerability detection

      46 Step 2.1: Triage vulnerabilities

      51 Step 2.2: Determine high-level business criticality

      56 Step 2.3: Consider current security posture

      61 Step 2.4: Risk assessment of vulnerabilities

      71 Step 3.1: Assessing remediation options

      Table of Contents

      80 Step 3.2: Scheduling and executing remediation

      85 Step 3.3: Continuous improvement

      89 Step 4.1: Metrics, KPIs, and CSFs

      94 Step 4.2: Vulnerability management policy

      97 Step 4.3: Select & implement a scanning tool

      107 Step 4.4: Penetration testing

      118 Summary of accomplishment

      119 Additional Support

      120 Bibliography

      Analyst Perspective

      Vulnerabilities will always be present. Know the unknowns!

      In this age of discovery, technology changes at such a rapid pace. New things are discovered, both in new technology and in old. The pace of change can often be very confusing as to where to start and what to do.

      The ever-changing nature of technology means that vulnerabilities will always be present. Taking measures to address these completely will consume all your department’s time and resources. That, and your efforts will quickly become stale as new vulnerabilities are uncovered. Besides, what about the systems that simply can’t be patched? The key is to understand the vulnerabilities and the levels of risk they pose to your organization, to prioritize effectively and to look beyond patching.

      A risk-based approach to vulnerability management will ensure you are prioritizing appropriately and protecting the business. Reduce the risk surface!

      Vulnerability management is more than just systems and application patching. It is a full process that includes patching, compensating controls, segmentation, segregation, and heightened diligence in security monitoring.

      Jimmy Tom, Research Advisor – Security, Privacy, Risk, and Compliance, Info-Tech Research Group. Jimmy Tom
      Research Advisor – Security, Privacy, Risk, and Compliance
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Vulnerability scanners, industry alerts, and penetration tests are revealing more and more vulnerabilities, and it is unclear how to manage them.

      Organizations are struggling to prioritize the vulnerabilities for remediation, as there are many factors to consider, including the threat of the vulnerability and the potential remediation option.

      Common Obstacles

      Patches are often seen as the answer to vulnerabilities, but these are not always the most suitable solution.

      Some systems deemed vulnerable simply cannot be patched or easily replaced.

      Companies are unaware of the risk implications that come from leaving the vulnerability open and from the remediation option itself.

      Info-Tech’s Approach

      Design and implement a vulnerability management program that identifies, prioritizes, and remediates vulnerabilities.

      Understand what needs to be considered when implementing remediation options, including patches, configuration changes, and defense-in-depth controls.

      Build a process that is easy to understand and allows vulnerabilities to be remediated proactively, instead of in an ad hoc fashion.

      Info-Tech Insight

      Vulnerability management does not always equal patch management. There is more than one way to tackle the problem, particularly if a system cannot be easily patched or replaced. If a vulnerability cannot be completely remediated, steps to reduce the risk to a tolerable level must be taken.

      Common obstacles

      These barriers make vulnerability management difficult to address for many organizations:
      • The value of vulnerability management is not well articulated in many organizations. As a result, investment in vulnerability scanning technology is often insufficient.
      • Many organizations feel that a “patch everything” approach is the most effective path.
      • Vulnerability management is commonly misunderstood as being a process that only supports patch management.
      • There is often misalignment between SecOps and ITOps in remediation action and priority, affecting the timeliness of remediation.
      CVSS Score Distribution From the National Vulnerability Database: Pie Charts presenting the CVSS Core Distribution for the National Vulnerability Database. The left circle represents 'V3' and the right 'V2', where V3 has an extra option for 'Critical', above 'High', 'Medium', and 'Low', and V2 does not.
      (Source: NIST National Vulnerability Database Dashboard)

      Leverage risk to sort, triage, and prioritize vulnerabilities

      Reduce your risk surface to avoid cost to your business; everything else is table stakes.

      Reduce the critical and high vulnerabilities below the risk threshold and operationalize the remediation of medium/low vulnerabilities by following your effective vulnerability management program cycles.

      Identify vulnerability sources

      An inventory of your scanning tool and vulnerability threat intelligence data sources will help you determine a viable strategy for addressing vulnerabilities. Defining roles and responsibilities ahead of time will ensure you are not left scrambling when dealing with vulnerabilities.

      Triage and prioritize

      Bring the vulnerabilities into context by assessing vulnerabilities based on your security posture and mechanisms and not just what your data sources report. This will allow you to gauge the true urgency of the vulnerabilities based on risk and determine an effective mitigation plan.

      Remediate vulnerabilities

      Address the vulnerabilities based on their level of risk. Patching isn't the only risk mitigation action; some systems simply cannot be patched, but other options are available.

      Reduce the risk down to medium/low levels and engage your regular operational processes to deal with the latter.

      Measure and formalize

      Upon implementation of the program, measure with metrics to ensure that the program is successful. Improve the program with each iteration of vulnerability mitigation to ensure continuous improvement.

      Tactical Insight 1

      All actions to address vulnerabilities should be based on risk and the organization’s established risk tolerance.

      Tactical Insight 2

      Reduce the risk surface down below the risk threshold.

      The industry has shifted to a risk-based approach

      Traditional vulnerability management is no longer viable.

      “For those of us in the vulnerability management space, ensuring that money, resources, and time are strategically spent is both imperative and difficult. Resources are dwindling fast, but the vulnerability problem sure isn’t.” (Kenna Security)

      “Using vulnerability scanners to identify unpatched software is no longer enough. Keeping devices, networks, and digital assets safe takes a much broader, risk-based vulnerability management strategy – one that includes vulnerability assessment and mitigation actions that touch the entire ecosystem.” (Balbix)

      “Unlike legacy vulnerability management, risk-based vulnerability management goes beyond just discovering vulnerabilities. It helps you understand vulnerability risks with threat context and insight into potential business impact.” (Tenable)

      “A common mistake when prioritizing patching is equating a vulnerability’s Common Vulnerability Scoring System (CVSS) score with risk. Although CVSS scores can provide useful insight into the anatomy of a vulnerability and how it might behave if weaponized, they are standardized and thus don’t reflect either of the highly situational variables — namely, weaponization likelihood and potential impact — that factor into the risk the vulnerability poses to an organization.” (SecurityWeek)

      Why a take risk-based approach?

      Vulnerabilities, by the numbers

      60% — In 2019, 60% of breaches were due to unpatched vulnerabilities.

      74% — In the same survey, 74% of survey responses said they cannot take down critical applications and systems to patch them quickly. (Source: SecurityBoulevard, 2019)

      Info-Tech Insight

      Taking a risk-based approach will allow you to focus on mitigating risk, rather than “just patching” your environment.

      The average cost of a breach in 2020 is $3.86 million, and “…the price tag was much less for mature companies and industries and far higher for firms that had lackluster security automation and incident response processes.” (Dark Reading)

      Vulnerability Management

      A risk-based approach

      Reduce the risk surface to avoid cost to your business, everything else is table stakes

      Logo for Info-Tech.
      Logo for #iTRG.

      1

      Identify

      4

      Address

        Mitigate the risk surface by reducing the time across the phases › Mitigate the risk by implementing:
      • patch systems & apps
      • compensating controls
      • systems and apps hardening
      • systems segregation
      Chart presenting an example of 'Risk Surface' with the axes 'Risk Level' and 'Time' with lines created by individual risks. The highlighted line begins in 'Critical' and eventually drops to low. The area between the line and your organization's risk tolerance is labelled 'Risk Surface'.

      Objective: reduce risk surface by reducing time to address

      Your organization's risk tolerance threshold

        Identify vulnerability management scanning tools & external threat intel sources (Mitre CVE, US-CERT, vendor alerts, etc.) Vulnerability information feeds:
      • scanning tool
      • external threat intel
      • internal threat intel

      2

      Analyze

        Assign actual risk (impact x urgency) to the organization based on current security posture

      Triage based on risk ›

      Your organization's risk tolerance threshold

      Risk tolerance threshold map with axes 'Impact' and 'Likelihood'. High levels of one and low levels of the other, or medium levels of both, is 'Medium', High level of one and Medium levels of the other is 'High', and High levels of both is 'Critical'.

      3

      Assess

        Plan risk mitigation strategy › Consider:
      • risk tolerance
      • compensating controls
      • business impact

      Info-Tech’s vulnerability management methodology

      Focus on developing the most efficient processes.

      Vulnerability management isn’t “old school.”

      The vulnerability management market is relatively mature; however, vulnerability management remains a very relevant and challenging topic.

      Security practitioners are inundated with the advice they need to prioritize their vulnerabilities. Every vulnerability scanning vendor will proclaim their ability to prioritize the identified vulnerabilities.

      Third-party prioritization methodology can’t be effectively applied across all organizations. Each organization is too unique with different constraints. No tool or service can account for these variables.

      Equation to find 'Vulnerability Priority'.

      When patching is not possible, other options exist: configuration changes (hardening), defense-in-depth, compensating controls, and even elevated security monitoring are possible options.

      Info-Tech Insight

      Vulnerability management is not only patch management. Patching is only one aspect.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      Key deliverable:

      Vulnerability Management SOP

      The Standard operating procedure (SOP) will comprise the end-to-end description of the program: roles & responsibilities, data flow, and expected outcomes of the program.

      Sample of the key deliverable, Vulnerability Management SOP.
      Vulnerability Management Policy

      Template for your vulnerability management policy.

      Sample of the Vulnerability Management Policy blueprint. Vulnerability Tracking Tool

      This tool offers a template to track vulnerabilities and how they are remedied.

      Sample of the Vulnerability Tracking Tool blueprint.
      Vulnerability Scanning RFP Template

      Request for proposal template for the selection of a vulnerability scanning tool.

      Sample of the Vulnerability Scanning RFP Template blueprint. Vulnerability Risk Assessment Tool

      Methodology to assess vulnerability risk by determining impact and likelihood.

      Sample of the Vulnerability Risk Assessment Tool blueprint.

      Blueprint benefits

      IT Benefits

      • A standardized, consistent methodology to assess, prioritize, and remediate vulnerabilities.
      • A risk-based approach that aligns with what’s important to the business.
      • A way of dealing with the high volumes of vulnerabilities that your scanning tool is reporting.
      • Identification of “where to start” in terms of vulnerability management.
      • Ability to not lose yourself in the patch madness but rather take a sound approach to scheduling and prioritizing patches and updates.
      • Knowledge of what to do when patching is simply not possible or feasible.

      Business Benefits

      • Alignment with IT in ensuring that business processes are only interrupted when absolutely necessary while maintaining a regular cadence of vulnerability remediation.
      • A consistent program that the business can plan around and predict when interruptions will occur.
      • IT’s new approach being integrated with existing IT operations processes, offering the most efficient yet expedient method of dealing with vulnerabilities.

      Info-Tech’s process can save significant financial resources

      Phase Measured Value
      Phase 1: Identify vulnerability sources
        Define the process, scope, roles, vulnerability sources, and current state
        • Consultant at $100 an hour for 16 hours = $1,600
      Phase 2: Triage vulnerabilities and assign urgencies
        Establish triaging and vulnerability evaluation process
        • Consultant at $100 an hour for 16 hours = $1,600
        Determine high-level business criticality and data classifications
        • Consultant at $100 an hour for 40 hours = $4,000
        Assign urgencies to vulnerabilities
        • Consultant at $100 an hour for 8 hours = $800
      Phase 3: Remediate vulnerabilities
        Prepare documentation for the vulnerability process
        • Consultant at $100 an hour for 8 hours = $800
        Establish defense-in-depth modelling
        • Consultant at $100 an hour for 24 hours = $2,400
        Identify remediation options and establish criteria for use
        • Consultant at $100 an hour for 40 hours = $4,000
        Formalize backup and testing procedures, including exceptions
        • Consultant at $100 an hour for 8 hours = $800
        Remediate vulnerabilities and verify
        • Consultant at $100 an hour for 24 hours = $2,400
      Phase 4: Continually improve the vulnerability management process
        Establish a metrics program for vulnerability management
        • Consultant at $100 an hour for 16 hours = $1,600
        Update vulnerability management policy
        • Consultant at $100 an hour for 8 hours = $800
        Develop a vulnerability scanning tool RFP
        • Consultant at $100 an hour for 40 hours = $4,000
        Develop a penetration test RFP
        • Consultant at $100 an hour for 40 hours = $4,000
      Potential financial savings from using Info-Tech resources Phase 1 ($1,600) + Phase 2 ($6,400) + Phase 3 ($10,400) + Phase 4 ($10,400) = $28,800

      Guided Implementation

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

      What does a typical GI on this topic look like?

      Phase 1

      Phase 2

      Phase 3

      Phase 4

      Call #1: Scope requirements, objectives, and your specific challenges.

      Call #2: Discuss current state and vulnerability sources.

      Call #3: Identify triage methods and business criticality.

      Call #4:Review current defense-in-depth and discuss risk assessment.

      Call #5: Discuss remediation options and scheduling.

      Call #6: Review release and change management and continuous improvement.

      Call #7: Identify metrics, KPIs, and CSFs.

      Call #8: Review vulnerability management policy.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

        Day 1 Day 2 Day 3 Day 4 Day 5
      Activities
      Identify vulnerability sources

      1.1 What is vulnerability management?

      1.2 Define scope and roles

      1.3 Cloud considerations for vulnerability management

      1.4 Vulnerability detection

      Triage and prioritize

      2.1 Triage vulnerabilities

      2.2 Determine high-level business criticality

      2.3 Consider current security posture

      2.4 Risk assessment of vulnerabilities

      Remediate vulnerabilities

      3.1 Assess remediation options

      3.2 Schedule and execute remediation

      3.3 Drive continuous improvement

      Measure and formalize

      4.1 Metrics, KPIs & CSFs

      4.2 Vulnerability Management Policy

      4.3 Select & implement a scanning tool

      4.4 Penetration testing

      Next Steps and Wrap-Up (offsite)

      5.1 Complete in-progress deliverables from previous four days

      5.2 Set up review time for workshop deliverables and to discuss next steps

      Deliverables
      1. Scope and boundary definition of vulnerability management program
      2. Responsibility assignment for vulnerability identification and remediation
      3. Monitoring and review process of third-party vulnerability sources
      4. Incident management and vulnerability convergence
      1. Methodology for evaluating identified vulnerabilities
      2. Identification of high-level business criticality
      3. Defined high-level data classifications
      4. Documented defense-in-depth controls
      5. Risk assessment criteria for impact and likelihood
      1. Documented risk assessment methodology and remediation options
      1. Defined metrics, key performance indicators (KPIs), and critical success factors (CSFs)
      2. Initial draft of vulnerability management policy
      3. Scanning tool selection criteria
      4. Introduction to penetration testing
      1. Completed vulnerability management standard operating procedure
      2. Defined vulnerability management risk assessment criteria
      3. Vulnerability management policy draft

      Implement Risk-Based Vulnerability Management

      Phase 1

      Identify Vulnerability Sources

      Phase 1

      1.1 What is vulnerability management?
      1.2 Define scope and roles
      1.3 Cloud considerations for vulnerability management
      1.4 Vulnerability detection

       

      Phase 2

      2.1 Triage vulnerabilities
      2.2 Determine high-level business criticality
      2.3 Consider current security posture
      2.4 Risk assessment of vulnerabilities

       

      Phase 3

      3.1 Assessing remediation options
      3.2 Scheduling and executing remediation
      3.3 Continuous improvement

       

      Phase 4

      4.1 Metrics, KPIs & CSFs
      4.2 Vulnerability management policy
      4.3 Select and implement a scanning tool
      4.4 Penetration testing

      This phase will walk you through the following activities:

      Establish a common understanding of vulnerability management, define the roles, scope, and information sources of vulnerability detection.

      This phase involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Step 1.1

      Vulnerability Management Defined

      Activities

      None for this section

      This step will walk you through the following activities:

      Establish a common understanding of vulnerability management and its place in the IT organization.

      This step involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Outcomes of this step

      Foundational knowledge of vulnerability management in your organization.

      Identify vulnerability sources
      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      What is vulnerability management?

      It’s more than just patching.

      • Vulnerability management is the regular and ongoing practice of scanning an operating environment to uncover vulnerabilities. These vulnerabilities can be outdated applications, unpatched operating systems and software, open ports, obsolete hardware, or any combination of these.
      • The scanning and detection of vulnerabilities is the first step. Planning and executing of remediation is next, along with the approach, prioritized sequence of events, and timing.
      • A vendor-supplied software patch or firmware update is often the easy answer, however, this is not always a viable solution. What if you can’t patch in a timely fashion? What if patching is not possible as it will break the application and bring down operations? What if no patch exists due to the age of the application or operating platform?

      “Most organizations do not have a formal process for vulnerability management.” (Morey Haber, VP of Technology, BeyondTrust, 2016)

      Effective vulnerability management

      It’s not easy, but it’s much harder without a process in place.
      • Effective vulnerability management requires a formal process for organizations to follow; without one, vulnerabilities are dealt with in an ad hoc fashion.
      • Patching isn’t the only solution, but it’s the one that often draws focus.
      • Responsibilities for the different aspects of vulnerability management are often unclear, such as for testing, remediation, and implementation.
      • Identifying new threats without proper vulnerability scanning tools can be a near-impossible task.
      • Determining which vulnerabilities are most urgent can be an inconsistent process, increasing the organizational risk.
      • Measuring the effectiveness of your vulnerability remediation activities can help you better manage resources in SecOps and ITOps. Your staff will be spending the appropriate effort on vulnerabilities that warrant that level of attention.

      You’re not just doing this for yourself. It’s also for your auditors.

      Many compliance and regulatory obligations require organizations to have thorough documentation of their vulnerability management practices.

      Vulnerability management revolves around your asset security services

      Diagram with 'Asset Security Services' at the center. On either side are 'Network Security Services' and 'Identity Security Services', all three of which flow up into 'Security Analytics | Security Incident Response', and all four share a symbiotic flow with 'Management' below and contribute to 'Mega Trend Mapping' above. Management is supported by 'Governance'. Vulnerabilities can be found primarily within your assets but also connect to your information risk management. These must be effectively managed as part of a holistic security program.

      Without management, vulnerabilities left unattended can be easy for attackers to exploit. It becomes difficult to identify the correct remediation option to mitigate against the vulnerabilities.

      Vulnerability management works in tandem with SecOps and ITOps

      Vulnerability Management Process Inputs/Outputs:
      'Vulnerability Management (Process and Tool)' outputs are 'Incident Management', 'Release Management', 'Change Management', 'IT Asset Management', 'Application Security Testing', 'Threat Intelligence', and 'Security Risk Management'; inputs are 'Vulnerability Disclosure', 'Threat Intelligence', and 'Security Risk Management'.

      Arrows denote direction of information feed

      Vulnerability management serves as the input into a number of processes for remediation, including:
      • Incident management, to deal with issues
      • Release management, for patch management
      • Change management, for change control
      • IT asset management, to track version information, e.g. for patching
      • Application security testing, for the verification of vulnerabilities

      A two-way data flow exists between vulnerability management and:

      • Security risk management, for the overall risk posture of the organization
      • Threat intelligence, as vulnerability management reveals only one of several threat vectors

      For additional information please refer to Info-Tech’s research for each area:

      • Vulnerability management can leverage your existing processes to gain an operational element for the program.
      • As you strive to mature each of the processes on their own, vulnerability management will benefit accordingly.
      • Review our research for each of these areas and speak to one of our analysts if you wish to improve any of the listed processes.

      Info-Tech’s Information Security Program Framework

      Vulnerability management is a component of the Infrastructure Security section of Security Management

      Information Security Framework with Level 1 and Level 2 capabilities in two main sections, 'Management' and 'Governance'. Level 2 capabilities are grouped within Level 1 capabilities. For more information, review our Build an Information Security Strategy blueprint, or speak to one of our analysts.

      Info-Tech Insight

      Vulnerability management is but one piece of the information security puzzle. Ensure that you have all the pieces!

      Case Study

      Logo for Cimpress.
      INDUSTRY: Manufacturing
      SOURCE: Cimpress, 2016

      One organization is seeing immediate benefits by formalizing its vulnerability management program.

      Challenge

      Cimpress was dealing with many challenges in regards to vulnerability management. Vulnerability scanning tools were used, but the reports that were generated often gave multiple vulnerabilities that were seen as critical or high and required many resources to help address them. Scanning was done primarily in an attempt to adhere to PCI compliance rather than to effectively enable security. After re-running some scans, Cimpress saw that some vulnerabilities had existed for an extended time period but were deemed acceptable.

      Solution

      The Director of Information Security realized that there was a need to greatly improve this current process. Guidelines and policies were formalized that communicated when scans should occur and what the expectations for remediations should be. Cimpress also built a tiered approach to prioritize vulnerabilities for remediation that is specific to Cimpress instead of relying on scanning tool reports.

      Results

      Cimpress found better management of the vulnerabilities within its system. There was no pushback to the adoption of the policies, and across the worldwide offices, business units have been proactively trying to understand if there are vulnerabilities. Vulnerability management has been expanded to vendors and is taken into consideration when doing any mergers and acquisitions. Cimpress continues to expand its program for vulnerability management to include application development and vulnerabilities within any existing legacy systems.

      Step 1.2

      Defining the scope and roles

      Activities
      • 1.2.1 Define the scope and boundary of your organization’s security program
      • 1.2.2 Assign responsibility for vulnerability identification and remediation

      This step will walk you through the following activities:

      Define and understand the scope and boundary of the security program. For example, does it include OT? Define roles and responsibilities for vulnerability identification and remediation

      This step involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Outcomes of this step

      Understand how far vulnerability management extends and what role each person in IT plays in the remediation of vulnerabilities

      Identify vulnerability sources
      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      Determine the scope of your security program

      This will help you adjust the depth and breadth of your vulnerability management program.
      • Determining the scope will help you decide how much organizational risk the vulnerability management program will oversee.
      • Scope can be defined along four aspects:
        • Data Scope – What data elements in your organization does your security program cover? How is data classified?
        • Physical Scope – What physical scope, such as geographies, does the security program cover?
        • Organizational Scope – How are business units engaged with security initiatives? Does the scope cover all subsidiary organizations?
        • IT Scope – What parts of the organization does IT cover? Does their coverage include operational technology (OT) and industrial control systems (ICS)?
      Stock image of figures standing in connected circles.

      1.2.1 Define the scope and boundary of your organization’s security program

      60 minutes

      Input: List of Data Scope, Physical Scope, Organization Scope, and IT Scope

      Output: Defined scope and boundaries of the IT security program

      Materials: Whiteboard/Flip Charts, Sticky Notes, Markers, Vulnerability Management SOP Template

      Participants: Business stakeholders, IT leaders, Security team members

      1. On a whiteboard, write the headers: Data Scope, Physical Scope, Organizational Scope, and IT Scope.
      2. Give each group member a handful of sticky notes. Ask them to write down as many items as possible for the organization that could fall under one of the four scope buckets.
      3. In a group, discuss the sticky notes and the rationale for including them. Discuss your security-related locations, data, people, and technologies, and define their scope and boundaries.

      The goal is to identify what your vulnerability management program is responsible for and document it.

      Consider the following:

      How is data being categorized and classified? How are business units engaged with security initiatives? How are IT systems connected to each other? How are physical locations functioning in terms of information security management?

      Download the Vulnerability Management SOP Template

      Assets are part of the scope definition

      An inventory of IT assets is necessary if there is to be effective vulnerability management.

      • Organizations need an up-to-date and comprehensive asset inventory for vulnerability management. This is due to multiple reasons:
        • When vulnerabilities are announced, they will need to be compared to an inventory to determine if the organization has any relevant systems or versions.
        • It indicates where all IT assets can be found both physically and logically.
        • Asset inventories typically have owners assigned to the assets and systems whose responsibility it is to carry out remediations for vulnerabilities.
      • Furthermore, asset inventories can provide insight into where data can be found within the organization. This is extremely useful within a formal data classification program, which plays a large factor in vulnerability management.
      If you need assistance building your asset inventory, review Info-Tech’s Implement Hardware Asset Management and Implement Software Asset Management blueprints.

      Info-Tech Insight

      Create a formal IT asset inventory before continuing with the rest of this project. Otherwise, you risk being at the mercy of a weak vulnerability management program.

      Assign responsibility for vulnerability identification and remediation

      Determine who is critical to effectively detecting and managing vulnerabilities.
      • Some of the remediation steps will involve members of IT management to identify the true organizational risk of a vulnerability.
      • Vulnerability remediation comes in different shapes and sizes. In addition to patching, this can include implementing compensating controls, server and application hardening, or the segregating of vulnerable systems.
        • Who carries out each of these activities? Who coordinates the activities and tracks them to ensure completion?
      • The people involved may be members outside of the security team, such as members from IT operations, infrastructure, and applications. The specific roles that each of these groups play should be clearly identified.
      Stock image of many connected profile photos in a cloud network.

      1.2.2 Assign responsibility for vulnerability identification and remediation

      60 minutes

      Input: Sample list of vulnerabilities and requisite actions from each group, High-level organizational chart with area functions

      Output: Defined set of roles and responsibilities for member groups

      Materials: Vulnerability Management SOP Template

      Participants: CIO, CISO, IT Management representatives for each area of IT

      1. Display the table of responsibilities that need to be assigned.
      2. List all the positions within the IT security team.
      3. Map these to the positions that require IT security team members.
      4. List all positions that are part of the IT team.
      5. Map these to the positions that require IT team members.

      If your organization does not have a dedicated IT security team, you can perform this exercise by mapping the relevant IT staff to the different positions shown on the right.

      Download the Vulnerability Management SOP Template Sample of the Roles and Responsibilities table from the Vulnerability Management SOP Template.

      Step 1.3

      Cloud considerations for vulnerability management

      Activities

      None for this section.

      This step will walk you through the following activities:

      Review cloud considerations for vulnerability management

      This step involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Outcomes of this step

      Understand the various types of cloud offerings and the implications (and limitations) of vulnerability management in a cloud environment.

      Identify vulnerability sources
      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      Cloud considerations

      Cloud will change your approach to vulnerability management.
      • There will be a heavy dependence on the cloud service provider to ensure that vulnerabilities in their foundational technologies have been addressed.
      • Depending on the level of “as-a-Service,” customers will have varying degrees of control and visibility into the underlying operations.
      • With vendor acquiescence, you can set your tool to scan a given cloud environment, depending on how much visibility you have into their environment based on the service you have purchased.
      • Due to compliance obligations of their customers, there is a growing trend among cloud providers to allow more scanning of cloud environments.
      • In the absence of customer scanning capability, vendors may offer attestation of vulnerability management and remediation.
      Table outlining who has control, between the 'Organization' and the 'Vendor', of different cloud capabilities in different cloud strategies.

      For more information, see Info-Tech Research Group’s Document Your Cloud Strategy blueprint.

      Cloud environment scanning

      Cloud scanning is becoming a more common necessity but still requires special consideration.

      An organization’s cloud environment is just an extension of its own environment. As such, cloud environments need to be scanned for vulnerabilities.

      Private Cloud
      If your organization owns a private cloud, these environments can be tested normally.
      Public Cloud
      Performing vulnerability testing against public, third-party cloud environments is an area experiencing rapid growth and general acceptance, although customer visibility will still be limited.

      In many cases, a customer must rely on the vendor’s assurance that vulnerabilities are being addressed in a sufficient manner.

      Security standards’ compliance requirements are driving the need for cloud suppliers to validate and assure that they are appropriately scanning for and remediating vulnerabilities.

      Infrastructure- or Platform-as-a-Service (IaaS or PaaS) Environments
      • There is a general trend for PaaS and IaaS vendors to allow testing if given due notice.
      • Your contract with the cloud vendor or the vendor’s terms and conditions will outline the permissibility of customer vulnerability scanning. In some cases, a cloud vendor will deny the ability to do vulnerability scanning if they already provide a solution as part of their service.
      • Always ensure that the vendor is aware of your vulnerability scanning activity so that false positives aren’t triggering their security measures as possible denial-of-service (DoS) attacks.
      Software-as-a-Service (SaaS) Environments
      • SaaS offers very limited visibility to the services behind the software that the customer sees. You therefore cannot test for patch levels or vulnerabilities.
      • SaaS customers must rely exclusively on the provider for the regular scanning and remediation of vulnerabilities in the back-end technologies supporting the SaaS application.
      • You can only test the connection points to SaaS environments. This involves trying to figure out what you can see, e.g. looking for encrypted traffic.

      Certain testing (e.g. DoS or load testing) will be very limited by your cloud vendor. Cloud vendors won’t open themselves to testing that would possibly impact their operations.

      Step 1.4

      Vulnerability detection

      Activities
      • 1.4.1 Develop a monitoring and review process of third-party vulnerability sources
      • 1.4.2 Incident management and vulnerability management

      This step will walk you through the following activities:

      Create an inventory of your vulnerability monitoring capability and third-party vulnerability information sources.

      Determine how incident management and vulnerability management interoperate.

      This step involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Outcomes of this step

      Catalog of vulnerability information data sources. Understanding of the intersection of incident management and vulnerability management.

      Identify vulnerability sources
      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      Vulnerability detection

      Vulnerabilities can be identified through numerous mediums.

      Info-Tech has determined the following to be the four most common ways to identify vulnerabilities.

      Vulnerability Assessment and Scanning Tools
      • Computer programs that function to identify and assess security vulnerabilities and weaknesses within computers, computer systems, applications, or networks.
      • Using a known vulnerability database, the tool scans targeted hosts or systems to identify flaws and generate reports and recommendations based on the results.
      • There are four main types of tools under this category: network and operating system vulnerability scanners, application scanning and testing tools, web application scanners, and exploitation tools.
      Penetration Tests
      • The act of identifying vulnerabilities on computers, computer systems, applications, or networks followed by testing of the vulnerability to validate the findings.
      • Penetration tests are considered a service that is offered by third-parties in which a variety of products, tools, and methods are used to exploit systems and gain access to data.
      Open Source Monitoring
      • New vulnerabilities are detected daily with each vulnerability’s information being uploaded to an information-sharing platform to enable other organizations to be able to identify the same vulnerability on their systems.
      • Open source platforms are used to alert and distribute information on newly discovered vulnerabilities to security professionals.
      Security Incidents
      • Any time an incident response plan is called into action to mitigate an incident, there should be formal communication with the vulnerability management team.
      • Any IT incident an organization experiences should provide a feed for analysis into your vulnerability management program.

      Automate with a vulnerability scanning tool

      Vulnerabilities are too numerous for manual scanning and detection.
      • Vulnerability management is not only the awareness of the existence of vulnerabilities but that they are actively present in your environment.
      • A vulnerability scanner will usually report dozens, if not hundreds, of vulnerabilities on a regular and recurring basis. Typical IT environments have several dozen, if not hundreds, of servers. We haven’t even considered the amount of network equipment or the hundreds of user workstations in an environment.
      • This tool will give you information of the presence of a vulnerability in your environment and the host on which the vulnerability exists. This includes information on the version of software that contains a vulnerability and whether you are running that version. The tool will also report on the criticality of the vulnerability based on industry criticality ratings.
      • The tools are continually updated by the vendor with the latest definition updates for the latest vulnerabilities out there. This ensures you are always scanning for the greatest number of potential vulnerabilities.
      Automation requires oversight.
      1. Vulnerability scanners bring great automation to the task of scanning and detecting vulnerabilities in high numbers.
      2. Vulnerability scanners, however, do not have your level of intelligence. Any compensating controls, network segregation, or other risk mitigation features that you have in place will not be known by the tool.
      3. Determining the risk and urgency of a vulnerability within the context of your specific environment will still require internal review by you or your SecOps team.

      For guidance on tool selection

      Refer to section 4.3 Selecting and Implement a Scanning Tool in this blueprint.

      Vulnerability scanning tool considerations

      Select a vulnerability scanning tool with the features you need to be effective.
      • Vulnerability scanning tool selection can be an exciting and confusing process. You will need to consider what features you desire in a tool and whether you want the tool to go beyond just scanning and reporting.
      • In addition to vulnerability scanning, some tools will integrate with your IT service management (service desk ticketing system) tool and asset, configuration, and change management modules. This can facilitate the necessary workflow that the remediation process follows once a vulnerability is discovered.
      • A number of vulnerability scanning tool vendors have started offering remediation as part of their software features. This includes the automation and orchestration functionality and configuration and asset management to track its remediation activities.
      • A side benefit of the asset discovery feature in vulnerability scanning tools is that it can help enhance an organization’s asset inventory and license compliance, particularly in cases where end users are able to install software on their workstations.
      Stock photo of a smartphone scanning a barcode.

      For guidance on tool vendors

      Visit SoftwareReviews for information on vulnerability management tools and vendors.

      Vulnerability scanning tool best practices

      How often should scans be performed?

      One-off scans provide snapshots in time. Repeated scans over time provide tracking for how systems are changing and how well patches are being applied and software is being updated.

      The results of a scan (asset inventory, configuration data, and vulnerability data) are basic information needed to understand your security posture. This data needs to be as up to date as possible.

      ANALYST PERSPECTIVE: Organizations should look for continuous scanning

      Continuous scanning is the concept of providing continual scanning of your systems so any asset, configuration, or vulnerability information is up to date. Most vendors will advertise continuous scanning but you need to be skeptical of how this feature is met.

      Continuous Scanning Methods

      Continuous agent scanning

      Real-time scanning that is completed through agent-based scanning. Provides real-time understanding of system changes.

      On-demand scanning

      Cyclical scanning is the method where once you’re done scanning an area, you start it again. This is usually done because doing some scans on some areas of your network take time. How long the scan takes depends on the scan itself. How often you perform a scan depends on how long a scan takes. For example, if a scan takes a day, you perform a daily scan.

      Cloud-based scanning

      Cloud-scanning-as-a-Service can provide hands-free continuous monitoring of your systems. This is usually priced as a subscription model.

      Vulnerability scanning tool best practices

      Where to perform a scan.

      What should be scanned How to point a scanner
      The general idea is that you want to scan pretty much everything. Here are considerations for three environments:
      Mobile Devices

      You need to scan mobile devices for vulnerabilities, but the problem is these can be hard to scan and often come and go on your network. There are always going to be some devices that aren’t on the network when scanning occurs.

      Several ways to scan mobile devices:

      • Intercept the device when it remotes into your network using a VPN. You catch the device with a remote scan. This can only be done if a VPN is required.
      • An agent-based approach can be used for mobile devices. Locally installed software gives the information needed to evaluate the security posture of a device. Discernibly, concerns around device processing, memory, and network bandwidth come into play. Ease of installation becomes key for agents.
      Virtualization
      • In a virtual environment, you will have servers being dynamically spun up. Ensure your tool is able to scan these new servers automatically.
      • Often, vulnerability scanning tool providers will restrict scanning to preapproved scanners. Look for tools that are preapproved by the VM vendors.
      Cloud Environments
      • You can set your tool to scan a given cloud environment. The main concern here is who owns the cloud. If it is a private cloud, there is little concern.
      • If it is a third-party cloud (AWS, Azure, etc.) you need to confirm with the cloud service provider that scanning of your cloud environment can occur.
      • There is a trend to allow more scanning of cloud environments.
      • You need to tell the scanner an IP address, a group of IP addresses, an asset group, or a combination of those.
      • You can categorize by functional classifications – internet-facing servers, workstations, network devices, etc., or by organizational structure – Finance, HR, Legal, etc.
      • If you have a strong change management system, you can better hone when and where to perform a scan based on actual changes.
      • You can set the number of concurrent outbound TCP connections that are being made. For example, set the tool so it sends out to 10 ports at a time, rather than pinging at 64k ports on a machine, which would flood the NIC.
      • Side Note: Flooding a host with pings from a scanning tool can be done to find out DoS thresholds on a machine. There are no bandwidth concerns for a network DoS, however, because the packets are so small.

      Vulnerability scanning tool best practices

      Communication and measurement

      Pre-Scan Communication With Users

      • It is always important to inform owners and users of systems that a scan will be happening.
      • Although it is unlikely any performance issues will arise, it is important to notify end users of potential impact.
      • Local admins or system owners may have controls in place that stop vulnerability scans and you need to inform the owners so that they can safelist the scanner you will be using.
      Vulnerability Scanning Tool Tracking Metrics
      • Vulnerability score by operating system, application, or organization division.
        • This provides a look at the widely accepted severity of the vulnerability as it relates across the organization’s systems.
      • Most vulnerable applications and application version.
        • This provides insight into how outdated applications are creating risk exposure for an organization.
        • This will also provide metrics on the effectiveness of your patching program.
      • Number of assets scanned within the last number of days.
        • This provides visibility into how often your assets are being scanned and thus protected.
      • Number of unowned devices or unapproved applications.
        • This metric will track how many unowned devices or unapproved applications may be on your network. Unowned devices may be rogue devices or just consultant/contractor devices.

      Third-party vulnerability information sources

      IT security forums and mailing lists are another source of vulnerability information.

      Proactively identify new vulnerabilities as they are announced.

      By monitoring for vulnerabilities as they are announced through industry alerts and open-source mechanisms, it is possible to identify vulnerabilities beyond your scanning tool’s penetration tests.

      Common sources:
      • Vendor websites and mailing lists
        • Vendors are the trusted sources for vulnerability and patch information on their products, particularly with new industry vulnerability disclosure requirements. Vendors are the most familiar with their products, downloads are most likely malware free, and additional information is often included.
        • There are some issues: vendors won’t announce a vulnerability until a patch is created, which creates a potential unknown risk exposure; numerous vendor sites will have to be monitored continually.
      • Third-party websites
        • A non-vendor site providing information on vulnerabilities. They often will cover a specific technology or an industry section, becoming a potential “one-stop shop” for some. They will often provide vulnerability information that is augmented with different remediation recommendations faster than vendors.
        • However, it’s more likely that malicious code could be downloaded and it will often not be comprehensive information on patching.
      • Third-party mailing lists, newsgroups, live paid subscriptions, and live open-source feeds
        • These are alerting and notification services for the detection and dissemination of vulnerability information. They provide information on the latest and most critical vulnerabilities, e.g. US-CERT Cybersecurity Alerts.
      • Vulnerability databases
        • These usually consist of dedicated databases on vulnerabilities. They perform the hard work of identifying and aggregating vulnerability and patch information into a central repository for end-user consumption. The commentary features on these databases provide excellent insight for practitioners, e.g. National Vulnerability Database (NVD).
      Stock photo of a student checking a bulletin board.

      Third-party vulnerability information sources

      IT security forums and mailing lists are another source of vulnerability information.

      Third-party sources for vulnerabilities

      • Open Source Vulnerability Database (OSVDB)
        • An open-source database that is run independently of any vendors.
      • Common Vulnerabilities and Exposures (CVE)
        • Free, international dictionary of publicly known information security vulnerabilities and exposures.
      • National Vulnerability Database (NVD)
        • Through NIST, the NVD is the US government’s repository of vulnerabilities and includes product names, flaws, and any impact metrics.
        • The National Checklist Repository Program (NCRP), also provided by NIST, provides security checklists for configurations of operating systems and applications.
        • The Center for Internet Security, a separate entity unrelated to NIST, provides configuration benchmarks that are often referenced by the NCRP.
      • Open Web Application Security Project (OWASP)
        • OWASP is another free project helping to expose vulnerabilities within software.
      • US-CERT National Cyber Alert System (US-CERT Alerts)
        • Cybersecurity Alerts – Provide timely information about current security issues, vulnerabilities, and exploits.
        • Cybersecurity Tips – Provide advice about common security issues for the general public.
        • Cybersecurity Bulletins – Provide weekly summaries of new vulnerabilities. Patch information is provided when available.
      • US-CERT Vulnerability Notes Database (US-CERT Vulnerability Notes)
        • Database of searchable security vulnerabilities that were deemed not critical enough to be covered under US-CERT Alerts. Note that the NVD covers both US-CERT Alerts and US-CERT Notes.
      • Open Vulnerability Assessment Language (OVAL)
        • Coding language for security professionals to discuss vulnerability checking and configuration issues. Vulnerabilities are identified using tests that are disseminated in OVAL definitions (XML executables that can be used by end users).

      1.4.1 Develop a monitoring and review process for third-party vulnerability sources

      60 minutes

      Input: Third-party resources list

      Output: Process for review of third-party vulnerability sources

      Materials: Whiteboard, Whiteboard markers, Vulnerability Management SOP Template

      Participants: IT Security Manager, SecOps team members, ITOps team members, CISO

      1. Identify what third-party resources are useful and relevant.
      2. Shortlist your third-party sources.
      3. Identify what is the best way to receive information from a third party.
      4. Document the method to receive or check information from the third-party source.
      5. Identify who is responsible for maintaining third-party vulnerability information sources
      6. Capture this information in the Vulnerability Management SOP Template.
      Download the Vulnerability Management SOP Template Sample of the Third Party Vulnerability Monitoring tables from the Vulnerability Management SOP Template.

      Incidents and vulnerability management

      Incidents can also be a sources of vulnerabilities.

      When any incident occurs, for example:

      • A security incident, such as malware detected on a machine
      • An IT incident, such as an application becomes unresponsive
      • A crisis occurs, like a worker accident

      There can be underlying vulnerabilities that need to be processed.

      Three Types of IT Incidents exist:
      1. Information Security Incident
      2. IT Incident and/or Problem
      3. Crisis

      Note: You need to have developed your various incident response plans to develop information feeds to the vulnerability mitigation process.
      If you are missing an incident response plan, take a look at Info-Tech’s Related Resources.

      Info-Tech Related Resources:
      If you do not have a formalized information security incident management program, take a look at Info-Tech’s blueprint Develop and Implement a Security Incident Management Program.

      If you do not have a formalized problem management process, take a look at Info-Tech’s blueprint Incident and Problem Management.

      If you do not have a formalized IT incident management process, take a look at Info-Tech’s blueprint Develop and Implement a Security Incident Management Program.

      If you do not have formalized crisis management, take a look at Info-Tech’s blueprint Implement Crisis Management Best Practices.

      1.4.2 Incident management and vulnerability management

      60 minutes

      Input: Existing incident response processes, Existing crisis communications plans

      Output: Alignment of vulnerability management program with existing incident management processes

      Materials: Whiteboard, Whiteboard markers, Vulnerability Management SOP Template

      Participants: IT Security Manager, SecOps team members, ITOps team members, including tiers 1, 2, and 3, CISO, CIO

      1. Inventory what incident response plans the organization has. These include:
        1. Information Security Incident Response Plan
        2. IT Incident Plan
        3. Problem Management Plan
        4. Crisis Management Plan
      2. Identify what part of those plans contains the post-response recap or final analysis.
      3. Formalize a communication process between the incident response plan and the vulnerability mitigation process.

      Note: Most incident processes will cover some sort of root cause analysis and investigation of the incident. If a vulnerability of any kind is detected within this analysis it needs to be reported on and treated as a detected vulnerability, thus warranting the full vulnerability mitigation process.

      Download the Vulnerability Management SOP Template

      Implement Risk-Based Vulnerability Management

      Phase 2

      Triage & prioritize

      Phase 1

      1.1 What is vulnerability management?
      1.2 Define scope and roles
      1.3 Cloud considerations for vulnerability management
      1.4 Vulnerability detection

       

      Phase 2

      2.1 Triage vulnerabilities
      2.2 Determine high-level business criticality
      2.3 Consider current security posture
      2.4 Risk assessment of vulnerabilities

       

      Phase 3

      3.1 Assessing remediation options
      3.2 Scheduling and executing remediation
      3.3 Continuous improvement

       

      Phase 4

      4.1 Metrics, KPIs & CSFs
      4.2 Vulnerability management policy
      4.3 Select and implement a scanning tool
      4.4 Penetration testing

      This phase will walk you through the following activities:

      Examine the elements that you will use to triage and analyze vulnerabilities, prioritizing using a risk-based approach, and prepare for remediation options.

      This phase involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Step 2.1

      Triage vulnerabilities

      Activities
      • 2.1.1 Evaluate your identified vulnerabilities

      This step will walk you through the following activities:

      Review your vulnerability information sources and determine a methodology that will be used to consistently evaluate vulnerabilities as your scanning tool alerts you to them.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      A consistent, documented process for the evaluation of vulnerabilities in your environment.

      Triage & prioritize
      Step 2.1 Step 2.2 Step 2.3 Step 2.4

      Triaging vulnerabilities

      Use Info-Tech’s methodology to allocate urgencies to your vulnerabilities to assign the appropriate resources to each one.

      When evaluating numerous vulnerabilities, use the following three factors to help determine the urgency of vulnerabilities:

      • The intrinsic qualities of the vulnerability
      • The business criticality of the affected asset
      • The sensitivity of the data stored on the affected asset

      Intrinsic qualities of the vulnerability — Vulnerabilities need to be examined for the inherent risk they pose specifically to the organization, which includes if an exploit has been identified or if the industry views this as a serious and likely threat.

      Business criticality of the affected asset — Assets with vulnerabilities need to be assessed for their criticality to the business. Vulnerabilities on systems that are critical to business operations or customer interactions are usually top of mind.

      Sensitivity of the data of the affected asset — Beyond just the criticality of the business, there must be consideration of the sensitivity of the data that may be compromised or modified as a result of any vulnerabilities.

      Info-Tech Insight

      This methodology allows you to determine urgency of vulnerabilities, but your remediation approach needs to be risk-based, within the context of your organization.

      Triage your vulnerabilities, filter out the noise

      Triaging enables your vulnerability management program to focus on what it should focus on.

      Use the Info-Tech Vulnerability Mitigation Process Template to define how to triage vulnerabilities as they first appear.

      Triaging is an important step in vulnerability management, whether you are facing ten to tens of thousands of vulnerability notifications.
      Many scanning tools already provide the capability to compare known vulnerabilities against existing assets through integration with the asset inventory.

      There are two major use cases for this process:
      1. For organizations that have identified vulnerabilities but do not know their own systems well enough. This can be due to a lack of a formal asset inventory.
      2. For proactive organizations that are regularly staying up to date with industry announcements regarding vulnerabilities. Once an alert has been made publicly, this process can assist in confirming if the vulnerability is relevant to the organization.
      The Info-Tech methodology for initial triaging of vulnerabilities:
      Flowchart of the Info-Tech methodology for initial triaging of vulnerabilities, beginning with 'Vulnerability has been identified' and ending with either 'Vulnerability has been triaged' or 'No action needed'.

      Even if neither of these use cases apply to your organization, triaging still addresses the issues of false positives. Triaging provides a quick way to determine if vulnerabilities are relevant.

      After eliminating the noise, evaluate your vulnerabilities to determine urgency

      Consider the intrinsic risk to the organization.

      Is there an associated, verified exploit?
      • For a vulnerability to become a true threat to the organization, it must be exploited to cause damage. In today’s threat landscape, exploit kits are sold online that allow individuals with low technical knowledge to exploit a vulnerability.
      • Not all vulnerabilities have an associated exploit, but this does not mean that these vulnerabilities can be left alone. In many cases, it is just a matter of time before an exploit is created.
      • Another point to consider is that while exploits can exist theoretically, they may not be verified. Vulnerabilities always pose some level of risk, but if there are no known verified exploits, there is less risk attached.
      Is there a CVSS base score of 7.0 or higher?
      • Common Vulnerability Scoring System (CVSS) is an open-source industry scoring method to assess the potential severity of vulnerabilities.
      • CVSS takes into account: attack vector, complexity, privileges required, user interaction, scope, confidentiality impact, integrity impact, and availability impact.
      • Vulnerabilities that have a score of 4.0 or lower are classified as low vulnerabilities, while scores between 4.0 and 6.9 are put in the medium category. Scores of 7 or higher are in the high and critical categories. As we will review in the Risk Assessment section, you will want to immediately deal with high and critical vulnerabilities.
      Is there potential for significant lateral movement?
      • Even though a vulnerability may appear to be part of an inconsequential asset, it is important to consider whether it can be leveraged to gain access to other areas of the network or system by an attacker.
      • Another consideration should be whether the vulnerability can be exploited by remote or local access. Remote exploits pose a greater risk as this can mean that attackers can perform an exploit from any location. Local exploits carry less risk, although the risk of insider threats should be considered here as well.

      2.1.1 Evaluate your identified vulnerabilities

      60 minutes

      Input: Visio workflow of Info-Tech’s vulnerability management process

      Output: Adjusted workflow to reflect your current processes, Vulnerability Tracking Tool

      Materials: Whiteboard, Whiteboard markers, Vulnerability Management SOP Template

      Participants: IT Security Manager, SecOps team members, ITOps team members, including tiers 1, 2, and 3, CISO, CIO

      Using the criteria from the previous slide, Info-Tech has created a methodology to evaluate your vulnerabilities by examining their intrinsic qualities.

      The methodology categorizes the vulnerabilities into high, medium, and low risk importance categorizations, before assigning final urgency scores in the later steps.

      1. Review the evaluation process in the Vulnerability Management Workflow library.
      2. Determine if this process makes sense for the organization; otherwise, change the flow to include any other considerations of process flows.
      3. As this process is used to evaluate vulnerabilities, document vulnerabilities to an importance category. This can be done in the Vulnerability Tracking Tool or using a similar internal vulnerability tracking document, if one exists.

      Download the Vulnerability Management SOP Template

      Step 2.2

      Determine high-level business criticality

      Activities
      • 2.2.1 Determine high-level business criticality
      • 2.2.2 Determine your high-level data classifications

      This step will walk you through the following activities:

      Determining high-level business criticality and data classifications will help ensure that IT security is aligned with what is critical to the business. This will be very important when decisions are made around vulnerability risk and the urgency of remediation action.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • CISO

      Outcomes of this step

      Understanding and consistency in how business criticality and business data is assessed by IT in the vulnerability management process.

      Triage & prioritize
      Step 2.1 Step 2.2 Step 2.3 Step 2.4

      Understanding business criticality is key to determining vulnerability urgency

      Prioritize operations that are truly critical to the operation of the business, and understand how they would be impacted by an exploited vulnerability.

      Use the questions below to help assess which operations are critical for the business to continue functioning.

      For example, email is often thought of as a business-critical operation when this is not always the case. It is important to the business, but as regular operations can continue for some time without it, it would not be considered extremely business critical.

      Questions to ask Description
      Is there a hard-dollar impact from downtime? This refers to when revenue or profits are directly impacted by a business disruption. For example, when an online ordering system is compromised and shut down, it impacts sales, and therefore, revenue.
      Is there an impact on goodwill/ customer trust? If downtime means delays in service delivery or otherwise impacts goodwill, there is an intangible impact on revenue that may make the associated systems mission critical.
      Is regulatory compliance a factor? Depending on the circumstances of the vulnerabilities, it can be a violation of regulatory compliance and would cause significant fines.
      Is there a health or safety risk? Some operations are critical to health and safety. For example, medical organizations have operations that are necessary to ensure that individuals’ health and safety are maintained. An exploited vulnerability that prevents these operations can directly impact the lives of these individuals.
      Don’t start from scratch – your disaster recovery plan (DRP) may have a business impact analysis (BIA) that can provide insight into which applications and operations are considered business critical.

      Analyst Perspective

      When assessing the criticality of business operations, most core business applications may be deemed business critical over the long term.

      Consider instead what the impact is over the first 24 or 48 hours of downtime.

      2.2.1 Determine high-level business criticality

      120 minutes; less time if a Disaster recovery plan business impact analysis exists

      Input: List of business operations, Insight into business operations impacts to the business

      Output: List of business operations and their criticality and impact to the business

      Materials: Vulnerability Management SOP Template

      Participants: Participants from the business, IT Security Manager, CISO, CIO

      1. List your core business operations at a high level.
      2. Use a High, Medium, or Low ranking to prioritize the business operations based on mission-critical criteria and the impact of the vulnerability.
      3. When using the process flow, consider if the vulnerability directly affects any of these business operations and move through the process flow based on the corresponding High, Medium, or Low ranking.
      Example prioritization of business operations for a manufacturing company: Questions to ask:
      1. Is there a hard-dollar impact from downtime?
      2. Is there impact on goodwill or customer trust?
      3. Is regulatory compliance a factor?
      4. Is there a health or safety risk?

      Download the Vulnerability Management SOP Template

      Determine vulnerability urgency by its data classification

      Consider how to classify your data based on if the Confidentiality, Integrity, or Availability (CIA) is compromised.

      To properly classify your data, consider how the confidentiality, integrity, and availability of that data would be affected if it were to be exploited by a vulnerability. Review the table below for an explanation for each objective.
      Confidentiality

      Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

      Integrity

      Guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity.

      Availability

      Ensuring timely and reliable access to and use of information.

      Each piece of data should be ranked as High, medium, or low across confidentiality, integrity, and availability based on adverse effect. Arrow pointing right. Low — Limited adverse effect

      Moderate — Serious adverse effect

      High — Severe or catastrophic adverse effect

      If you wish to build a whole data classification methodology, refer to our Discover and Classify Your Data blueprint.

      How to determine data classification when CIA differs:

      The overall ranking of the data will be impacted by the highest objective’s ranking.

      For example, if confidentiality and availability are low, but integrity is high, the overall impact is high.

      This process was developed in part by Federal Information Processing Standards Publication 199.

      2.2.2 Determine your high-level data classifications

      120 minutes, less time if data classification already exists

      Input: Knowledge of data use and sensitivity

      Output: Adjusted workflow to reflect your current processes, Vulnerability Tracking Tool

      Materials: Whiteboard, Whiteboard markers, Vulnerability Management SOP Template

      Participants: IT Security Manager, CISO, CIO

      If your organization has formal data classification in place, it should be leveraged to determine the high, medium, and low rankings necessary for the process flows. However, if there is no formal data classification in place, the process below can be followed:

      1. List common assets or applications that are prone to vulnerabilities.
      2. Consider the data that is on these devices and provide a high (severe or catastrophic adverse effect), medium (serious adverse effect), or low (limited adverse effect) ranking based on confidentiality, availability, and integrity.
        1. Use the table on the previous slide to assist in providing the ranking.
        2. Remember that it is the highest ranking that dictates the overall ranking of the data.
      3. Document which data belongs in each of the categories to provide contextual evidence.

      Download the Vulnerability Management SOP Template

      This process should be part of your larger data classification program. If you need assistance in building this out, review the Info-Tech research, Discover and Classify Your Data.

      Step 2.3

      Consider current security posture

      Activities
      • 2.3.1 Document your defense-in-depth controls

      This step will walk you through the following activities:

      Your defense-in-depth controls are the existing layers of security technology that protects your environment. These are relevant when considering the urgency and risk of vulnerabilities in your environment, as they will mitigate some of the risk.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      Understanding and documentation of your current defense-in-depth controls.

      Triage & prioritize
      Step 2.1 Step 2.2 Step 2.3 Step 2.4

      Review your current security posture

      What you have today matters.
      • In most cases, your vulnerability scanning tool alone will not have the context of your security posture in the results of its scans. This can skew the true urgency of detected vulnerabilities in your environment.
      • What you have in place today is what comprises your organization’s overall security posture. This bears high relevance to the determination of the risk that a vulnerability poses to your environment.
      • Elements such as enterprise architecture and defense in depth mechanisms should be factored into determining the risk of a vulnerability and what kind of immediacy is warranted to address it.
      • Details of your current security posture will also contribute to the assessment and selection of remediation options.
      Stock image of toy soldiers split into two colours, facing eachother down.

      Enterprise architecture considerations

      What does your network look like?
      • Most organizations have a network topology that has been put in place with operational needs in mind. These includes specific vLANs or subnets, broadcast domains, or other methods of traffic segregation.
      • The firewall and network ACLs (access control lists) will manage traffic and the routes that data packets follow to traverse a network.
      • Organizations may physically separate data network types, for example, a network for IT services and one for operational technology (OT)(OT is often known as ICS (industrial control systems) or SCADA (supervisory control and data acquisition)) or other types of production technology.
      • The deployment of distribution and access switches across an enterprise can also be a factor, where a flatter network will have fewer network devices within the topology.
      • In a directory services environment such as Windows Active Directory, servers and applications can be segregated by domains and trust relationships, organizational units, and security groups.
      What’s the relevance to vulnerability management?

      For a vulnerability to be exploited, a malicious actor must find a way to access the vulnerable system to make use of the vulnerability in question.

      Any enterprise architecture characteristics that you have in place may lessen the probability of a successful vulnerability exploit.

      This may potentially “buy time” for SecOps to address and remediate the vulnerability.

      Defense-in-depth

      Defense-in-depth provides extra layers of protection to the organization.

      • Defense-in-depth refers to the coordination of security controls to add layers of security to the organization.
        • This means that even if attackers are able to get past one control or layer, they are hindered by additional security.
      • Defense-in-depth is distinct from the previous section on enterprise architecture as these are security controls put in place with the purpose of being lines of defense within your security posture.
      • This can be extremely useful in managing vulnerabilities; thus, it is important to establish the existing defense-in-depth controls. By establishing the base model for your defense-in-depth, it will allow you to leverage these controls to manage vulnerabilities.
      • Controls are typically distributed across endpoints, network infrastructure, servers, and physical security.

      Note: Defense-in-depth controls do not entirely mitigate vulnerability risk. They provide a way in which the vulnerability cannot be exploited, but it continues to exist on the application. This must be kept in mind as the controls or applications themselves change, as it can re-open the vulnerability and cause potential problems.

      Examples of defense-in-depth controls can consist of any of the following:
      • Antivirus software
      • Authentication security
      • Multi-factor authentication
      • Firewalls
      • Demilitarized zones (DMZ)
      • Sandboxing
      • Network zoning
      • Application whitelisting
      • Access control lists
      • Intrusion detection & prevention systems
      • Airgapping
      • User security awareness training

      2.3.1 Document your defense-in-depth controls

      2 hours, less time if a security services catalog exists

      Input: List of technologies within your environment, List of IT security controls that are in place

      Output: List of defense-in-depth controls

      Materials: Whiteboard/flip charts, Vulnerability Management SOP Template

      Participants: IT Security Manager, Infrastructure Manager, IT Director, CISO

      1. Document the existing defense-in-depth controls within your system.
      2. Review the initial list that has been provided and see if these are controls that currently exist.
      3. Indicate any other controls that are being used by the organization. This may already exist if you have a security services catalog.
      4. Indicate who the owners of the different controls are.
      5. Track the information in the Vulnerability Management SOP Template.

      Download the Vulnerability Management SOP Template

      Sample table of security controls within a Defense-in-depth model with column headers 'Defense-in-depth control', 'Description', 'Workflow', and 'Control Owner'.

      Step 2.4

      Risk assessment of vulnerabilities

      Activities
      • 2.4.1 Build a classification scheme to consistently assess impact
      • 2.4.2 Build a classification scheme to consistently assess likelihood

      This step will walk you through the following activities:

      Assessing risk will be the cornerstone of how you evaluate vulnerabilities and what priority you place on remediation. This is actual risk to the organization and not simply what the tool reports without the context of your defense-in-depth controls.

      This step involves the following participants:

      • IT Security Manager
      • IT Operations Management
      • CISO
      • CIO

      Outcomes of this step

      A risk matrix tailored to your organization, based on impact and likelihood. This will provide a consistent, unambiguous way to assess risk across the vulnerability types that is reported by your scanning tool.

      Triage & prioritize
      Step 2.1 Step 2.2 Step 2.3 Step 2.4

      Vulnerabilities and risk

      Vulnerabilities must be addressed to mitigate risk to the business.
      • Vulnerabilities are a concern because they are potential threats to the business. Vulnerabilities that are not addressed can turn from potential threats into actual threats; it is only a matter of time and opportunity.
      • Your organization will already be familiar with risk management, as every decision carries a business risk component. There may even be a senior manager assigned as corporate risk officer to manage organizational risk.
      • The organization likely has a risk tolerance level that defines the organization’s risk appetite. This may be measured in dollars, non-productivity time, or other units of inefficiency.
      • The risk of a vulnerability can be calculated using impact and likelihood. Impact is the effect that the vulnerability will have if it is exploited by a malicious actor. Likelihood is the degree to which a vulnerability exploit can possibly occur.
      Stock image of a cartoon character in a tie hanging on the needle of a 'RISK' meter as it sits at 'LOW'.

      Info-Tech Insight

      Risk to the organization is business language that everyone can understand. This is particularly true when the risk is to productivity or to the company’s bottom line.

      A risk-based approach to vulnerability management

      CVSS scores are just the starting point!

      Vulnerabilities are constant.
      • There will always be vulnerabilities in the environment, many of which won’t be reported as they are currently unknown.
      • Don’t focus on trying to resolve all vulnerabilities in your environment. You are neither resourced for it nor can the business tolerate the downtime needed to remediate every single vulnerability.
        • The constant follow of new vulnerabilities will quickly render your efforts useless and it will become a game of “whack-a-mole.”
      • Being able to prioritize which vulnerabilities require appropriate levels of response is crucial to ensuring that an organization stays ahead of the continual flow.
      • Your vulnerability scanning tool will report the severity of a vulnerability, often using an industry Common Vulnerability Scoring System (CVSS) system ranging from 0 to 10. It will then scan your environment for the presence of the vulnerability and report accordingly.
        • Your vulnerability scanning tool will not be aware of any mitigation components in your environment, such as compensating controls, network segregation, server/application hardening, or any other measures that can reduce the risk. That is why determining actual risk is a crucial step.

      Stock image of a whack-a-mole game.

      Info-Tech Insight

      Vulnerability scanning is a valuable function, but it does not tell the full picture. You must determine how urgent a vulnerability truly is, based on your specific environment.

      Prioritize remediation by levels of risk

      Address critical and high risk with high immediacy.

      • Addressing the critical and high-risk vulnerabilities with urgency will ensure that you are addressing a more manageable number of vulnerabilities.
      • An optimized vulnerability management process will address the medium and low risk vulnerabilities within the regular cycle.
      • This may be very similar to what you do today in an ad hoc fashion:
        • Zero-day vulnerabilities tend to warrant a stop in operations and are dealt with immediately (or as soon as a vendor has a fix).
        • The standard remediation process (patching/updating, change of configuration, etc.) happens within a regular controlled time cycle.
      • Formalizing this process will ensure that appropriate attention is given to vulnerabilities that warrant it and that the remaining vulnerabilities are dealt with as a regular, recurring activity.

      Mitigate the risk surface by reducing the time across the phases

      Chart titled 'Mitigate the risk surface by reducing the time across the phases' with the axes 'Risk Level' and 'Time' with lines created by individual risks. The highlighted line begins in 'Critical' and eventually drops to low. A note on the line reads 'Objective: Reduce risk surface by reducing time to address'. The area between the line and your organization's risk tolerance is labelled 'Risk Surface, to be addressed with high priority'. A bracket around Risk levels 'High' and 'Critical' reads 'Priority focus zone (risk surface)'. Risk lines within levels 'Low' and 'Medium' read 'Follow standard vulnerability management cycles'.

      Risk matrix

      Risk = Impact x Likelihood
      • Info-Tech’s Vulnerability Management Risk Assessment Tool provides a method of calculating the risk of a vulnerability. The risk rating is assigned using the impact of the risk and the likelihood or probability that the event may occur.
      • The tool puts the vulnerability into your organization’s context: How many people will be affected? What service types are vulnerable and how does that impact the business? Is there an anticipated update from the vendor of the system being affected?
      • Urgency of remediation should be based on the business consequences if the vulnerability were to be exploited, relative to the business’ risk tolerance.

      Info-Tech Insight

      Risk determination should be done within the context of your current environment and not simply based on what your vulnerability tool is reporting.

      A risk matrix is useful in calculating a risk rating for vulnerabilities. Risk matrix with axes 'Impact' and 'Time' and individual vulnerabilities mapped onto it via their risk rating. The example 'Organizational Risk Tolerance Threshold' line runs diagonally through the 'Medium' squares.

      2.4.1 Build a classification scheme to consistently assess impact

      60 minutes

      Input: Knowledge of IT environment, Knowledge of business impact for each IT component or service

      Output: Vulnerability Management Risk Assessment Tool formatted to your organization

      Materials: Vulnerability Management Risk Assessment Tool

      Participants: Functional Area Managers, IT Security Manager, CISO

      Risk always has a negative impact, but the size of the impact can vary considerably in terms of cost, number of people or sites affected, and the severity of the impact. Impact questions tend to be more objective and quantifiable than likelihood questions.

      1. Define a set of questions to measure risk impact or edit existing questions in the tool.
      2. For each question, assign a weight that should be placed on that factor.
      3. Define criteria for each question that would categorize the risk. The drop-down box content can be modified in the hidden Labels tab.

      Note that you are looking to baseline vulnerability types, rather than categorizing every single vulnerability your scanning tool reports. The volume of vulnerabilities will be high, but vulnerabilities can be categorized into types on a regular basis.

      Download the Vulnerability Management Risk Assessment Tool

      Screenshot of table from Info-Tech's Vulnerability Management Risk Assessment Tool for assessing Impact. Column headers are 'Weight', 'Question', 'OS vulnerability', 'Application vulnerability', 'Network vulnerability', and 'Vendor patch release'.

      2.4.2 Build a classification scheme to consistently assess likelihood

      60 minutes

      Input: Knowledge of IT environment, Knowledge of business impact for each IT component or service

      Output: Vulnerability Management Risk Assessment Tool formatted to your organization

      Materials: Vulnerability Management Risk Assessment Tool

      Participants: Functional Area Managers, IT Security Manager, CISO

      Risk always has a negative impact, but the size of the impact can vary considerably in terms of cost, number of people or sites affected, and the severity of the impact. Impact questions tend to be more objective and quantifiable than likelihood questions.

      1. Define a set of questions to measure risk impact or edit existing questions in the tool.
      2. For each question, assign a weight that should be placed on that factor.
      3. Define criteria for each question that would categorize the risk. The drop-down box content can be modified in the hidden Labels tab.

      Note that you are looking to baseline vulnerability types, rather than categorizing every single vulnerability that your scanning tool reports. The volume of vulnerabilities will be high, but vulnerabilities can be categorized into types on a regular basis.

      Download the Vulnerability Management Risk Assessment Tool

      Screenshot of table from Info-Tech's Vulnerability Management Risk Assessment Tool for assessing Likelihood. Column headers are 'Weight', 'Question', 'OS vulnerability', 'Application vulnerability', and 'Network vulnerability'.

      Prioritize based on risk

      Select the best remediation option to minimize risk.

      Through the combination of the identified risk and remediation steps in this phase, the prioritization for vulnerabilities will become clear. Vulnerabilities will be assigned a priority once their intrinsic qualities and threat potential to business function and data have been identified.

      • Remediation options will be identified for the higher urgency vulnerabilities.
      • Options will be assessed for whether they are appropriate.
      • They will be further tested to determine if they can be used adequately prior to full implementation.
      • Based on the assessments, the remediation will be implemented or another option will be considered.
      Prioritization
      1. Assignment of risk
      2. Identification of remediation options
      3. Assessment of options
      4. Implementation

      Remediation plays an incredibly important role in the entire program. It plays a large part in wider risk management when you must consider the risk of the vulnerability, the risk of the remediation option, and the risk associated with the overall process.

      Implement Risk-Based Vulnerability Management

      Phase 3

      Remediate vulnerabilities

      Phase 1

      1.1 What is vulnerability management?
      1.2 Define scope and roles
      1.3 Cloud considerations for vulnerability management
      1.4 Vulnerability detection

       

      Phase 2

      2.1 Triage vulnerabilities
      2.2 Determine high-level business criticality
      2.3 Consider current security posture
      2.4 Risk assessment of vulnerabilities

       

      Phase 3

      3.1 Assessing remediation options
      3.2 Scheduling and executing remediation
      3.3 Continuous improvement

       

      Phase 4

      4.1 Metrics, KPIs & CSFs
      4.2 Vulnerability management policy
      4.3 Select and implement a scanning tool
      4.4 Penetration testing

      This phase will walk you through the following activities:

      • Identifying potential remediation options.
      • Developing criteria for each option with regards to when to use and when to avoid.
      • Establishing exception procedure for testing and remediation.
      • Documenting the implementation of remediations and verification.

      This phase involves the following participants:

      • CISO, or equivalent
      • Security Manager/Analyst
      • Network, Administrator, System, Database Manager
      • Other members of the vulnerability management team
      • Risk managers for the risk-related steps

      Determining how to remediate

      Patching is only one option.

      This phase will allow organizations to build out the specific processes for remediating vulnerabilities. The overall process will be the same but what will be critical is the identification of the correct material. This includes building the processes around:
      • Identifying and selecting the remediation option to be used.
      • Determining what to do when a patch or update is not available.
      • Scheduling and executing the remediation activity.
      • Continuous improvement.

      Each remediation option carries a different level of risk that the organization needs to consider and accept by building out this program.

      It is necessary to be prepared to do this in real time. Careful documentation is needed when dealing with vulnerabilities. Use the Vulnerability Tracking Tool to assist with documentation in real time. This is separate from using the process template but can assist in the documentation of vulnerabilities.

      Step 3.1

      Assessing remediation options

      Activities
      • 3.1.1 Develop risk and remediation action

      This step will walk you through the following activities:

      With the risk assessment from the previous activity, we can now examine remediation options and make a decision. This activity will guide us through that.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      List of remediation options and criteria on when to consider each.

      Remediate vulnerabilities
      Step 3.1 Step 3.2 Step 3.3

      Identify remediation options

      There are four options when it comes to vulnerability remediation.

      Patches and Updates

      Patches are software or pieces of code that are meant to close vulnerabilities or provide fixes to any bugs within existing software. These are typically provided by the vendor to ensure that any deployed software is properly protected after vulnerabilities have been detected.

      Configuration Changes

      Configuration changes involve administrators making significant changes to the system or network to remediate against the vulnerability. This can include disabling the vulnerable application or specific element and can even extend to removing the application altogether.

      Remediation

      Compensating Controls

      By leveraging security controls, such as your IDS/IPS, firewalls, or access control, organizations can have an added layer of protection against vulnerabilities beyond the typical patches and configuration changes. This can be used as a measure while waiting to implement another option (if one exists) to reduce the risk of the vulnerability in the short or long term.

      Risk Acceptance

      Whenever a vulnerability is not remediated, either indefinitely or for a short period of time, the organization is accepting the associated risk. Segregation of the vulnerable system can occur in this instance. This can occur in cases where a system or application cannot be updated without detrimental effect to the business.

      Patches and updates

      Patches are often the easiest and most common method of remediation.

      Patches are usually the most desirable remediation solution when it comes to vulnerability management. They are typically provided by the vendor of the vulnerable application or system and are meant to eliminate the existing vulnerability.

      When to use

      • When adequate testing can be performed on the patch to be implemented.
      • When there is a change window approaching for the affected systems.
      • When there is standardization across the IT assets to allow for easier installation of patches.

      When to avoid

      • When the patch cannot be adequately tested.
      • When a patch has been tested, but it caused an unfavorable consequence such as a system or application failure.
      • When there is no near change window in which to install the patches, which is often the case for critical systems.
      When to consider other remediation options
      • For critical systems, it can be difficult to implement a patch as they often require the system to be rebooted or go through some downtime. There must be consideration towards whether there is a change window approaching if a patch is to be implemented on a business-critical system.
        • If there is no opportunity to implement the patch, or no approaching change window, it is wise to leverage another remediation option.
      • When patches are not currently available from the vendor or they are in production, other remediation options are needed.
      • Other remediation options can be used in tandem with the patch. For example, if a patch is being deferred until the change window, it would be wise to use alternate remediation options to close the vulnerability.

      Compensating controls

      Compensating controls can decrease the risk of vulnerabilities that cannot be (immediately) remediated.

      • Compensating controls are measures put in place when direct remediation measures are impractical or non-existent.
      • Similar to the payment card industry’s PCI DSS 1.0 provision of compensating controls, these are meant to meet the intent or rigor of the original requirement; unlike PCI DSS, these measures are to mitigate risk rather than meet compliance.
      • The compensating control should be viewed as only a temporary measure for dealing with a vulnerability, although circumstances may dictate a degree of permanence in the application of the compensating control.
      • Examples where compensating controls may be needed are:
        • The software vendor is developing an update or patch to address a vulnerability.
        • Through your testing process, a patch will adversely affect the performance or operation of the target system and be detrimental to the business.
        • A critical application will only run on a legacy operating system, the latter of which is no longer supported by the vendor.
        • A legacy application is no longer being supported but is critical to your operations. A replacement, if one exists, will take time to implement.
      Examples of compensating controls
      • Segregating a vulnerable server or application on the network, physically or logically.
      • Hardening the operating system or application.
      • Restricting user logins to the system or application.
      • Implementing access controls on the network route to the system.
      • Instituting application whitelisting.

      Configuration changes

      Configuration changes involve making changes directly to the application or system in which there is a vulnerability. This can vary from disabling or removing the vulnerable element or, in the case of applications built in-house, changing the coding of the application itself. These are commonly used in network vulnerabilities such as open ports.

      When to use

      • A patch is not available.
      • The vulnerable element can be significantly changed, or even disabled, without significantly disrupting the business.
      • The application is built in-house, as the vulnerability must be closed internally.
      • There is adequate testing to ensure that the configuration change does not affect the business.
      • A configuration change in your network or system can affect numerous endpoints or systems, reducing endpoint patching or use of defense-in-depth controls.

      When to avoid

      • When a suitable patch is available.
      • When the vulnerability is on a business-critical element with no nearby change window or it cannot be disabled.
      • When there is no opportunity in which to perform testing to ensure that there are no unintended consequences.
      When to consider other remediation options
      • Configuration changes require careful documentation as changes are occurring to the system and applications. If there is a need to perform a back-out process and return to the original configuration, this can be extremely difficult without clear documentation of what occurred.
      • If business systems are too critical or important to the regular business function to perform any changes, it is necessary to consider other options.

      Info-Tech Insight

      Remember your existing processes: configuration changes may need to be approved and orchestrated through your organization’s configuration and change management processes.

      Case Study

      Remediation options do not have to be used separately. Use the Shellshock 2014 case as an example.

       
      INDUSTRY: All
      SOURCE: Public Domain
      Challenge

      Bashdoor, more commonly known as Shellshock, was announced on September 24, 2014.

      This bug involved the Bash shell, which normally executes user commands, but this vulnerability meant that malicious attackers could exploit it.

      This was rated a 10/10 by CVSS – the highest possible score.

      Within hours of the announcement, hackers began to exploit this vulnerability across many organizations.

      Solution

      Organizations had to react quickly and multiple remediation options were identified:

      • Configuration changes – Companies were recommended to use other shells instead of the Bash shell.
      • Defense-in-depth controls – Using HTTP server logs, it could be possible to identify if the vulnerability had been exploited.
      • Patches – Many vendors released patches to close this vulnerability including Debian, Ubuntu, and Red Hat.
      Results

      Companies began to protect themselves against these vulnerabilities.

      While many organizations installed patches as quickly as possible, some also wished to test the patch and leveraged defense-in-depth controls in the interim.

      However, even today, many still have the Shellshock vulnerability and exploits continue to occur.

      Accept the risk and do nothing

      By choosing not to remediate vulnerabilities, you must accept the associated risk. This should be your very last option.

      Every time that a vulnerability is not remediated, it continues to pose a risk to the organization. While it may seem that every vulnerability needs to be remediated, this is simply not possible due to limited resources. Further, it can take away resources from other security initiatives as opposed to low-priority vulnerabilities that are extremely unlikely to be exploited.

      Common criteria for vulnerabilities that are not remediated:
      • Affected systems are of extremely low criticality.
      • Affected systems are deemed too critical to take offline to perform adequate remediation.
      • Low urgency is assigned to those vulnerabilities.
      • Cost and time required for the remediation are too high.
      • No adequate solutions exist – the vendor has not released a patch, there are weak defense-in-depth controls, and it is not possible to perform a configuration change.

      Risk acceptance is not uncommon…

      • With an ever-increasing number of vulnerabilities, organizations are struggling to keep up and often, intentionally or unintentionally, accept the risk associated.
      • In the end, non-remediation means full acceptance of the risk and any consequences.

      Enterprise risk management
      Arrow pointing up.
      Risk acceptance of vulnerabilities

      While these are common criteria, they must be aligned to the enterprise risk management framework and approved by management.

      Don’t forget the variables that were assessed in Phase 2. This includes the risk from potential lateral movement or if there is an existing exploit.

      Risk considerations

      When determining if risk acceptance is appropriate, consider the cost of not mitigating vulnerabilities.

      Don’t accept the risk because it seems easy. Consider the financial impact of leaving vulnerabilities open.

      With risk acceptance, it is important to review the financial impact of a security incident resulting from that vulnerability. There is always the possibility of exploitation for vulnerabilities. A simple metric taken from NIST SP800-40 to use for this is:

      Cost not to mitigate = W * T * R

      Where (W) is the number of work stations, (T) is the time spent fixing systems or lost in productivity, and (R) is the hourly rate of the time spent.

      As an example provided by NIST SP800-40 Version 2.0, Creating a Patch and Vulnerability Management Program:

      “For an organization where there are 1,000 computers to be fixed, each taking an average of 8 hours of down time (4 hours for one worker to rebuild a system, plus 4 hours the computer owner is without a computer to do work) at a rate of $70/hour for wages and benefits:

      1,000 computers * 8 hours * $70/hour = $560,000”

      Info-Tech Insight

      Always consider the financial impact that can occur from an exploited vulnerability that was not remediated.

      3.1.1 Develop risk and remediation action

      90 minutes

      Input: List of remediation options

      Output: List of remediation options sorted into “when to use” and “when to avoid” lists

      Materials: Whiteboard/flip charts, Vulnerability Management SOP Template

      Participants: IT Security Manager, IT Infrastructure Manager, IT Operations Manager, Corporate Risk Officer, CISO

      It is important to define and document your organization-specific criteria for when a remediation option is appropriate and inappropriate.

      1. List each remediation option on a flip chart and create two headings: “When to use” and “When to avoid.”
      2. Each person will list “when to use” criteria on a green sticky note and “when to avoid” criteria on a red one for each option; these will be placed on the appropriate flip chart.
      3. Discuss as a group which criteria are appropriate and which should be removed.
      4. Move on to the next remediation option when completed.
        • Ensure to include when there are remediation options that will be connected. For example, the risk may be accepted until the next available change window, or a defense-in-depth control is used before a patch can be fully installed.
      5. Once the criteria has been established, document this in the Vulnerability Management SOP Template.
      When to use:
      • When adequate testing can be performed on the patch to be implemented.
      • When there is a change window approaching, especially for critical systems.
      • When there is standardization across the IT assets to allow for easier installation of patches.
      When to avoid:
      • When the patch cannot be adequately tested.
      • When a patch has been tested, but it has caused an unfavorable consequence such as a system or application failure.
      • When there is no near change window in which to install the patches.
      (Example from the Vulnerability Management SOP Template for Patches.)

      Download the Vulnerability Management SOP Template

      Step 3.2

      Scheduling and executing remediation

      Activities

      None for this section.

      This step will walk you through the following activities:

      Although there are no specific activities for this section, it will walk you through your existing processes configuration and change management to ensure that you are leveraging those activities in your vulnerability remediation actions.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      Gained understanding of how IT operations processes configuration and change management can be leveraged for the vulnerability remediation process. Don’t reinvent the wheel!

      Remediate vulnerabilities
      Step 3.1 Step 3.2 Step 3.3

      Implementing the remediation

      Vulnerability management converges with your IT operations functions.
      • Once a remediation strategy has been formulated, you can leverage your release and change management processes to orchestrate the testing, version tracking, scheduling, approval, and implementation activities.
      • Each of these processes should exist in your environment in some form. Leveraging these will engage the IT operations team to carry out their tasks in the remediation process.
      • There can be a partial or full handoff to these processes, however, the owner of the vulnerability management program is responsible for verifying the application of the remediation measure and that the overall risk has been reduced.
      • Although full blueprints exist that cover each of these processes in great detail, the following slides provide an overview of each of these IT operations processes and how they intersect with vulnerability management.
      Stock image of a person on a laptop overlaid by an icon with gears indicating settings.

      Release Management

      Control the quality of deployments and releases of software updates.

      • The release management process exists to ensure that new software releases (such as patches and updates) are properly tested and documented with version control prior to their implementation into the production environment.
      • The process should map out the logistics of the deployment process to ensure that it is consistent and controlled.
      • Testing is an important part of release management and the urgency of a vulnerability remediation operation can expedite this process to ensure minimal delays. Once testing has been completed successfully, the update is then “promoted” to production-ready status and submitted into the change management process.
      • Often a separate release team may not exist, however, release management still occurs.

      For guidance on implementing or improving your release management process, refer to Info-Tech’s Stabilize Release and Deployment Management blueprint or speak to one of our experts.

      Info-Tech Insight

      Many organizations don’t have a separate release team. Rather, whomever is doing the deployment will submit a change request and the testing details are vetted through the organization’s change management process.

      For guidance on the change management process review our Optimize Change Management blueprint.

      Change Management

      Leverage change control, interruption management, approval, and scheduling.
      • Change management likely exists in some shape or form in your organization. There is usually someone or a committee, such as a change advisory board (CAB), that gives approval for a change.
      • Leveraging the change management process will ensure that your vulnerability remediation has undergone the proper review and approval before implementation. There will usually be business sign-off as part of a change management approval process.
      • Communication will also be integrated in the change management process, so the change manager will ensure that appropriate, timely communications are sent to the proper key stakeholders.
      • The change management process will link to release management and configuration management processes if they exist.

      For further guidance on implementing or improving your change management process, refer to Info-Tech’s Optimize Change Management blueprint or speak to one of our experts.

      “With no controls in place, IT gets the blame for embarrassing outages. Too much control, and IT is seen as a roadblock to innovation.” (VP IT, Federal Credit Union)

      Post-implementation activities

      Vulnerability remediation isn’t a “set it and forget it” activity.
      • Once vulnerability remediation has occurred, it is imperative that the results are reported back to the vulnerability management program manager. This ensures that the loop is closed and the tracking of the remediation activity is done properly.
        • Organizations that are subject to audit by external entities will understand the importance of such documentation.
      • The results of post-implementation review from the change management process will be of great interest, particularly if there was any deviation from the planned activities.
      • Although change execution will usually undergo some form of testing during the maintenance window, there is always the possibility that something has broken as a result of the software update. Be quick to respond to these types of incidents!
        • One example of an issue that is near impossible to test during a maintenance window is one that manifests only when the system or software comes under load. This is what makes for busy Monday mornings after a weekend change window.
      A scan with your vulnerability management software after remediation can be a way to verify that the overall risk has been reduced, if remediation was done by way of patching/updates.

      Info-Tech Insight

      After every change completion, whether due to vulnerability remediation or not, it is a good idea to ensure that your infrastructure team increases its monitoring diligence and that your service desk is ready for any sudden influx of end-user calls.

      Step 3.3

      Continuous improvement

      Activities

      None for this section.

      This step will walk you through the following activities:

      Although this section has no activities, it will review the process by which you may continually improve vulnerability management.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      An understanding of the importance of ongoing improvements to the vulnerability management program.

      Remediate vulnerabilities
      Step 3.1 Step 3.2 Step 3.3

      Drive continuous improvement

      • Also known as “Continual Improvement” within the ITIL best practice framework.
      • Your vulnerability management program will not be perfect on first launch. In fact, due to the ever-changing nature of vulnerabilities and the technology designed to detect and combat vulnerabilities, the processes within your vulnerability management program will need to be tweaked from time to time.
      • Continuous improvement is a sustained, proactive approach to process improvement. The practice allows for all process participants to observe and suggest incremental improvements that can help improve the overall process.
      • In many cases, continuous improvement can be triggered by changes in the environment. This makes perfect sense for vulnerability management process improvement as a change in the environment will require vulnerability scanning to ensure that such changes have not introduced new vulnerabilities into the environment, increasing your risk surface.
      • One key method to tracking continuous improvement is through the effective use of metrics, covered in Section 4.1 of this blueprint.
      “The success rate for continual improvement efforts is less than 60 percent. A major – if not the biggest – factor affecting the deployment of long-term continual improvement initiatives today is the fundamental change taking place in the way companies manage and execute work.” (Industry analyst at a consulting firm, 2014)

      Continuous Improvement

      Continuously re-evaluate the vulnerability management process.

      As your systems and assets change, your vulnerability management program may need updates in two ways.

      When new assets and systems are introduced:

      • When new systems and assets are introduced, it is important for organizations to recognize how these can affect vulnerability management.
      • It will be necessary to identify the business criticality of the new assets and systems and the sensitivity of the data that can be found on them.
      • Without doing so, these will be considered rogue systems or assets – there is no clear process for assigning urgencies.
      • This will only cause problems as actions may be taken that are not aligned with the organization’s risk management framework.

      Effective systems and asset management are needed to track this. Review Info-Tech’s Implement Systems Management to Improve Availability and Visibility blueprint for more help.

      Document any changes to the vulnerability management program in the Vulnerability Management SOP Template.

      When defense-in-depth capabilities are modified:

      • As you build an effective security program, more controls will be added that can be used to protect the organization.
      • These should be documented and evaluated based on ability to mitigate against vulnerabilities.
      • The defense-in-depth model that was previously established should be updated to include the new capabilities that can be used.
      • Defense-in-depth models are continually evolving as the security landscape evolves, and organizations must be ready for this.

      To assist in building a defense-in-depth model, review Build an Information Security Strategy.

      Implement Risk-Based Vulnerability Management

      Phase 4

      Measure and formalize

      Phase 1

      1.1 What is vulnerability management?
      1.2 Define scope and roles
      1.3 Cloud considerations for vulnerability management
      1.4 Vulnerability detection

       

      Phase 2

      2.1 Triage vulnerabilities
      2.2 Determine high-level business criticality
      2.3 Consider current security posture
      2.4 Risk assessment of vulnerabilities

       

      Phase 3

      3.1 Assessing remediation options
      3.2 Scheduling and executing remediation
      3.3 Continuous improvement

       

      Phase 4

      4.1 Metrics, KPIs & CSFs
      4.2 Vulnerability management policy
      4.3 Select and implement a scanning tool
      4.4 Penetration testing

      This phase will walk you through the following activities:

      • You will determine what ought to be measured to track the success of your vulnerability management program.
      • If you lack a scanning tool this phase will help you determine tool selection.
      • Lastly, penetration testing is a good next step to consider once you have your vulnerability management program well underway.

      This phase involves the following participants:

      • IT Security Manager
      • SecOps team members
      • Procurement representatives
      • CISO
      • CIO

      Step 4.1

      Metrics, Key Performance Indicators (KPIs), and Critical Success Factors (CSFs)

      Activities
      • 4.1.1 Measure your program with metrics, KPIs, and CSFs

      This step will walk you through the following activities:

      After a review of the differences between raw metrics, key performance indicators (KPI), and critical success factors (CSF), compile a list of what metrics you will be tracking, why, and the business goals for each.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • CISO
      • CIO

      Outcomes of this step

      Outline of metrics you can configure your vulnerability scanning tool to report on.

      Measure and formalize
      Step 4.1 Step 4.2 Step 4.3 Step 4.4

      You can’t manage what you can’t measure

      Metrics provides visibility.

      • Management consultant Peter Drucker introduced the concept of metrics tied to key performance indicators (KPIs), and the concept holds true: without metrics, you lack the visibility to manage or improve a process.
      • Metrics aren’t just a collection of statistics, they have to be meaningful, they have to tell the story, and most importantly, they have to answer the “so what?” question. What is the significance of a metric – do they illustrate a trend or an anomaly? What actions should be carried out when a metric hits a certain threshold?
      • It would be prudent to track several metrics that can be combined to tell the full story. For example, tracking the number of critical vulnerabilities alone does not give a sense of the overall risk to the organization, nor does it offer any information on how quickly they have been remediated or what amount of effort was invested.
      Stock image of measuring tape.

      Metrics, KPIs, and CSFs

      Tracking the right information and making the information relevant.
      • There is often confusion between raw metrics, key performance indicators, and critical success factors.
      • Raw metrics are what is trackable from your systems and processes as a set of measurements without any context. Raw metrics in themselves are useful in telling the story of “what are we doing?”
      • KPIs are the specific metric or combination of metrics that help you track or gauge performance. KPIs tell the story of “how are we doing?” or “how well are we doing?”
      • CSFs are the specific KPIs that track the activities that are absolutely critical to accomplish for the business or business unit to be successful.
      The activity tracker on your wrist is a wealth of metrics, KPIs, and CSFs.

      If you wear an activity tracker, you are likely already familiar with the differences between metrics, key performance indicators, and critical success factors:

      • The raw metrics are your heart rate, step count, hours of sleep, caloric intake, etc.
      • KPIs are the individual goals that you have set: maintain a heart rate within the appropriate range for your age/activity level, achieve a step count goal per day, get x hours of sleep per night, consume a calorie range of y per day, etc.
      • CSFs are your overall goal: increase your cardiovascular capacity, lose weight, feel more energetic, etc.

      Your security systems can be similarly measured and tracked – transfer this skill!

      Tracking relevant information

      Tell the story in the numbers.

      Below are a number of suggested metrics to track, and why.

      Business Goal

      Critical Success Factor

      Key Performance Indicator

      Metric to track

      Minimize overall risk exposure Reduction of overall risk due to vulnerabilities Decrease in vulnerabilities Track the number of vulnerabilities year after year.
      Appropriate allocation of time and resources Proper prioritization of vulnerability mitigation activities Decrease of critical and high vulnerabilities Track the number of high-urgency vulnerabilities.
      Consistent timely remediation of threats to the business Minimize risk when vulnerabilities are detected Remediate vulnerabilities more quickly Mean time to detect: track the average time between the identification to remediation.
      Track effectiveness of scanning tool Minimize the ratio, indicating that the tool sees everything Ratio between known assets and what the scanner tracks Scanner coverage compared to known assets in the organization.
      Having effective tools to track and address Accuracy of the scanning tool Difference or ratio between reported vulnerabilities and verified ones Number of critical or high vulnerabilities verified, between the scanning tool’s criticality rating and actual criticality.
      Reduction of exceptions to ensure minimal exposure Visibility into persistent vulnerabilities and risk mitigation measures Number of exceptions granted Number of vulnerabilities in which little or no remediation action was taken.

      4.1.1 Measure your program with metrics, KPIs, and CSFs

      60 minutes

      Input: List of metrics current being measured by the vulnerability management tool

      Output: List of relevant metrics to track, and the KPIs, CSFs, and business goals related to the metric

      Materials: Whiteboard/flip charts, Vulnerability Management SOP Template

      Participants: IT Security Manager, IT operations management, CISO

      Metrics can offer a way to view how the organization is dealing with vulnerabilities and if there is improvement.

      1. Determine the high-level vulnerability management goals for the organization.
      2. Even with a formal process in place, the organization should be considering ways it can improve.
      3. Determine metrics that can help quantify those goals and how they can be measured.
      4. Metrics should always be easy to measure. If it’s a complex process to find the information required, it means that it is not a metric that should be used.
      5. Document your list of metrics in the Vulnerability Management SOP Template.

      Download the Vulnerability Management SOP Template

      Step 4.2

      Vulnerability Management Policy

      Activities
      • 4.2.1 Update the vulnerability management program policy

      This step will walk you through the following activities:

      If you have a vulnerability management policy, this activity may help augment it. Otherwise, if you don’t have one, this would be a great starting point.

      This step involves the following participants:

      • IT Security Manager
      • CISO
      • CIO
      • Human resources representative

      Outcomes of this step

      An inaugural policy covering vulnerability management

      Measure and formalize
      Step 4.1 Step 4.2 Step 4.3 Step 4.4

      Vulnerability Management Program Policy

      Policies provide governance and enforcement of processes.
      • Policies offer formal guidance on the “rules” of a program, describing its purpose, scope, detailed program description, and consequences of non-compliance. Often they will have a employee sign-off acknowledging understanding.
      • In many organizations, policies are endorsed by senior executives, which gives the policy its “teeth” across the company. The human resources department will always have input due to the implications of the non-compliance aspect.
      • Policies are written to ensure an outcome of consistent expected behavior and are often written to protect the company from liability.
      • Policies should be easy to understand and unambiguous, reflect the current state, and be enforceable. Enforceability can come in the form of audit, technology, or any other means of determining compliance and enforcing behavior.
      Stock image of a judge's gavel.

      4.2.1 Update the vulnerability management policy

      60 minutes

      Input: Vulnerability Management SOP, HR guidance on policy creation and approval

      Output: Completed Vulnerability Management Policy

      Materials: Vulnerability Management SOP, Vulnerability Management Policy Template

      Participants: IT Security Manager, IT operations management, CISO, Human resources representative

      After having built your entire process in this project, formalize it into a vulnerability management policy. This will set the standards and expectations for vulnerability management in the organization, while the process will be around the specific actions that need to be taken around vulnerability management.

      This is separate and distinct from the Vulnerability Management SOP Template, which is a process and procedure document.
      1. Review Info-Tech’s Vulnerability Management Policy and customize it to your organization’s specifications.
      2. Use your Vulnerability Management SOP as a resource when specifying some of the details within the policy.
      Sample of Info-Tech's Vulnerability Management Policy Template

      Download the Vulnerability Management Policy Template

      Step 4.3

      Select and implement a scanning tool

      Activities
      • 4.3.1 Create an RFP for vulnerability scanning tools

      This step will walk you through the following activities:

      If you need to select a new vulnerability scanning tool, or replace your existing one, this activity will help set up a request for proposal (RFP).

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • CISO

      Outcomes of this step

      The provisions needed for you to create and deploy an RFP for a vulnerability management tool.

      Measure and formalize
      Step 4.1 Step 4.2 Step 4.3 Step 4.4

      Vulnerability management and penetration testing

      Similar in nature, yet provide different security functions.

      Vulnerability Scanning Tools

      Scanning tools focus on the network and operating systems. These tools look for items such as missing patches or open ports. They won’t detect specific application vulnerabilities.

      Exploitation Tools

      These tools will look to exploit a detected vulnerability to validate it.

      Penetration Tests

      A penetration test simulates the actions of an external or internal cyber attacker that aims to breach the information security of the organization. (Formal definition of penetration test)

      ‹————— What’s the difference again? —————›
      Vulnerability scanning tools are just one type of tool. When you add an exploitation tool to the mix, you move down the spectrum. Penetration tests will use scanning tools, exploitation tools, and people.

      What is the value of each?

      • For vulnerability scans, the person performing the scan provides the value – value comes from the organization itself.
      • For exploitation tools on their own, the value comes from the tool itself being used in a safe environment.
      • For penetration tests, the tester is providing the value. They are the value add.

      What’s the implication for me?

      Info-Tech Recommends:
      • A combination of vulnerability scanning and penetration testing. This will improve your security posture through systematic risk reduction and improve your security program through the testing of prevention, detection, and response capabilities with unique recommendations being generated.
      • Start with as much vulnerability scanning as possible to identify gaps to fix and then move onto a penetration test to do a more robust and validated assessment.
      • For penetration tests, start with a transparent box test first, then move to an opaque box. Ideally, this is done with different third parties.

      Vulnerability scanning software

      All organizations can benefit from having one.

      Scanning tools will benefit areas beyond just vulnerability management

      • Network security: It improves the accuracy and granularity of your network security technologies such as WAFs, NGFWs, IDPS, and SIEM.
      • Asset management: Vulnerability scanning can identify new or unknown assets and provide current status information on assets.
      • System management: Information from a vulnerability scan supports baselining activities and determination of high-value and high-risk assets.

      Vulnerability Detection Use Case

      Most organizations use scanners to identify and assess system vulnerabilities and prioritize efforts.

      Compliance Use Case

      Others will use scanners just for compliance, auditing, or larger GRC reasons.

      Asset Discovery Use Case

      Many organizations will use scanners to perform active host and application identification.

      Scanning Tool Market Trends

      Vulnerability scanning tools have expanded value from conventional checking for vulnerabilities to supporting configuration checking, asset discovery, inventory management, patch management, SSL certificate validation, and malware detection.

      Expect to see network and system vulnerability scanners develop larger vulnerability management functions and develop exploitation tool functionality. This will become a table stakes option enabling organizations to provide higher levels of validation of detected vulnerabilities. Some tools already possess these capabilities:

      • Core Impact is an exploitation tool with vulnerability scanning aspects.
      • Metasploit is an exploitation tool with some new vulnerability scanning aspects.
      • Nessus is mainly a vulnerability scanning tool but has some exploitation aspects.

      Device proliferation (BYOD, IoT, etc.) is increasing the need for stronger vulnerability management and scanners. This is driving the need for numerous device types and platform support and the development of baseline and configuration norms to support system management.

      Increased regulatory or compliance controls are also stipulating the need for vulnerability scanning, especially by a trusted third party.

      Organizations are outsourcing security functions or moving to cloud-based deployment options for any security technology they can. Expect to see massive growth of vulnerability scanning as a service.

      Vulnerability scanning market

      There are several technology types or functional differentiators that divide the market up.

      Vulnerability Exploitation Tools

      • These will actually test defences and better emulate real life than just scanning. These tools include packet manipulation tools (such as hping) and password cracking tools (such as John the Ripper or Cain and Abel).
      • These tools will provide much more granular information on your network, operations systems, and applications.
      • The main limitation of these tools is how to use them. If you do not have development or test environments that mimic your real production environments to run the exploit tools, these tools may not be appropriate. It may work if you can find some downtime on production systems, but only in very specific and careful instances.
      • Lower maturity security programs usually just do network and application vulnerability scanning. Higher maturity programs will also use penetration testing, application testing, and vulnerability exploitation tools.
      • Network vulnerability scanning tools should always be used. Once you identify any servers or ports running web applications, then you run a web application vulnerability scanner.
      • Exploitation tools and application testing tools are used in more specific use cases that are often related to more-demanding security programs.

      Scanning Tool Market Trends

      • These are considered baseline tools and are near commoditization.
      • Vulnerability scanning tools are not granular enough to detect application-level vulnerabilities (thus the need for application scanners and testing tools) and they don’t validate the exploitability of the vulnerability (thus the need for exploit tools).

      Web Application Scanning Tools

      These tools perform dynamic application security testing (DAST) and static application security testing (SAST).

      Application Scanning and Testing Tools

      • These perform a detailed scan against an application to detect any problematic or malicious code and try to break the application using known vulnerabilities.
      • These tools will identify if something is vulnerable to an exploit but won’t actually run the exploit.
      • These tools are evaluated based on their ability to detect application-specific issues and validate them.

      Vulnerability scanning tool features

      Evaluate vulnerability scanning tools on specific features or functions that are the best differentiators.

      Differentiator

      Description

      Deployment Options Do you want a traditional on-premises, cloud-based, or managed service?
      Vulnerability Database Coverage Scanners use a library of known vulnerabilities to test for. Evaluate based on the amount of exploits/vulnerabilities the tool can scan for.
      Scanning Method Evaluate if you want agent-based, authenticated active, unauthenticated active, passive, or some combination of those scanning methods.
      Integration What is the breadth of other security and non-security technologies the tool can integrate with?
      Remediation How detailed are the recommended remediation actions? The more granular, the better.
       

      Differentiator

      Description

      Prioritization Does the tool evaluate vulnerabilities based on commonly accepted methods or through a custom-designed prioritization methodology?
      Platform Support What is the breadth of environment, application, and device support in the tool? Consider your need for virtual support, cloud support, device support, and application-specific support. Also consider how often new scanning modules are supported (e.g. how quickly Windows 10 was supported).
      Pricing As with many security controls that have been around for a long time and are commonly used, pricing becomes a main consideration, especially when there are so many open-source options available.

      Common areas people mistake as tool differentiators:

      • Accuracy – Scanning tools are evaluated more on efficiency than effectiveness. Evaluate on the ability to detect, remediate, and manage vulnerabilities rather than real vulnerability detection and the number of false positives. To reduce false positives, you need to use exploitation tools.
      • Performance – Scanning tools have such a small footprint in an environment and the actual scanning itself is such a small impact that evaluation on performance doesn’t matter.

      For more information on vulnerability scanning tools and how they rate, review the Vulnerability Management category on SoftwareReviews.

      Vulnerability scanning deployment options

      Understand the different deployment options to identify which is best for your security program.

      Option

      Description

      Pros

      Cons

      Use Cases

      On-Premises Either an on-premises appliance or an on-premises virtualized machine that performs external and internal scanning.
      • Small resource need, so limited network impact.
      • Strong internal scanning.
      • Easier integration with other technologies.
      • Network footprint and resource usage.
      • Maintenance and support costs.
      • Most common deployment option.
      • Appropriate if you have cloud concerns or strong internal network scanning, or if you require strong integration with other systems.
      Cloud Either hosted on a public cloud infrastructure or hosted by a third party and offered “as a service.”
      • Small network footprint.
      • On-demand scanning as needed.
      • Optimal external scanning capabilities.
      • Can only do edge-related scanning unless authenticated or agent based.
      • No internal network scanning with passive or unauthenticated active scanning methods.
      • Very limited network resources.
      • Compliance obligations that dictate external vulnerability scanning.
      Managed A third party is contracted to manage and maintain your vulnerability scanner so you can dedicate resources elsewhere.
      • Expert management of environment scanning, optimizing tool usage.
      • Most scanning work time is report customization and tuning and remediation efforts; thus, managed doesn’t provide sizable resource alleviation.
      • Third party has and owns the vulnerability information.
      • Limited staff resources or expertise to maintain and manage scanner.

      Vulnerability scanning methods

      Understand the different scanning methods to identify which tool best supports your needs.

      Method

      Description

      Pros

      Cons

      Use Cases

      Agent-Based Scanning Locally installed software gives the information needed to evaluate the security posture of a device.
      • Provides information that can’t be discovered remotely such as installed applications that aren’t running at a given time.
      • Device processing, memory, and network bandwidth impact.
      • Asset without an agent is not scanned.
      • Need for continuous scanning.
      • Organization has strong asset management
      Authenticated Active Scanning Tool uses authenticated credentials to log in to a device or application to perform scanning.
      • Provides information that can’t be discovered remotely such as installed applications that aren’t running at a given time.
      • Best accuracy for vulnerability detection across a network.
      • Aggregation and centralization of authenticated credentials creates a major risk.
      • All use cases.
      Unauthenticated Active Scanning Scanning of devices without any authentication.
      • Emulates realistic scan by an attacker.
      • Provides limited scope of scanning.
      • Some compliance use cases.
      • Perform after either agent or authenticated scanning.
      Passive Scanning Scanning of network traffic.
      • Lowest resource impact.
      • Not enough information can be provided for true prioritization and remediation.
      • Augmenting scanning technique to agent or authenticated scanning.

      IP Management and IPv6

      IP management and the ability to manage IPv6 is a new area for scanning tool evaluation.

      Scanning on IPv4

      Scanning tools create databases of systems and devices with IP addresses.
      Info-Tech Recommends:

      • It is easier to do discovery by directing the scanner at a set IP address or range of IP addresses; thus, it’s useful to organize your database by IPs.
      • Do discovery by phases: Start with internet-facing systems. Your perimeter usually is well-defined by IP addresses and system owners and is most open to attack.
      • Stipulate a list of your known IP addresses through the DHCP registration and perform a scan on that.
      • Depending on your IP address space, another option is to scan your entire IP address space.

      Current Problem With IP Addresses

      IP addresses are becoming no longer manageable or even owned by organizations. They are often provided by ISPs or other third parties.

      Even if it is your range, chances are you don't do static IP ranges today.

      Info-Tech Recommends:

      • Agent-based scanning or MAC address-based scanning
      • Use your DHCP for scanning

      Scanning on IPv6

      First, you need to know if your organization is moving to IPv6. IPv6 is not strategically routed yet for most organizations.

      If you are moving to IPv6, Info-Tech recommends the following:

      • Because you cannot point a scanner at an IPv6 IP range, any scanning tool needs to have a strategy around how to handle IPv6 and properly scan based on IP ranges.
      • You need to know IPv4 to IPv6 translations.
      • Evaluate vulnerability scanning tools on whether any IPv6 features are on par with IPv4 features.

      If you are already on IPv6, Info-Tech recommends the following:

      • If you are on an IPv6 native network, it is nearly impossible to scan the network. You have to always scan your known addresses from your DHCP.

      4.3.1 Create an RFP for vulnerability scanning tools

      2 hours

      Input: List of key feature requirements for the new tool, List of intersect points with current software, Network topology and layout of servers and applications

      Output: Completed RFP document that can be distributed to vendor proponents

      Materials: Whiteboard/flip charts, Vulnerability Scanning Tool RFP Template

      Participants: IT Security Manager, IT operations managers, CISO, Procurement department representative

      Use a request for proposal (RFP) template to convey your desired scanning tool requirements to vendors and outline the proposal and procurement steps set by your organization.

      1. Determine what kind of requirements will be needed for your scanning tool RFP, based on people, process, and technology requirements.
      2. Consider items such as the desired capabilities and the scope of the scanning.
      3. Conduct interviews with relevant stakeholders to determine the exact requirements needed.
      4. Use Info-Tech’s Vulnerability Scanning Tool RFP Template. It lists many requirements but can be customized to your organization’s specific needs.

      Download the Vulnerability Scanning Tool RFP Template

      4.3.1 Create an RFP for vulnerability scanning tools (continued)

      Things to Consider:
      • Ensure there is adequate resource dedication to support and maintenance for vulnerability scanning.
      • Consider if you will benefit from an RFP. If there is a more appropriate option for your need and your organization, consider that instead.
      • If you don’t know the product you want, then perform an RFI.
      • In the RFP, you need to express your driving needs for the tool so the vendor can best understand your use case.
      • Identify who should participate in the RFP creation and evaluation. Make sure they have time available and it does not conflict with other items.
      • Determine if you want to send it to a select few or if you want to send it to a lot of vendors.
      • Determine a response date so you can know who is soliciting your business.
      • You need to have a process to handle questions from vendors.
      Info-Tech RFP Table of Contents:
      1. Statement of Work
      2. General Information
      3. Proposal Preparation Instructions
      4. Scope of Work, Specifications, and Requirements
      5. Vendor Qualifications and References
      6. Budget and Estimated Pricing
      7. Vendor Certification

      Download the Vulnerability Scanning Tool RFP Template

      Step 4.4

      Penetration testing

      Activities
      • 4.1.1 Create an RFP for penetration tests

      This step will walk you through the following activities:

      We will review penetration testing, its distinction from vulnerability management, and why you may want to engage a penetration testing service.

      We provide a request for proposal (RFP) template that we can review if this is an area of interest.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • CISO
      • CIO

      Outcomes of this step

      An understanding of penetration testing, and guidance on how to get started if there is interest to do so.

      Measure and formalize
      Step 4.1 Step 4.2 Step 4.3 Step 4.4

      Penetration testing

      Penetration tests are critical parts of any strong security program.

      Penetration testing will emulate the methods an attacker would use in the real world to circumvent your security controls and gain access to systems and data.

      Penetration testing is much more than just running a scanner or other automated tools and then generating a report. Penetration testing performs critical exploit validation to create certainty around your vulnerability.

      The primary objective of a penetration test is to identify and validate security weaknesses in an organization’s security systems.

      Reasons to Test:

      • Assess current security control effectiveness
      • Develop an action plan of items
      • Build a business case for a better security program
      • Increased security budget through vulnerability validation
      • Third-party, unbiased validation
      • Adhere to compliance or regulatory requirements
      • Raise security awareness
      • Demonstrate how an attacker can escalate privileges
      • Effective way to test incident response

      Regulatory Considerations:

      • There is a lot of regulatory wording saying that organizations can’t get a system that is managed, integrated, and supported by one vendor and then have it tested by the same vendor.
      • There is the need for separate third-party testing.
      • Penetration testing is required for PCI, cloud providers, and federal entities.

      How and where is the value being generated?

      Penetration testing is a service provided by trained and tested professionals with years of experience. The person behind the test is the most important part of the test. The person is able to emulate a real-life attacker better than any computer. It is just a vulnerability scan if you use tools or executables alone.

      “A penetration test is an audit with validation.” (Joel Shapiro, Vice President Sales, Digital Boundary Group)

      Start by considering the spectrum of penetration tests

      Network Penetration Tests

      Conventional testing of network defences.

      Testing vectors include:

      • Perimeter infrastructure
      • Wireless, WEP/WPA cracking
      • Cloud penetration testing
      • Telephony systems or VoIP
      Types of tests:
      • Denial-of-service testing
      • Out-of-band attacks
      • War dialing
      • Wireless network testing/war driving
      • Spoofing
      • Trojan attacks
      • Brute force attacks
      • Watering hole attacks
      • Honeypots
      • Cloud-penetration testing
      Application Penetration Tests

      Core business functions are now being provided through web applications, either to external customers or to internal end users.

      Types: Web apps, non-web apps, mobile apps

      Application penetration and security testing encompasses:

      • Code review – analyzing the application code for sensitive information of vulnerabilities in the code.
      • Authorization testing – testing systems responsible for user session management to see if unauthorized access can be permitted.
      • Authentication process for user testing.
      • Functionality testing – test the application functionality itself.
      • Website pen testing – active analysis of weaknesses or vulnerabilities.
      • Encryption testing – testing things like randomness or key strength.
      • User-session integrity testing.
      Human-Centric Testing
      • Penetration testing is developing a people aspect as opposed to just being technology focused.
      • End users and their susceptibility to social engineering attacks (spear phishing, phone calls, physical site testing, etc.) is now a common area to test.
      • Social engineering penetration testing is not only about identifying your human vulnerabilities, but also about proactively training your end users. As well as discovering and fixing potential vulnerabilities, social engineering penetration testing will help to raise security awareness within an organization.

      Info-Tech Insight

      Your pen test should use multiple methods. Demonstrating weakness in one area is good but easy to identify. When you blend techniques, you get better success at breaching and it becomes more life-like. Think about prevention, detection, and response testing to provide full insight into your security defenses.

      Penetration testing types

      Evaluate four variables to determine which type of penetration test is most appropriate for your organization.

      Evaluate these dimensions to determine relevant penetration testing.

      Network, Application, or Human

      Evaluate your need to perform different types of penetration testing.

      Some level of network and application testing is most likely appropriate.

      The more common decision point is to consider to what degree your organization requires human-centric penetration testing.

      External or Internal

      External: Attacking an organization’s perimeter and internet-facing systems. For these, you generally provide some level of information to the tester. The test will begin with publicly available information gathering followed by some kind of network scanning or probing against externally visible servers or devices (DNS server, email server, web server, firewall, etc.)

      Internal: Carried out within the organization’s network. This emulates an attack originating from an internal point (disgruntled employee, authorized user, etc.). The idea is to see what could happen if the perimeter is breached.

      Transparent, Semi-Transparent, or Opaque Box

      Opaque Box: The penetration tester is not provided any information. This emulates a real-life attack. Test team uses publicly available information (corporate website, DNS, USENET, etc.) to start the test. These tests are more time consuming and expensive. They often result in exploitation of the easiest vulnerability.
      Use cases: emulating a real-life attack; testing detection and response capabilities; limited network segmentation.

      Transparent Box: Tester is provided full disclosure of information. The tester will have access to everything they need: building floor plans, data flow designs, network topology, etc. This represents what a credentialed and knowledgeable insider would do.
      Use cases: full assessment of security controls; testing of attacker traversal capabilities.

      Aggressiveness of the Test

      Not Aggressive: Very slow and careful penetration testing. Usually spread out in terms of packets being sent and number of calls to individuals. It attempts to not set off any alarm bells.

      Aggressive: A full DoS attack or something similar. These would be DoS attacks that take down systems or full SQL injection attacks all at once versus small injections over time. Testing options cover anything including physical tests, network tests, social engineering, and data extraction and exfiltration. This is more costly and time consuming.

      Assessing Aggressiveness: How aggressive the test should be is based on the threats you are concerned with. Assess who you are concerned with: random individuals on the internet, state-sponsored attacks, criminals, hacktivists, etc. Who you are concerned with will determine the appropriate aggressiveness of the test.

      Penetration testing scope

      Establish the scope of your penetration test before engaging vendors.

      Determining the scope of what is being tested is the most important part of a penetration test. Organizations need to be as specific as possible so the vendor can actually respond or ask questions.

      Organizations need to define boundaries, objectives, and key success factors.

      For scope:
      • If you go too narrow, the realism of the test suffers.
      • If you go too broad, it is more costly and there’s a possible increase in false positives.
      • Balance scope vs. budget.
      Boundaries to scope before a test:
      • IP addresses
      • URLs
      • Applications
      • Who is in scope for social engineering
      • Physical access from roof to dumpsters defined
      • Scope prioritized for high-value assets
      Objectives and key success factors to scope:
      • When is the test complete? Is it at the point of validated exploitation?
      • Are you looking for as many holes as possible, or are you looking for how many ways each hole can be exploited?

      What would be out of scope?

      • Are there systems, IP addresses, or other things you want out of scope? These are things you don’t explicitly want any penetration tester to touch.
      • Are there third-party connections to your environment that you don’t want to be tested? These are instances such as cloud providers, supply chain connections, and various services.
      • Are there things that would be awkward to test? For example, determine if you include high-level people in a social engineering test. Do you conduct social engineering for the CEO? If you get their credentials, it could be an awkward moment.

      Ways to break up a penetration test:

      • Location – This is the most common way to break up a penetration test.
      • Division – Self-contained business units are often done as separate tests so you can see how each unit does.
      • IT systems – For example, you put certain security controls in a firewall and want to test its effectiveness.
      • Applications – For example, you are launching a new website or a new portal and you want to test it.

      Penetration testing appropriateness

      Determine your penetration testing appropriateness.

      Usual instances to conduct a penetration test:
      • Setting up a new physical office. Penetration testing will not only test security capabilities but also resource availability and map out network flows.
      • New infrastructure hardware implemented. All new infrastructure needs to be tested.
      • Changes or upgrades to existing infrastructure. Need for testing varies depending on the size of the change.
      • New application deployment. Need to test before being pushed to production environments.
      • Changes or upgrades to existing applications. When fundamental functional changes occur, perform testing:
        • Before upgrades or patching
        • After upgrades or patching
      • Periodic testing. It is a best practice to periodically test your security control effectiveness. Consider at least an annual test.

      Specific timing considerations: Testing should be completed during non-production times of day. Testing should be completed after a backup has been performed.

      Assess your threats to determine your appropriate test type:

      Penetration testing is about what threats you are concerned about. Understand your risk profile, risk tolerance level, and specific threats to see how relevant penetration tests are.

      • Are external attackers concerning to you? Are you distressed about how an attacker can use brute force to enter your network? If so, focus on ingress points, such as FWs, routers, and DMZ.
      • Is social engineering a concern for you (i.e. phone-based or email-based)? Then you are concerned about a credentialed hacker.
      • Is it an insider threat, a disgruntled employee, etc.? This also includes an internal system that is under command and control (C&C).

      ANALYST PERSPECTIVE: Do a test only after you take a first pass.
      If you have not done some level of vulnerability assessment on your own (performing a scan, checking third-party sources, etc.) don’t waste your money on a penetration test. Only perform a penetration test after you have done a first pass and identified and remediated all the low-hanging fruit.

      4.4.1 Create an RFP for penetration tests

      2 hours

      Input: List of criteria and scope for the penetration test, Systems and application information if white box

      Output: Completed RFP document that can be distributed to vendor proponents

      Materials: Whiteboard/flip charts, Penetration Test RFP Template

      Participants: IT Security Manager, IT operations managers, CISO, Procurement department representative

      Use an RFP template to convey your desired penetration test requirements to vendors and outline the proposal and procurement steps set by your organization.

      1. Determine what kind of requirements will be needed for your penetration test RFP based on people, process, and technology requirements.
        • Consider items such as your technology environment and the scope of the penetration tests.
      2. Conduct an interview with relevant stakeholders to determine the exact requirements needed.
      3. Use Info-Tech’s Penetration Test RFP Template, which lists many requirements but can be customized to your organization’s specific needs.

      Download the Penetration Test RFP Template

      4.4.1 Create an RFP for penetration tests (continued)

      Steps of a penetration test:
      1. Determine scope
      2. Gather targeted intelligence
      3. Review exploit attempts, such as access and escalation
      4. Test the collection of sensitive data
      5. Run reporting
      Info-Tech RFP Table of Contents:
      1. Statement of Work
      2. General Information
      3. Proposal Preparation Instructions
      4. Scope of Work, Specifications, and Requirements
      5. Vendor Qualifications and References
      6. Budget and Estimated Pricing
      7. Vendor Certification

      Download the Penetration Test RFP Template

      Penetration testing considerations – service providers

      Consider what type of penetration testing service provider is best for your organization

      Professional Service Providers

      Professional Services Firms. These firms will often provide a myriad of professional services across auditing, financial, and consulting services. If they offer security-related consulting services, they will most likely offer some level of penetration testing.

      Security Service Firms. These are dedicated security consulting or advisory firms that will offer a wide spectrum of security-related services. Penetration testing may be one aspect of larger security assessments and strategy development services.

      Dedicated Penetration Testing Firms. These are service providers that will often offer the full gamut of penetration testing services.

      Integrators

      Managed Security Service Providers. These providers will offer penetration testing. For example, Dell SecureWorks offers numerous services including penetration testing. For organizations like this, you need to be skeptical of ulterior motives. For example, expect recommendations around outsourcing from Dell SecureWorks.

      Regional or Small Integrators. These are service providers that provide security services of some kind. For example, they would help in the implementation of a firewall and offer penetration testing services as well.

      Info-Tech Recommends:

      • Always be conscientious of who is conducting the testing and what else they offer. Even if you get another party to test rather than your technology provider, they will try to obtain you as a client. Remember that for larger technology vendors, security testing is a small revenue stream for them and it’s a way to find technology clients. They may offer penetration testing for free to obtain other business.
      • Most of the penetration testers were systems administrators (for network testing) or application developers (for application testing) at some point before becoming penetration testers. Remember this when evaluating providers and evaluating remediation recommendations.
      • Evaluate what kind of open-source tools, commercial tools, and proprietary tools are being used. In general, you don’t want to rely on an open-source scanner. For open source, they will have more outdated vulnerability databases, system identification can also be limited compared to commercial, and reporting is often lacking.
      • Above all else, ensure your testers are legally capable, experienced, and abide by non-disclosure agreements.

      Penetration testing best practices – communications

      Communication With Service Provider

      • During testing there should be designated points of contact between the service provider and the client.
      • There needs to be secure channels for communication of information between the tester and the client both during the test and for any results.
      • Results should always be explained to the client by the tester, regardless of the content or audience.
      • There should be a formal debrief with the results report.
      Immediate reporting of issues
      • Before any testing commences, immediate reporting conditions need to be defined. These are instances when you would want immediate notification of something occurring.
      • Stipulate certain systems or data types that if broken into or compromised, you would want to be notified right away.
      • Example:
        • If you are conducting social engineering, require notification for all account credentials that are compromised. Once credentials are compromised, it destroys all accountability for those credentials and the actions associated with those credentials by any user.
        • Require immediate reporting of specific high-critical systems that are compromised or if access is even found.
        • Require immediate reporting when regulated data is discovered or compromised in any way.

      Communication With Internal Staff

      Do you tell your internal staff that this is happening?

      This is sometimes called a “double blind test” when you don’t let your IT team know of the test occurring.

      Pros to notifying:
      • This tests the organization’s security monitoring, incident detection, and response capabilities.
      • Letting the team know they are going to see some activity will make sure they don’t get too worried about it.
      • There may be systems you can’t jeopardize but still need to test so notification beforehand is essential (e.g. you wouldn’t allow ERP testing with notification).
      Cons:
      • It does not give you a real-life example of how you respond if something happens.
      • Potential element of disrespect to IT people.

      Penetration testing best practices – results and remediation

      What to expect from penetration test results report:

      A final results report will state all findings including what was done by the testers, what vulnerabilities or exploitations were detected, how they were compromised, the related risk, and related remediation recommendations.

      Expect four major sections:
      • Introduction. An overview of the penetration test methodology including rating methodology of vulnerabilities.
      • Executive Summary. A management-level description of the test, often including a summary of any recommendations.
      • Technical Review. An overview of each item that was looked at and touched. This area breaks down what was done, how it was done, what was found, and any related remediation recommendations. Expect graphs and visuals in this section.
      • Detailed Findings. An in-depth breakdown of all testing methods used and results. Each vulnerability will be explained regarding how it was detected, what the risk is, and what the remediation recommendation is.
      Two areas that will vary by service provider:

      Prioritization

      • Most providers will boast their unique prioritization methodology.
      • A high, medium, and low rating scale based on some combination of variables (e.g. ease of exploitation, breadth of hole, information accessed resulting in further exploitation).
      • The prioritization won’t take into account asset value or criticality.
      • Keep in mind the penetration test is not an input into ultimate vulnerability prioritization, but it can help determine your urgency.

      Remediation

      • Remediation recommendations will vary across providers.
      • Generally, fairly generic recommendations are provided (e.g. remove your old telnet and input up-to-date SSH).
      • Most of the time, it is along the lines of “we found a hole; close the hole.”

      Summary of Accomplishment

      Problem Solved

      At the conclusion of this blueprint, you will have created a full vulnerability management program that will allow you to take a risk-based approach to vulnerability remediation.

      Assessing a vulnerability’s risk will enable you to properly determine the true urgency of a vulnerability within the context of your organization; this ensures you are not just blindly following what the tool is reporting.

      The risk-based approach will allow you to prioritize your discovered vulnerabilities and take immediate action on critical and high vulnerabilities while allowing your standard remediation cycle to address the medium to low vulnerabilities.

      With your program defined and developed, you now need to configure your vulnerability scanning tool or acquire one if you don’t already have a tool in place.

      Lastly, while vulnerability management will help address your systems and applications, how do you know if you are secure from external malicious actors? Penetration testing will offer visibility, allowing you to plug those holes and attain an environment with a smaller risk surface.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      Additional Support

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Photo of Jimmy Tom.

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

      Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      Sample of the Implement Vulnerability Management storyboard.
      Review of the Implement Vulnerability Management storyboard
      Sample of the Vulnerability Mitigation SOP template.
      Build your vulnerability management SOP

      Contributors

      Contributors from 2016 version of this project:

      • Morey Haber, Vice President of Technology, BeyondTrust
      • Richard Barretto, Manager, Information Privacy and Security, Cimpress
      • Joel Shapiro, Vice President Sales, Digital Boundary Group

      Contributors from current version of this project:

      • 2 anonymous contributors from the manufacturing sector
      • 1 anonymous contributor from a US government agency
      • 2 anonymous contributors from the financial sector
      • 1 anonymous contributor from the medical technology industry
      • 2 anonymous contributors from higher education
      • 1 anonymous contributor from a Canadian government agency
      • 7 anonymous others; information gathered from advisory calls

      Bibliography

      Arya. “COVID-19 Impact: Vulnerability Management Solution Market | Strategic Industry Evolutionary Analysis Focus on Leading Key Players and Revenue Growth Analysis by Forecast To 2028 – FireMon, Digital Shadows, AlienVault.” Bulletin Line, 6 Aug. 2020. Accessed 6 Aug. 2020.

      Campagna, Rich. “The Lean, Mean Vulnerability Management Machine.” Security Boulevard, 31 Mar. 2020. Accessed 15 Aug. 2020.

      Constantin, Lucian. “What are vulnerability scanners and how do they work?” CSO Online, 10 Apr. 2020. Accessed 1 Sept. 2020.

      “CVE security vulnerabilities published in 2019.” CVE Details. Accessed 22 Sept. 2020.

      Garden, Paul, et al. “2019 Year End Report – Vulnerability QuickView.” Risk Based Security, 2020. Accessed 22 Sept. 2020.

      Keary, Eoin. “2019 Vulnerability Statistics Report.” Edgescan, Feb. 2019. Accessed 22 Sept. 2020.

      Lefkowitz, Josh. ““Risk-Based Vulnerability Management is a Must for Security & Compliance.” SecurityWeek, 1 July 2019. Accessed 1 Nov. 2020.

      Mell, Peter, Tiffany Bergeron, and David Henning. “Creating a Patch and Vulnerability Management Program.” Creating a Patch and Vulnerability Management Program. NIST, Nov. 2005. Web.

      “National Vulnerability Database.” NIST. Accessed 18 Oct. 2020.

      “OpenVAS – Open Vulnerability Assessment Scanner.” OpenVAS. Accessed 14 Sept. 2020.

      “OVAL.” OVAL. Accessed 21 Oct. 2020.

      Paganini, Pierluigi. “Exploiting and Verifying Shellshock: CVE-2014-6271.” INFOSEC, 27 Sept. 2014. Web.

      Pritha. “Top 10 Metrics for your Vulnerability Management Program.” CISO Platform, 28 Nov. 2019. Accessed 25 Oct. 2020.

      “Risk-Based Vulnerability Management: Understanding Vulnerability Risk With Threat Context And Business Impact.” Tenable. Accessed 21 Oct. 2020.

      Stone, Mark. “Shellshock In-Depth: Why This Old Vulnerability Won’t Go Away.” SecurityIntelligence, 6 Aug. 2020. Web.

      “The Role of Threat Intelligence in Vulnerability Management.” NOPSEC, 18 Sept. 2014. Accessed 18 Aug. 2020.

      “Top 15 Paid and Free Vulnerability Scanner Tools in 2020.” DNSstuff, 6 Jan. 2020. Accessed 15 Sept. 2020.

      Truta, Filip. “60% of Breaches in 2019 Involved Unpatched Vulnerabilities.” Security Boulevard, 31 Oct. 2019. Accessed 2 Nov. 2020.

      “Vulnerability Management Program.” Core Security. Accessed 15 Sept. 2020.

      “What is Risk-Based Vulnerability Management?” Balbix. Accessed 15 Sept. 2020.

      White, Monica. “The Cost Savings of Effective Vulnerability Management (Part 1).” Kenna Security, 23 April 2020. Accessed 20 Sept. 2020.

      Wilczek, Marc. “Average Cost of a Data Breach in 2020: $3.86M.” Dark Reading, 24 Aug. 2020. Accessed 5 Nov 2020.

      Measure and Manage Customer Satisfaction Metrics That Matter the Most

      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Marketing Solutions
      • Parent Category Link: /marketing-solutions
      • Lack of understanding of what is truly driving customer satisfaction or dissatisfaction.
      • Lack of insight into who our satisfied and dissatisfied customers are.
      • Lack of a system for early detection of declines in satisfaction.
      • Lack of clarity on what to improve and how resources should be allocated.

      Our Advice

      Critical Insight

      • All software companies measure satisfaction in some way, but many lack understanding of what’s truly driving customers to stay or leave. By understanding the true drivers of satisfaction, solution providers can measure and monitor satisfaction more effectively, pull actionable insights and feedback, and make changes to products and services that customers really care about and will keep them coming back to you to have their needs met.
      • Obstacles:
        • Use of metrics that don’t provide the insight needed to make impactful changes that will boost satisfaction and ultimately, retention and profit.
        • Lack of a clear definition of what satisfaction means to customers, metric definitions and/or standard methods of measurement, and a consistent monitoring cadence.

      Impact and Result

      • Understanding of who your satisfied and dissatisfied customers are.
      • Understanding of the true drivers of satisfaction and dissatisfaction among your customer segments.
      • Establishment of a repeatable process and cadence for effective satisfaction measurement and monitoring.
      • Development of an executable customer satisfaction improvement plan that identifies customer journey pain points and areas of dissatisfaction, and outlines how to improve them.
      • Knowledge of where money, time, and other resources are needed most to improve satisfaction levels and ultimately increase retention.

      Measure and Manage Customer Satisfaction Metrics That Matter the Most Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Measure and Manage the Customer Satisfaction Metrics that Matter the Most Deck – An overview of how to understand what drives customer satisfaction and how to measure and manage it for improved business outcomes.

      Understand the true drivers of customer satisfaction and build a process for managing and improving customer satisfaction.

      [infographic]

      Further reading

      Measure and Manage the Customer Satisfaction Metrics that Matter the Most

      Understand what truly keeps your customer satisfied. Start to measure what matters to improve customer experience and increase satisfaction and advocacy. 

      EXECUTIVE BRIEF

      Analyst perspective

      Understanding and measuring the true drivers of satisfaction enable the delivery of real customer value

      The image contains a picture of Emily Wright.

      “Healthy customer relationships are the paramount to long-term growth. When customers are satisfied, they remain loyal, spend more, and promote your company to others in their network. The key to high satisfaction is understanding and measuring the true drivers of satisfaction to enable the delivery of real customer value.

      Most companies believe they know who their satisfied customers are and what keeps them satisfied, and 76% of B2B buyers expect that providers understand their unique needs (Salesforce Research, 2020). However, on average B2B companies have customer experience scores of less than 50% (McKinsey, 2016). This disconnect between customer expectations and provider experience indicates that businesses are not effectively measuring and monitoring satisfaction and therefore are not making meaningful enhancements to their service, offerings, and overall experience.

      By focusing on the underlying drivers of customer satisfaction, organizations develop a truly accurate picture of what is driving deep satisfaction and loyalty, ensuring that their company will achieve sustainable growth and stay competitive in a highly competitive market.”

      Emily Wright

      Senior Research Analyst, Advisory

      SoftwareReviews

      Executive summary

      Your Challenge

      Common Obstacles

      SoftwareReviews’ Approach

      Getting a truly accurate picture of satisfaction levels among customers, and where to focus efforts to improve satisfaction, is challenging. Providers often find themselves reacting to customer challenges and being blindsided when customers leave. More effective customer satisfaction measurement is possible when providers self-assess for the following challenges:

      • Lack of understanding of what is truly driving customer satisfaction or dissatisfaction.
      • Lack of insight into who our satisfied and dissatisfied customers are.
      • Lack of a system for early detection of declines in satisfaction.
      • Lack of clarity of what needs to be improved and how resources should be allocated.
      • Lack of reliable internal data for effective customer satisfaction monitoring.

      What separates customer success leaders from developing a full view of their customers are several nagging obstacles:

      • Use of metrics that don’t provide the insight needed to make impactful changes that will boost satisfaction and ultimately, retention and profit.
      • Friction from customers participating in customer satisfaction studies.
      • Lack of data, or integrated databases from which to track, pull, and analyze customer satisfaction data.
      • Lack a clear definition of what satisfaction means to customers, metric definitions, and/or standard methods of measurement and a consistent monitoring cadence.
      • Lack of time, resources, or technology to uncover and effectively measure and monitor satisfaction drivers.

      Through the SoftwareReviews’ approach, customer success leaders will:

      • Understand who your satisfied and dissatisfied customers are.
      • Understand the true drivers of satisfaction and dissatisfaction among your customer segments.
      • Establish a repeatable process and cadence for effective satisfaction measurement and monitoring.
      • Develop an executable customer satisfaction improvement plan that identifies customer journey pain points and areas of dissatisfaction, and outlines how to improve them.
      • Know where money, time, and resources are needed most to improve satisfaction levels and ultimately retention.

      Overarching SoftwareReviews Advisory Insight:

      All companies measure satisfaction in some way, but many lack understanding of what’s truly driving customers to stay or leave. By understanding the true drivers of satisfaction, solution providers can measure and monitor satisfaction more effectively, pull actionable insights and feedback, and make changes to products and services that customers really care about. This will keep them coming back to you to have their needs met.

      Healthy Customer Relationships are vital for long-term success and growth

      Measuring customer satisfaction is critical to understanding the overall health of your customer relationships and driving growth.

      Through effective customer satisfaction measurement, organizations can:

      Improve Customer Experience

      Increase Retention and CLV

      Increase Profitability

      Reduce Costs

      • Provide insight into where and how to improve.
      • Enhance experience, increase loyalty.
      • By providing strong CX, organizations can increase revenue by 10-15% (McKinsey, 2014).
      • Far easier to retain existing customers than to acquire new ones.
      • Ensuring high satisfaction among customers increases Customer Lifetime Value (CLV) through longer tenure and higher spending.
      • NPS Promoter score has a customer lifetime value that's 600%-1,400% higher than a Detractor (Bain & Company, 2015).
      • Highly satisfied customers spend more through expansions and add-ons, as well as through their long tenure with your company.
      • They also spread positive word of mouth, which brings in new customers.
      • “Studies demonstrate a strong correlation between customer satisfaction and increased profits — with companies with high customer satisfaction reporting 5.7 times more revenue than competitors.” (Matthew Loper, CEO and Co-Founder of WELLTH, 2022)
      • Measuring, monitoring, and maintaining high satisfaction levels reduces costs across the board.
      • “Providing a high-quality customer experience can save up to 33% of customer service costs” (Deloitte, 2018).
      • Satisfied customers are more likely to spread positive word of mouth which reduces acquisition / marketing costs for your company.

      “Measuring customer satisfaction is vital for growth in any organization; it provides insights into what works and offers opportunities for optimization. Customer satisfaction is essential for improving loyalty rate, reducing costs and retaining your customers.”

      -Ken Brisco, NICE, 2019

      Poor customer satisfaction measurement is costly

      Virtually all companies measure customer satisfaction, but few truly do it well. All too often, customer satisfaction measurement consists of a set of vanity metrics that do not result in actionable insight for product/service improvement. Improper measurement can result in numerous consequences:

      Direct and Indirect Costs

      Being unaware of true drivers of satisfaction that are never remedied costs your business directly through customer churn, service costs, etc.

      Tarnished Brand

      Tarnished brand through not resolving issues drives dissatisfaction; dissatisfied customers share their negative experiences, which can damage brand image and reputation.

      Waste Limited Resources

      Putting limited resources towards vanity programs and/or fixes that have little to no bearing on core satisfaction drivers wastes time and money.

      “When customer dissatisfaction goes unnoticed, it can slowly kill a company. Because of the intangible nature of customer dissatisfaction, managers regularly underestimate the magnitude of customer dissatisfaction and its impact on the bottom line.”

      - Lakshmiu Tatikonda, “The Hidden Costs of Customer Dissatisfaction”, 2013

      SoftwareReviews Advisory Insight:

      Most companies struggle to understand what’s truly driving customers to stay or leave. By understanding the true satisfaction drivers, tech providers can measure and monitor satisfaction more effectively, avoiding the numerous harmful consequences that result from average customer satisfaction measurement.

      Does your customer satisfaction measurement process need improvement?

      Getting an accurate picture of customer satisfaction is no easy task. Struggling with any of the following means you are ready for a detailed review of your customer satisfaction measurement efforts:

      • Not knowing who your most satisfied customers are.
      • Lacking early detection for declining satisfaction – either reactive, or unaware of dissatisfaction as it’s occurring.
      • Lacking a process for monitoring changes in satisfaction and lack ability to be proactive; you feel blindsided when customers leave.
      • Inability to fix the problem and wasting money on the wrong areas, like vanity metrics that don’t bring value to customers.
      • Spending money and other resources towards fixes based on a gut feeling, without quantifying the real root cause drivers and investing in their improvement.
      • Having metrics and data but lacking context; don’t know what contributed to the metrics/results, why people are dissatisfied or what contributes to satisfaction.
      • Lacking clear definition of what satisfaction means to customers / customer segments.
      • Difficulty tying satisfaction back to financial results.

      Customers are more satisfied with software vendors who understand the difference between surface level and short-term satisfaction, and deep or long-term satisfaction

      Surface-level satisfaction

      Surface-level satisfaction has immediate effects, but they are usually short-term or limited to certain groups of users. There are several factors that contribute to satisfaction including:

      • Novelty of new software
      • Ease of implementation
      • Financial savings
      • Breadth of features

      Software Leaders Drive Deep Satisfaction

      Deep satisfaction has long-term and meaningful impacts on the way that organizations work. Deep satisfaction has staying power and increases or maintains satisfaction over time, by reducing complexity and delivering exceptional quality for end-users and IT alike. This report found that the following capabilities provided the deepest levels of satisfaction:

      • Usability and intuitiveness
      • Quality of features
      • Ease of customization
      • Vendor-specific capabilities

      The above solve issues that are part of everyday problems, and each drives satisfaction in deep and meaningful ways. While surface-level satisfaction is important, deep and impactful capabilities can sustain satisfaction for a longer time.

      Deep Customer Satisfaction Among Software Buyers Correlates Highly to “Emotional Attributes”

      Vendor Capabilities and Product Features remain significant but are not the primary drivers

      The image contains a graph to demonstrate a correlation to Satisfaction, all Software Categories.
      Source: SoftwareReviews buyer reviews (based on 82,560 unique reviews).

      Driving deep satisfaction among software customers vs. surface-level measures is key

      Vendor capabilities and product features correlate significantly to buyer satisfaction

      Yet, it’s the emotional attributes – what we call the “Emotional Footprint”, that correlate more strongly

      Business-Value Created and Emotional Attributes are what drives software customer satisfaction the most

      The image contains a screenshot of a graph to demonstrate Software Buyer Satisfaction Drivers and Emotional Attributes are what drives software customer satisfaction.

      Software companies looking to improve customer satisfaction will focus on business value created and the Emotional Footprint attributes outlined here.

      The essential ingredient is understanding how each is defined by your customers.

      Leaders focus on driving improvements as described by customers.

      SoftwareReviews Insight:

      These true drivers of satisfaction should be considered in your customer satisfaction measurement and monitoring efforts. The experience customers have with your product and brand is what will differentiate your brand from competitors, and ultimately, power business growth. Talk to a SoftwareReviews Advisor to learn how users rate your product on these satisfaction drivers in the SoftwareReviews Emotional Footprint Report.

      Benefits of Effective Customer Satisfaction Measurement

      Our research provides Customer Success leaders with the following key benefits:

      • Ability to know who is satisfied, dissatisfied, and why.
      • Confidence in how to understand or uncover the factors behind customer satisfaction; understand and identify factors driving satisfaction, dissatisfaction.
      • Ability to develop a clear plan for improving customer satisfaction.
      • Knowledge of how to establish a repeatable process for customer satisfaction measurement and monitoring that allows for proactivity when declines in satisfaction are detected.
      • Understanding of what metrics to use, how to measure them, and where to find the right information/data.
      • Knowledge of where money, time, and other resources are needed most to drive tangible customer value.

      “81% of organizations cite CX as a competitive differentiator. The top factor driving digital transformation is improving CX […] with companies reporting benefits associated with improving CX including:

      • Increased customer loyalty (92%)
      • An uplift in revenue (84%)
      • Cost savings (79%).”

      – Dan Cote, “Advocacy Blooms and Business Booms When Customers and Employees Engage”, Influitive, 2021

      The image contains a screenshot of a thought model that focuses on Measure & Manage the Customer Satisfaction Metrics That Matter the Most.

      Who benefits from improving the measurement and monitoring of customer satisfaction?

      This Research Is Designed for:

      • Customer Success leaders and marketers who are:
        • Responsible for understanding how to benchmark, measure, and understand customer satisfaction to improve satisfaction, NPS, and ROI.
        • Looking to take a more proactive and structured approach to customer satisfaction measurement and monitoring.
        • Looking for a more effective and accurate way to measure and understand how to improve customer satisfaction around products and services.

      This Research Will Help You:

      • Understand the factors driving satisfaction and dissatisfaction.
      • Know which customers are satisfied/dissatisfied.
      • Know where time, money, and resources are needed the most in order to improve or maintain satisfaction levels.
      • Develop a formal plan to improve customer satisfaction.
      • Establish a repeatable process for customer satisfaction measurement and monitoring that allows for proactivity when declines in satisfaction are detected.

      This Research Will Also Assist:

      • Customer Success Leaders, Marketing and Sales Directors and Managers, Product Marketing Managers, and Advocacy Managers/Coordinators who are responsible for:
        • Product improvements and enhancements
        • Customer service and onboarding
        • Customer advocacy programs
        • Referral/VoC programs

      This Research Will Help Them:

      • Coordinate and align on customer experience efforts and actions.
      • Gather and make use of customer feedback to improve products, solutions, and services provided.
      • Provide an amazing customer experience throughout the entirety of the customer journey.

      SoftwareReviews’ methodology for measuring the customer satisfaction metrics that matter the most

      1. Identify true customer satisfaction drivers

      2. Develop metrics dashboard

      3. Develop customer satisfaction measurement and management plan

      Phase Steps

      1. Identify data sources, documenting any gaps in data
      2. Analyze all relevant data on customer experiences and outcomes
      3. Document top satisfaction drivers
      1. Identify business goals, problems to be solved / define business challenges and marketing/customer success goals
      2. Use SR diagnostic to assess current state of satisfaction measurement, assessing metric alignment to satisfaction drivers
      3. Define your metrics dashboard
      4. Develop common metric definitions, language for discussing, and standards for measuring customer satisfaction
      1. Determine committee structure to measure performance metrics over time
      2. Map out gaps in satisfaction along customer journey/common points in journey where customers are least dissatisfied
      3. Build plan that identifies weak areas and shows how to fix using SR’s emotional footprint, other measures
      4. Create plan and roadmap for CSat improvement
      5. Create communication deck

      Phase Outcomes

      1. Documented satisfaction drivers
      2. Documented data sources and gaps in data
      1. Current state customer satisfaction measurement analysis
      2. Common metric definitions and measurement standards
      3. Metrics dashboard
      1. Customer satisfaction measurement plan
      2. Customer satisfaction improvement plan
      3. Customer journey maps
      4. Customer satisfaction improvement communication deck
      5. Customer Satisfaction Committee created

      Insight summary

      Understanding and measuring the true drivers of satisfaction enable the delivery of real customer value

      All software companies measure satisfaction in some way, but many lack understanding of what’s truly driving customers to stay or leave. By understanding the true drivers of satisfaction, solution providers can measure and monitor satisfaction more effectively, pull actionable insights and feedback, and make changes to products and services that customers really care about and which will keep them coming back to you to have their needs met.

      Positive experiences drive satisfaction more so than features and cost

      According to our analysis of software buyer reviews data*, the biggest drivers of satisfaction and likeliness to recommend are the positive experiences customers have with vendors and their products. Customers want to feel that:

      1. Their productivity and performance is enhanced, and the vendor is helping them innovate and grow as a company.
      2. Their vendor inspires them and helps them to continually improve.
      3. They can rely on the vendor and the product they purchased.
      4. They are respected by the vendor.
      5. They can trust that the vendor will be on their side and save them time.
      *8 million data points across all software categories

      Measure Key Relationship KPIs to gauge satisfaction

      Key metrics to track include the Business Value Created score, Net Emotional Footprint, and the Love/Hate score (the strength of emotional connection).

      Orient the organization around customer experience excellence

      1. Arrange staff incentives around customer value instead of metrics that are unrelated to satisfaction.
      2. Embed customer experience as a core company value and integrate it into all functions.
      3. Make working with your organization easy and seamless for customers.

      Have a designated committee for customer satisfaction measurement

      Best in class organizations create customer satisfaction committees that meet regularly to measure and monitor customer satisfaction, resolve issues quickly, and work towards improved customer experience and profit outcomes.

      Use metrics that align to top satisfaction drivers

      This will give you a more accurate and fulsome view of customer satisfaction than standard satisfaction metrics alone will.

      Guided Implementation

      What is our GI on measuring and managing the customer satisfaction metrics that matter most?

      Identify True Customer Satisfaction Drivers

      Develop Metrics Dashboard Develop Customer Satisfaction Measurement and Management Plan

      Call #1: Discuss current pain points and barriers to successful customer satisfaction measurement, monitoring and maintenance. Plan next call – 1 week.

      Call #2: Discuss all available data, noting any gaps. Develop plan to fill gaps, discuss feasibility and timelines. Plan next call – 1 week.

      Call #3: Walk through SoftwareReviews reports to understand EF and satisfaction drivers. Plan next call – 3 days.

      Call #4: Segment customers and document key satisfaction drivers. Plan next call – 2 week.

      Call #5: Document business goals and align them to metrics. Plan next call – 1 week.

      Call #6: Complete the SoftwareReviews satisfaction measurement diagnostic. Plan next call – 3 days.

      Call #7: Score list of metrics that align to satisfaction drivers. Plan next call – 2 days.

      Call #8: Develop metrics dashboard and definitions. Plan next call – 2 weeks.

      Call #9: Finalize metrics dashboard and definitions. Plan next call – 1 week.

      Call #10: Discuss committee and determine governance. Plan next call – 2 weeks.

      Call #11: Map out gaps in satisfaction along customer journey as they relate to top satisfaction drivers. Plan next call –2 weeks.

      Call #12: Develop plan and roadmap for satisfaction improvement. Plan next call – 1 week.

      Call #13: Finalize plan and roadmap. Plan next call – 1 week.

      Call # 14: Review and coach on communication deck.

      A Guided Implementation (GI) is series of calls with a SoftwareReviews Advisory analyst to help implement our best practices in your organization.

      For guidance on marketing applications, we can arrange a discussion with an Info-Tech analyst.

      Your engagement managers will work with you to schedule analyst calls.

      Software Reviews offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.” “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.” “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.” “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
      Included within Advisory Membership Optional add-ons

      Bibliography

      “Are you experienced?” Bain & Company, Apr. 2015. Accessed 6 June. 2022.

      Brisco, Ken. “Measuring Customer Satisfaction and Why It’s So Important.” NICE, Feb. 2019. Accessed 6 June. 2022.

      CMO.com Team. “The Customer Experience Management Mandate.” Adobe Experience Cloud Blog, July 2019. Accessed 14 June. 2022.

      Cote, Dan. “Advocacy Blooms and Business Booms When Customers and Employees Engage.” Influitive, Dec. 2021. Accessed 15 June. 2022.

      Fanderl, Harald and Perrey, Jesko. “Best of both worlds: Customer experience for more revenues and lower costs.” McKinsey & Company, Apr. 2014. Accessed 15 June. 2022.

      Gallemard, Jeremy. “Why – And How – Should Customer Satisfaction Be Measured?” Smart Tribune, Feb. 2020. Accessed 6 June. 2022.

      Kumar, Swagata. “Customer Success Statistics in 2021.” Customer Success Box, 2021. Accessed 17 June. 2022.

      Lakshmiu Tatikonda, “The Hidden Costs of Customer Dissatisfaction”, Management Accounting Quarterly, vol. 14, no. 3, 2013, pp 38. Accessed 17 June. 2022.

      Loper, Matthew. “Why ‘Customer Satisfaction’ Misses the Mark – And What to Measure Instead.” Newsweek, Jan. 2022. Accessed 16 June. 2022.

      Maechler, Nicolas, et al. “Improving the business-to-business customer experience.” McKinsey & Company, Mar. 2016. Accessed 16 June.

      “New Research from Dimension Data Reveals Uncomfortable CX Truths.” CISION PR Newswire, Apr. 2017. Accessed 7 June. 2022.

      Sheth, Rohan. 75 Must-Know Customer Experience Statistics to move Your Business Forward in 2022.” SmartKarrot, Feb. 2022. Accessed 17 June. 2022.

      Smith, Mercer. “111 Customer Service Statistics and Facts You Shouldn’t Ignore.” HelpScout, May 2022. Accessed 17 June. 2022.

      “State of the Connected Customer.” Salesforce, 2020. Accessed 14 June. 2022

      “The true value of customer experiences.” Deloitte, 2018. Accessed 15 June. 2022.

      Get the Most Out of Your CRM

      • Buy Link or Shortcode: {j2store}537|cart{/j2store}
      • member rating overall impact: 9.7/10 Overall Impact
      • member rating average dollars saved: $31,749 Average $ Saved
      • member rating average days saved: 22 Average Days Saved
      • Parent Category Name: Customer Relationship Management
      • Parent Category Link: /customer-relationship-management
      • Application optimization is essential to stay competitive and productive in today’s digital environment.
      • Enterprise applications often involve large capital outlay, unquantified benefits, and high risk of failure.
      • Customer relationship management (CRM) application portfolios are often messy with multiple integration points, distributed data, and limited ongoing end-user training.
      • User dissatisfaction is common.

      Our Advice

      Critical Insight

      A properly optimized CRM ecosystem will reduce costs and increase productivity.

      Impact and Result

      • Build an ongoing optimization team to conduct application improvements.
      • Assess your CRM application(s) and the environment in which they exist. Take a business-first strategy to prioritize optimization efforts.
      • Validate CRM capabilities, user satisfaction, issues around data, vendor management, and costs to build out an optimization strategy.
      • Pull this all together to develop a prioritized optimization roadmap.

      Get the Most Out of Your CRM Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should optimize your CRM, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Map current-state capabilities

      Gather information around the application:

      • Get the Most Out of Your CRM Workbook

      2. Assess your current state

      Assess CRM and related environment. Perform CRM process assessment. Assess user satisfaction across key processes, applications, and data. Understand vendor satisfaction

      • CRM Application Inventory Tool

      3. Build your optimization roadmap

      Build your optimization roadmap: process improvements, software capability improvements, vendor relationships, and data improvement initiatives.

      Infographic

      Workshop: Get the Most Out of Your CRM

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Define Your CRM Application Vision

      The Purpose

      Define your CRM application vision.

      Key Benefits Achieved

      Develop an ongoing application optimization team.

      Realign CRM and business goals.

      Understand your current system state capabilities.

      Explore CRM and related costs.

      Activities

      1.1 Determine your CRM optimization team.

      1.2 Align organizational goals.

      1.3 Inventory applications and interactions.

      1.4 Define business capabilities.

      1.5 Explore CRM-related costs (optional).

      Outputs

      CRM optimization team

      CRM business model

      CRM optimization goals

      CRM system inventory and data flow

      CRM process list

      CRM and related costs

      2 Map Current-State Capabilities

      The Purpose

      Map current-state capabilities.

      Key Benefits Achieved

      Complete a CRM process gap analysis to understand where the CRM is underperforming.

      Review the CRM application portfolio assessment to understand user satisfaction and data concerns.

      Undertake a software review survey to understand your satisfaction with the vendor and product.

      Activities

      2.1 Conduct gap analysis for CRM processes.

      2.2 Perform an application portfolio assessment.

      2.3 Review vendor satisfaction.

      Outputs

      CRM process gap analysis

      CRM application portfolio assessment

      CRM software reviews survey

      3 Assess CRM

      The Purpose

      Assess CRM.

      Key Benefits Achieved

      Learn which processes you need to focus on.

      Uncover underlying user satisfaction issues to address these areas.

      Understand where data issues are occurring so that you can mitigate this.

      Investigate your relationship with the vendor and product, including that relative to others.

      Identify any areas for cost optimization (optional).

      Activities

      3.1 Explore process gaps.

      3.2 Analyze user satisfaction.

      3.3 Assess data quality.

      3.4 Understand product satisfaction and vendor management.

      3.5 Look for CRM cost optimization opportunities (optional).

      Outputs

      CRM process optimization priorities

      CRM vendor optimization opportunities

      CRM cost optimization

      4 Build the Optimization Roadmap

      The Purpose

      Build the optimization roadmap.

      Key Benefits Achieved

      Understanding where you need to improve is the first step, now understand where to focus your optimization efforts.

      Activities

      4.1 Identify key optimization areas.

      4.2 Build your CRM optimization roadmap and next steps.

      Outputs

      CRM optimization roadmap

      Further reading

      Get the Most Out of Your CRM

      In today’s connected world, continuous optimization of enterprise applications to realize your digital strategy is key.

      Get the Most Out of Your CRM

      In today’s connected world, continuous optimization of enterprise applications to realize your digital strategy is key.

      EXECUTIVE BRIEF

      Analyst Perspective

      Focus optimization on organizational value delivery.

      Customer relationship management (CRM) systems are at the core of a customer-centric strategy to drive business results. They are critical to supporting marketing, sales, and customer service efforts.

      CRM systems are expensive, their benefits are difficult to quantify, and they often suffer from poor user satisfaction. Post implementation, technology evolves, organizational goals change, and the health of the system is not monitored. This is complicated in today’s digital landscape with multiple integration points, siloed data, and competing priorities.

      Too often organizations jump into the selection of replacement systems without understanding the health of their current systems. IT leaders need to stop reacting and take a proactive approach to continually monitor and optimize their enterprise applications. Strategically realign business goals, identify business application capabilities, complete a process assessment, evaluate user adoption, and create an optimization roadmap that will drive a cohesive technology strategy that delivers results.

      This is a picture of Lisa Highfield

      Lisa Highfield
      Research Director,
      Enterprise Applications
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      In today’s connected world, continuous optimization of enterprise applications to realize your digital strategy is key.

      Enterprise applications often involve large capital outlay and unquantified benefits.

      CRM application portfolios are often messy. Add to that poor processes, distributed data, and lack of training – business results and user dissatisfaction is common.

      Technology owners are often distributed across the business. Consolidation of optimization efforts is key.

      Common Obstacles

      Enterprise applications involve large numbers of processes and users. Without a clear focus on organizational needs, decisions about what and how to optimize can become complicated.

      Competing and conflicting priorities may undermine optimization value by focusing on the approaches that would only benefit one line of business rather than the entire organization.

      Teams do not have a framework to illustrate, communicate, and justify the optimization effort in the language your stakeholders understand.

      Info-Tech’s Approach

      Build an ongoing optimization team to conduct application improvements.

      Assess your CRM application(s) and the environment in which they exist. Take a business-first strategy to prioritize optimization efforts.

      Validate CRM capabilities, user satisfaction, issues around data, vendor management, and costs to build out an optimization strategy

      Pull this all together to develop a prioritized optimization roadmap.

      Info-Tech Insight

      CRM implementation should not be a one-and-done exercise. A properly optimized CRM ecosystem will reduce costs and increase productivity.

      This is an image of the thought model: Get the Most Out of Your CRM

      Insight Summary

      Continuous assessment and optimization of customer relationship management (CRM) systems is critical to their success.

      • Applications and the environments in which they live are constantly evolving.
      • Get the Most Out of Your CRM provides business and application managers a method to complete a health assessment on their CRM systems to identify areas for improvement and optimization.
      • Put optimization practices into effect by:
        • Aligning and prioritizing key business and technology drivers.
        • Identifying CRM process classification, and performing a gap analysis.
        • Measuring user satisfaction across key departments.
        • Evaluating vendor relations.
        • Understanding how data fits.
        • Pulling it all together into an optimization roadmap.

      CRM platforms are the applications that provide functional capabilities and data management around the customer experience (CX).

      Marketing, sales, and customer service are enabled through CRM technology.

      CRM technologies facilitate an organization’s relationships with customers, service users, employees, and suppliers.

      CRM technology is critical to managing the lifecycle of these relationships, from lead generation, to sales opportunities, to ongoing support and nurturing of these relationships.

      Customer experience management (CXM)

      CRM platforms sit at the core of a well-rounded customer experience management ecosystem.

      Customer Relationship Management

      • Web Experience Management Platform
      • E-Commerce & Point-of-Sale Solutions
      • Social Media Management Platform
      • Customer Intelligence Platform
      • Customer Service Management Tools
      • Marketing Management Suite

      Customer relationship management suites are one piece of the overall customer experience management ecosystem, alongside tools such as customer intelligence platforms and adjacent point solutions for sales, marketing, and customer service. Review Info-Tech’s CXM blueprint to build a complete, end-to-end customer interaction solution portfolio that encompasses CRM alongside other critical components. The CXM blueprint also allows you to develop strategic requirements for CRM based on customer personas and external market analysis.

      CRM by the numbers

      1/3

      Statistical analysis of CRM projects indicate failures vary from 18% to 69%. Taking an average of those analyst reports, about one-third of CRM projects are considered a failure.
      Source: CIO Magazine, 2017

      85%

      Companies that apply the principles of behavioral economics outperform their peers by 85% in sales growth and more than 25% in gross margin.
      Source: Gallup, 2012

      40%

      In 2019, 40% of executives name customer experience the top priority for their digital transformation.
      Source: CRM Magazine, 2019

      CRM dissatisfaction

      Drivers of Dissatisfaction

      Business Data People and Teams Technology
      • Misaligned objectives
      • Product fit
      • Changing priorities
      • Lack of metrics
      • Access to data
      • Data hygiene
      • Data literacy
      • One view of the customer
      • User adoption
      • Lack of IT support
      • Training (use of data and system)
      • Vendor relations
      • Systems integration
      • Multichannel complexity
      • Capability shortfall
      • Lack of product support

      Info-Tech Insight

      While technology is the key enabler of building strong customer experiences, there are many other drivers of dissatisfaction. IT must stand shoulder to shoulder with the business to develop a technology framework for customer relationship management.

      Marketing, Sales, and Customer Service, along with IT, can only optimize CRM with the full support of each other. The cooperation of the departments is crucial when trying to improve CRM technology capabilities and customer interaction.

      Application optimization is risky without a plan

      Avoid the common pitfalls.

      • Not considering application optimization as a business and IT partnership that requires continuous formal engagement of all participants.
      • Not having a good understanding of current state, including integration points and data.
      • Not adequately accommodating feedback and changes after digital applications are deployed and employed.
      • Not treating digital applications as a motivator for potential future IT optimization effort, and not incorporating digital assets in strategic business planning.
      • Not involving department leads, management, and other subject matter experts to facilitate the organizational change digital applications bring.

      “A successful application optimization strategy starts with the business need in mind and not from a technological point of view. No matter from which angle you look at it, modernizing a legacy application is a considerable undertaking that can’t be taken lightly. Your best approach is to begin the journey with baby steps.”
      – Ernese Norelus, Sreeni Pamidala, and Oliver Senti
      Medium, 2020

      Info-Tech’s methodology for Get the Most Out of Your CRM

      1. Map Current-State Capabilities 2. Assess Your Current State 3. Build Your Optimization Roadmap
      Phase Steps
      1. Identify stakeholders and build your CRM optimization team
      2. Build a CRM strategy model
      3. Inventory current system state
      4. Define business capabilities
      1. Conduct a gap analysis for CRM processes
      2. Assess user satisfaction
      3. Review your satisfaction with the vendor and product
      1. Identify key optimization areas
      2. Compile optimization assessment results
      Phase Outcomes
      1. Stakeholder map
      2. CRM optimization team
      3. CRM business model
      4. Strategy alignment
      5. Systems inventory and diagram
      6. Business capabilities map
      7. Key CRM processes list
      1. Gap analysis for CRM-related processes
      2. Understanding of user satisfaction across applications and processes
      3. Insight into CRM data quality
      4. Quantified satisfaction with the vendor and product
      1. Application optimization plan

      Get the Most Out of Your CRM Workbook

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals.

      Key deliverable:

      CRM Optimization Roadmap (Tab 8)

      This image contains a screenshot from Tab 9 of the Get the most out of your CRM WorkshopThis image contains a screenshot from Tab 9 of the Get the most out of your CRM Workshop

      Complete an assessment of processes, user satisfaction, data quality, and vendor management using the Workbook or the APA diagnostic.

      CRM Business Model (Tab 2)

      This image contains a screenshot from Tab 2 of the Get the most out of your CRM Workshop

      Align your business and technology goals and objectives in the current environment.

      Prioritized CRM Optimization Goals (Tab 3)

      This image contains a screenshot from Tab 3 of the Get the most out of your CRM Workshop

      Identify and prioritize your CRM optimization goals.

      Application Portfolio Assessment (APA)

      This image contains a screenshot of the Application Portfolio Assessment

      Assess IT-enabled user satisfaction across your CRM portfolio.

      Prioritized Process Assessment (Tab 5)

      This image contains a screenshot from Tab 5 of the Get the most out of your CRM Workshop

      Understand areas for improvement.

      Case Study

      Align strategy and technology to meet consumer demand.

      INDUSTRY - Entertainment
      SOURCE - Forbes, 2017

      Challenge

      Beginning as a mail-out service, Netflix offered subscribers a catalog of videos to select from and have mailed to them directly. Customers no longer had to go to a retail store to rent a video. However, the lack of immediacy of direct mail as the distribution channel resulted in slow adoption.

      Blockbuster was the industry leader in video retail but was lagging in its response to industry, consumer, and technology trends around customer experience

      Solution

      In response to the increasing presence of tech-savvy consumers on the internet, Netflix invested in developing its online platform as its primary distribution channel. The benefit of doing so was two-fold: passive brand advertising (by being present on the internet) and meeting customer demands for immediacy and convenience. Netflix also recognized the rising demand for personalized service and created an unprecedented, tailored customer experience.

      Results

      Netflix’s disruptive innovation is built on the foundation of great customer experience management. Netflix is now a $28-billion company, which is tenfold what Blockbuster was worth.

      Netflix used disruptive technologies to innovatively build a customer experience that put it ahead of the long-time, video rental industry leader, Blockbuster.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      What does a typical GI on this topic look like?

      Phase 1 Phase 2 Phase 3

      Call #1: Scope requirements, objectives, and your specific challenges.

      Call #2:

      Build the CRM team.

      Align organizational goals.

      Call #4:

      Conduct gap analysis for CRM processes.

      Prepare application portfolio assessment.

      Call #5:

      Understand product satisfaction and vendor management.

      Look for CRM cost optimization opportunities (optional).

      Call #7:

      Identify key optimization areas.

      Build out optimization roadmap and next steps.

      Call #3:

      Map current state.

      Inventory CRM processes.

      Explore CRM-related costs.

      Call #6:

      Review APA results.

      A Guided Implementation (GI) is series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Day 1 Day 2 Day 3 Day 4 Day 5
      Define Your CRM Application Vision Map Current-State Capabilities Assess CRM Build the Optimization Roadmap Next Steps and Wrap-Up (offsite)

      Activities

      1.1 Determine your CRM optimization team

      1.2 Align organizational goals

      1.3 Inventory applications and interactions

      1.4 Define business capabilities

      1.5 Explore CRM-related costs

      2.1 Conduct gap analysis for CRM processes

      2.2 Perform an application portfolio assessment

      2.3 Review vendor satisfaction

      3.1 Explore process gaps

      3.2 Analyze user satisfaction

      3.3 Assess data quality

      3.4 Understand product satisfaction and vendor management

      3.5 Look for CRM cost optimization opportunities (optional)

      4.1 Identify key optimization areas

      4.2 Build your CRM optimization roadmap and next steps

      5.1 Complete in-progress deliverables from previous four days

      5.2 Set up review time for workshop deliverables and to discuss next steps

      Deliverables
      1. CRM optimization team
      2. CRM business model
      3. CRM optimization goals
      4. CRM system inventory and data flow
      5. CRM process list
      6. CRM and related costs
      1. CRM process gap analysis
      2. CRM application portfolio assessment
      3. CRM software reviews survey
      1. CRM process optimization priorities
      2. CRM vendor optimization opportunities
      3. CRM cost optimization
      1. CRM optimization roadmap

      Phase 1

      Map Current-State Capabilities

      • 1.1 Identify Stakeholders and Build Your Optimization Team
      • 1.2 Build a CRM Strategy Model
      • 1.3 Inventory Current System State
      • 1.4 Define Business Capabilities
      • 1.5 Understand CRM Costs

      Get the Most Out of Your CRM

      This phase will walk you through the following activities:

      • Align your organizational goals
      • Gain a firm understanding of your current state
      • Inventory CRM and related applications
      • Confirm the organization’s capabilities

      This phase involves the following participants:

      • Product Owners
      • CMO
      • Departmental leads – Sales, Marketing, Customer Service, or other
      • Applications Director
      • Senior Business Analyst
      • Senior Developer
      • Procurement Analysts

      Inventory of CRM and related systems

      Develop an integration map to specify which applications will interface with each other.

      This is an image of an integration map, integrating the following Terms to CRM: Telephony Systems; Directory Services; Email; Content Management; Point Solutions; ERP

      Integration is paramount: your CRM application often integrates with other applications within the organization. Create an integration map to reflect a system of record and the exchange of data. To increase customer engagement, channel integration is a must (i.e. with robust links to unified communications solutions, email, and VoIP telephony systems).

      CRM plays a key role in the more holistic customer experience framework. However, it is heavily influenced by and often interacts with many other platforms.

      Data is one key consideration that needs to be considered here. If customer information is fragmented, it will be nearly impossible to build a cohesive view of the customer. Points of integration (POIs) are the junctions between the CRM(s) and other applications where data is flowing to and from. They are essential to creating value, particularly in customer insight-focused and omnichannel-focused deployments.

      Customer expectations are on the rise

      CRM strategy is a critical component of customer experience (CX).

      CUSTOMER EXPERIENCE

      1. Thoughtfulness is in
        Connect with customers on a personal level
      2. Service over products
        The experience is more important than the product
      3. Culture is now number one
        Culture is the most overlooked piece of customer experience strategy
      4. Engineering and service finally join forces
        Companies are combining their technology and service efforts to create
        strong feedback loops
      5. The B2B world is inefficiently served
        B2B needs to step up with more tools and a greater emphasis placed on
        customer experience

      Source: Forbes, 2019

      Build a cohesive CRM strategy that aligns business goals with CRM capabilities.

      Info-Tech Insight

      Customers expect to interact with organizations through the channels of their choice. Now more than ever, you must enable your organization to provide tailored customer experiences.

      IT is critical to the success of your CRM strategy

      Today’s shared digital landscape of the CIO and CMO

      CIO

      • IT Operations
      • Service Delivery and Management
      • IT Support
      • IT Systems and Application
      • IT Strategy and Governance
      • Cybersecurity

      Collaboration and Partnership

      • Digital Strategy = Transformation
        Business Goals | Innovation | Leadership | Rationalization
      • Customer Experience
        Architecture | Design | Omnichannel Delivery | Management
      • Insight (Market Facing)
        Analytics | Business Intelligence | Machine Learning | AI
      • Marketing Integration + Operating Model
        Apps | Channels | Experiences | Data | Command Center
      • Master Data
        Customer | Audience | Industry | Digital Marketing Assets

      CMO

      • PEO Media
      • Brand Management
      • Campaign Management
      • Marketing Tech
      • Marketing Ops
      • Privacy, Trust, and Regulatory Requirements

      Info-Tech Insight

      Technology is the key enabler of building strong customer experiences: IT must stand shoulder to shoulder with the business to develop a technology framework for customer relationship management.

      Step 1.1

      Identify Stakeholders and Build Your Optimization Team

      Activities

      1.1.1 Identify the stakeholders whose support will be critical to success

      1.1.2 Select your CRM optimization team

      Map Current-State Capabilities

      This step will walk you through the following activities:

      • Identify CRM drivers and objectives.
      • Explore CRM challenges and pain points.
      • Discover CRM benefits and opportunities.
      • Align the CRM foundation with the corporate strategy.

      This step involves the following participants:

      • Stakeholders
      • Project sponsors and leaders

      Outcomes of this step

      • Stakeholder map
      • CRM optimization team composition

      CRM optimization stakeholders

      Understand the roles necessary to get the most out of your CRM.

      Understand the role of each player within your optimization initiative. Look for listed participants on the activity slides to determine when each player should be involved.

      Info-Tech Insight

      Do not limit input or participation. Include subject matter experts and internal stakeholders at stages within the optimization initiative. Such inputs can be solicited on a one-off basis as needed. This ensures you take a holistic approach to creating your CRM optimization strategy.

      Title

      Roles Within CRM Optimization Initiative

      Optimization Sponsor

      • Owns the project at the management/C-suite level
      • Responsible for breaking down barriers and ensuring alignment with organizational strategy
      • CMO, VP od Marketing, VP of Sales, VP of Customer Care, or similar

      Optimization Initiative Manager

      • Typically IT individual(s) that oversee day-to-day operations
      • Responsible for preparing and managing the project plan and monitoring the project team’s progress
      • Applications Manager or other IT Manager, Business Analyst, Business Process Owner, or similar

      Business Leads/
      Product Owners

      • Works alongside the Optimization Initiative Manager to ensure that the strategy is aligned with business needs
      • In this case, likely to be a marketing, sales, or customer service lead
      • Product Owners
      • Sales Director, Marketing Director, Customer Care Director, or similar

      CRM Optimization Team

      • Comprised of individuals whose knowledge and skills are crucial to optimization success
      • Responsible for driving day-to-day activities, coordinating communication, and making process and design decisions
      • Project Manager, Business Lead, CRM Manager, Integration Manager, Application SMEs, Developers, Business Process Architects, and/or similar SMEs

      Steering Committee

      • Comprised of C-suite/management level individuals that act as the CRM optimization decision makers.
      • Responsible for validating goals and priorities, defining the optimization scope, enabling adequate resourcing, and managing change
      • Project Sponsor, Project Manager, Business Lead, CMO, Business Unit SMEs, or similar

      1.1.1 Identify stakeholders critical to success

      1 hour

      1. Hold a meeting to identify the stakeholders that should be included in the project’s steering committee.
      2. Finalize selection of steering committee members.
      3. Contact members to ensure their willingness to participate.
      4. Document the steering committee members and the milestone/presentation expectations for reporting project progress and results.

      Input

      • Stakeholder interviews
      • Business process owners list

      Output

      • CRM optimization stakeholders
      • Steering committee members

      Materials

      • N/A

      Participants

      • Product Owners
      • CMO
      • Departmental Leads – Sales, Marketing, Customer Service (and others)
      • Applications Director
      • Senior Business Analyst
      • Senior Developer
      • Procurement Analyst

      The CRM optimization team

      Consider the core team functions when composing the CRM optimization team. Form a cross-functional team (i.e. across IT, Marketing, Sales, Service, Operations) to create a well-aligned CRM optimization strategy.

      Don’t let your core team become too large when trying to include all relevant stakeholders. Carefully limiting the size of the optimization team will enable effective decision making while still including functional business units such as Marketing, Sales, Service, and Customer Service.

      Required Skills/Knowledge

      Suggested Optimization Team Members

      Business

      • Understanding of the customer
      • Departmental processes
      • Sales Manager
      • Marketing Manager
      • Customer Service Manager

      IT

      • Product Owner
      • Application developers
      • Enterprise architects
      • CRM Application Manager
      • Business Process Manager
      • Data Stewards
      Other
      • Operations
      • Administrative
      • Change management
      • Operations Manager
      • CFO
      • Change Management Manager

      1.1.2 Select your CRM optimization team

      30 minutes

      1. Have the CMO and other key stakeholders discuss and determine who will be involved in the CRM optimization project.
        • Depending on the initiative and the size of the organization the size of the team will vary.
        • Key business leaders in key areas – Sales, Marketing, Customer Service, and IT – should be involved.
      2. Document the members of your optimization team in the Get the Most Out of Your CRM Workbook, tab “1. Optimization Team.”
        • Depending on your initiative and size of your organization, the size of this team will vary.

      Get the Most Out of Your CRM Workbook

      Input

      • Stakeholders

      Output

      • List of CRM Optimization Team members

      Materials

      • Get the Most Out of Your CRM Workbook

      Participants

      • Product Owners
      • CMO
      • Departmental Leads – Sales, Marketing, Customer Service
      • Applications Director
      • Senior Business Analyst
      • Senior Developer
      • Procurement Analyst

      Step 1.2

      Build a CRM Strategy Model

      Activities

      • 1.2.1 Explore environmental factors and technology drivers
      • 1.2.2 Discuss challenges and pain points
      • 1.2.3 Discuss opportunities and benefits
      • 1.2.4 Align CRM strategy with organizational goals

      Map Current-State Capabilities

      This step will walk you through the following activities:

      • Identify CRM drivers and objectives.
      • Explore CRM challenges and pain points.
      • Discover the CRM benefits and opportunities.
      • Align the CRM foundation with the corporate strategy.

      This step involves the following participants:

      • CRM Optimization Team

      Outcomes of this step

      • CRM business model
      • Strategy alignment

      Align the CRM strategy with the corporate strategy

      Corporate Strategy

      Your corporate strategy:

      • Conveys the current state of the organization and the path it wants to take.
      • Identifies future goals and business aspirations.
      • Communicates the initiatives that are critical for getting the organization from its current state to the future state.

      Unified Strategy

      • The CRM optimization can be and should be linked, with metrics, to the corporate strategy and ultimate business objectives.

      CRM Strategy

      Your CRM Strategy:

      • Communicates the organization’s budget and spending on CRM.
      • Identifies IT initiatives that will support the business and key CRM objectives.
      • Outlines staffing and resourcing for CRM initiatives.

      CRM projects are more successful when the management team understands the strategic importance and the criticality of alignment. Time needs to be spent upfront aligning business strategies with CRM capabilities. Effective alignment between Sales, Marketing, Customer Service, Operations, IT, and the business should happen daily. Alignment doesn’t just need to occur at the executive level but at each level of the organization.

      Sample CRM objectives

      Increase Revenue

      Enable lead scoring

      Deploy sales collateral management tools

      Improve average cost per lead via a marketing automation tool

      Enhance Market Share

      Enhance targeting effectiveness with a CRM

      Increase social media presence via an SMMP

      Architect customer intelligence analysis

      Improve Customer Satisfaction

      Reduce time-to-resolution via better routing

      Increase accessibility to customer service with live chat

      Improve first contact resolution with customer KB

      Increase Customer Retention

      Use a loyalty management application

      Improve channel options for existing customers

      Use customer analytics to drive targeted offers

      Create Customer-Centric Culture

      Ensure strong training and user adoption programs

      Use CRM to provide 360-degree view of all customer interactions

      Incorporate the voice of the customer into product development

      Identifying organizational objectives of high priority will assist in breaking down business needs and CRM objectives. This exercise will better align the CRM systems with the overall corporate strategy and achieve buy-in from key stakeholders.

      CRM business model Template

      This image contains a screenshot of the CRM business model template

      Understand objectives for creating a strong CRM strategy

      Business Needs

      Business Drivers

      Technology Drivers

      Environmental Factors

      Definition A business need is a requirement associated with a particular business process. Business drivers can be thought of as business-level goals. These are tangible benefits the business can measure such as employee retention, operation excellence, and financial performance. Technology drivers are technological changes that have created the need for a new CRM enablement strategy. Many organizations turn to technology systems to help them obtain a competitive edge. External considerations are factors taking place outside of the organization that are impacting the way business is conducted inside the organization. These are often outside the control of the business.

      Examples

      • Audit tracking
      • Authorization levels
      • Business rules
      • Data quality
      • Employee engagement
      • Productivity
      • Operational efficiency
      • Deployment model (i.e. SaaS)
      • Integration
      • Reporting capabilities
      • Fragmented technologies
      • Economic and political factors, the labor market
      • Competitive influencers
      • Compliance regulations

      Info-Tech Insight

      One of the biggest drivers for CRM adoption is the ability to make decisions through consolidated data. This driver is a result of external considerations. Many industries today are highly competitive, uncertain, and rapidly changing. To succeed under these pressures, there needs to be timely information and visibility into all components of the organization.

      1.2.1 Explore environmental factors and technology drivers

      30 minutes

      1. Identify business drivers that are contributing to the organization’s need for CRM.
      2. Understand how the company is running today and what the organization’s future will look like. Try to identify the purpose for becoming an integrated organization. Use a whiteboard and markers to capture key findings.
      3. Consider environmental factors: external considerations, organizational drivers, technology drivers, and key functional requirements.
      4. Use the Get the Most Out of Your CRM Workbook, tab “2. Business Model,” to complete this exercise.

      Get the Most Out of Your CRM Workbook

      This is a screenshot of the CRM Business Model the following boxes highlighted in purple boxes.  CRM business Needs; Environmental Factors; Technology Drivers

      External Considerations

      Organizational Drivers

      Technology Considerations

      Functional Requirements

      • Funding Constraints
      • Regulations
      • Compliance
      • Scalability
      • Operational Efficiency
      • Data Accuracy
      • Data Quality
      • Better Reporting
      • Information Availability
      • Integration Between Systems
      • Secure Data

      Create a realistic CRM foundation by identifying the challenges and barriers to the project

      There are several different factors that may stifle the success of an CRM portfolio. Organizations creating an CRM foundation must scan their current environment to identify internal barriers and challenges.

      Common Internal Barriers

      Management Support

      Organizational Culture

      Organizational Structure

      IT Readiness

      Definition The degree of understanding and acceptance towards CRM technology and systems. The collective shared values and beliefs. The functional relationships between people and departments in an organization. The degree to which the organization’s people and processes are prepared for new CRM system(s.)

      Questions

      • Is a CRM project recognized as a top priority?
      • Will management commit time to the project?
      • Are employees resistant to change?
      • Is the organization highly individualized?
      • Is the organization centralized?
      • Is the organization highly formalized?
      • Is there strong technical expertise?
      • Is there strong infrastructure?
      Impact
      • Funding
      • Resources
      • Knowledge sharing
      • User acceptance
      • Flow of knowledge
      • Poor implementation
      • Need for reliance on consultants

      1.2.2 Discuss challenges and pain points

      30 minutes

      1. Identify challenges with current systems and processes.
      2. Brainstorm potential barriers to success. Use a whiteboard and markers to capture key findings.
      3. Consider the project barriers: functional gaps, technical gaps, process gaps, and barriers to CRM success.
      4. Use the Get the Most Out of Your CRM Workbook, tab “2. Business Model,” to complete this exercise.

      Get the Most Out of Your CRM Workbook

      This is a screenshot of the CRM Business Model the following boxes highlighted in purple boxes.  Barriers

      Functional Gaps

      Technical Gaps

      Process Gaps

      Barriers to Success

      • No sales tracking within core CRM
      • Inconsistent reporting – data quality concerns
      • Duplication of data
      • Lack of system integration
      • Cultural mindset
      • Resistance to change
      • Lack of training
      • Funding

      1.2.3 Discuss opportunities and benefits

      30 minutes

      1. Identify opportunities and benefits from an integrated system.
      2. Brainstorm potential enablers for successful CRM enablement and the ideal portfolio.
      3. Consider the project enablers: business benefits, IT benefits, organizational benefits, and enablers of CRM success.
      4. Use the Get the Most Out of Your CRM Workbook, tab “2. Business Model,” to complete this exercise.
      This is a screenshot of the CRM Business Model the following boxes highlighted in purple boxes.  Enablers

      Business Benefits

      IT Benefits

      Organizational Benefits

      Enablers of Success

      • Business-IT alignment
      • Compliance
      • Scalability
      • Operational Efficiency
      • Data Accuracy
      • Data Quality
      • Better Reporting
      • Change Management
      • Training
      • Alignment to Strategic Objectives

      1.2.4 Align CRM strategy with organizational goals

      1 hour

      1. Discuss your corporate objectives (organizational goals). Choose three to five corporate objectives that are a priority for the organization in the current year.
      2. Break into groups and assign each group one corporate objective.
      3. For each objective, produce several ways an optimized CRM system will meet the given objective.
      4. Think about the modules and CRM functions that will help you realize these benefits.
      5. Use the Get the Most Out of Your CRM Workbook, tab “2. Business Model,” to complete this exercise.
      Increase Revenue

      CRM Benefits

      • Increase sales by 5%
      • Expand to new markets
      • Offer new product
      • Identify geographies underperforming
      • Build out global customer strategy
      • Allow for customer segmentation
      • Create targeted marketing campaigns

      Input

      • Organizational goals
      • CRM strategy model

      Output

      • Optimization benefits map

      Materials

      • Get the Most Out of Your CRM Workbook

      Participants

      • Product Owners
      • CMO
      • Departmental Leads – Sales, Marketing, Customer Service
      • Applications Director
      • Senior Business Analyst
      • Senior Developer
      • Procurement Analyst

      Download the Get the Most Out of Your CRM Workbook

      Step 1.3

      Inventory Current System State

      Activities

      1.3.1 Inventory applications and interactions

      Map Current-State Capabilities

      This step will walk you through the following activities:

      • Inventory applications
      • Map interactions between systems

      This step involves the following participants:

      • CRM Optimization Team
      • Enterprise Architect
      • Data Architect

      Outcomes of this step

      • Systems inventory
      • Systems diagram

      1.3.1 Inventory applications and interactions

      1-3 hours

      1. Individually list all electronic systems involved in the organization. This includes anything related to customer information and interactions, such as CRM, ERP, e-commerce, finance, email marketing, and social media, etc.
      2. Document data flows into and out of each system to the ERP. Refer to the example on the next slide (CRM data flow).
      3. Review the processes in place (e.g. reporting, marketing, data moving into and out of systems). Document manual processes. Identify integration points. If flowcharts exist for these processes, it may be useful to provide these to the participants.
      4. If possible, diagram the system. Include information direction flow. Use the sample CRM map, if needed.

      This image contains an example of a CRM Data Flow

      CRM data flow

      This image contains an example of a CRM Data Flow

      Be sure to include enterprise applications that are not included in the CRM application portfolio. Popular systems to consider for POIs include billing, directory services, content management, and collaboration tools.

      When assessing the current application portfolio that supports CRM, the tendency will be to focus on the applications under the CRM umbrella, relating mostly to Marketing, Sales, and Customer Service. Be sure to include systems that act as input to, or benefit due to outputs from, the CRM or similar applications.

      Sample CRM map

      This image contains an example of a CRM map

      Step 1.4

      Define Business Capabilities

      Activities

      1.4.1 Define business capabilities

      1.4.2 List your key CRM processes

      Map Current-State Capabilities

      This step will walk you through the following activities:

      • Define your business capabilities
      • List your key CRM processes

      This step involves the following participants:

      • CRM Optimization Team
      • Business Architect

      Outcomes of this step

      • Business capabilities map
      • Key CRM processes list

      Business capability map (Level 0)

      This image contains a screenshot of a business capability map.  an Arrow labeled CRM points to the Revenue Generation section. Revenue Generation: Marketing; Sales; Customer Service.

      In business architecture, the primary view of an organization is known as a business capability map.

      A business capability defines what a business does to enable value creation, rather than how.

      Business capabilities:

      • Represent stable business functions.
      • Are unique and independent of each other.
      • Typically will have a defined business outcome.

      A business capability map provides details that help the business architecture practitioner direct attention to a specific area of the business for further assessment.

      Capability vs. process vs. feature

      Understanding the difference

      When examining CRM optimization, it is important we approach this from the appropriate layer.

      Capability:

      • The ability of an entity (e.g. organization or department) to achieve its objectives (APQC, 2017).
      • An ability that an organization, person, or system possesses. Typically expressed in general and high-level terms and typically require a combination of organization, people, processes, and technology to achieve (TOGAF).

      Process:

      • Can be manual or technology enabled. A process is a series of interrelated activities that convert inputs into results (outputs). Processes consume resources, require standards for repeatable performance, and respond to control systems that direct the quality, rate, and cost of performance. The same process can be highly effective in one circumstance and poorly effective in another with different systems, tools, knowledge, and people (APQC, 2017).

      Feature:

      • Is a distinguishing characteristic of a software item (e.g. performance, portability, or functionality) (IEEE, 2005).

      In today’s complex organizations, it can be difficult to understand where inefficiencies stem from and how performance can be enhanced.
      To fix problems and maximize efficiencies business capabilities and processes need to be examined to determine gaps and areas of lagging performance.

      Info-Tech’s CRM framework and industry tools such as the APQC’s Process Classification Framework can help make sense of this.

      1.4.1 Define business capabilities

      1-3 hours

      1. Look at the major functions or processes within the scope of CRM.
      2. Compile an inventory of current systems that interact with the chosen processes. In its simplest form, document your application inventory in a spreadsheet (see tab 3 of the CRM Application Inventory Tool). For large organizations, interview representatives of business domains to help create your list of applications.
      3. Make sure to include any processes that are manual versus automated.
      4. Use your current state drawing from activity 1.3.1 to link processes to applications for further effect.

      CRM Application Inventory Tool

      Input

      • Current systems
      • Key processes
      • APQC Framework
      • Organizational process map

      Output

      • List of key business processes

      Materials

      • CRM Application Inventory Tool
      • CRM APQC Framework
      • Whiteboard, PowerPoint, or flip charts
      • Pens/markers

      Participants

      • CRM Optimization Team

      CRM process mapping

      This image contains two screenshots.  one is of the business capability map seen earlier in this blueprint, and the other includes the following operating model: Objectives; Value Streams; Capabilities; Processes

      The operating model

      An operating model is a framework that drives operating decisions. It helps to set the parameters for the scope of CRM and the processes that will be supported. The operating model will serve to group core operational processes. These groupings represent a set of interrelated, consecutive processes aimed at generating a common output.

      The Value Stream

      Value Stream Defined

      Value Streams

      Design Product

      Produce Product

      Sell Product

      Customer Service

      • Manufacturers work proactively to design products and services that will meet consumer demand.
      • Products are driven by consumer demand and governmental regulations.
      • Production processes and labor costs are constantly analyzed for efficiencies and accuracies.
      • Quality of product and services are highly regulated through all levels of the supply chain.
      • Sales networks and sales staff deliver the product from the organization to the end consumer.
      • Marketing plays a key role throughout the value stream connecting consumers wants and needs to the product and services offered.
      • Relationships with consumers continue after the sale of a product and services.
      • Continued customer support and mining is important to revenue streams.

      Value streams connect business goals to the organization’s value realization activities in the marketplace. Those activities are dependent on the specific industry segment in which an organization operates.

      There are two types of value streams: core value streams and support value streams.

      • Core value streams are mostly externally facing. They deliver value to either an external or internal customer and they tie to the customer perspective of the strategy map.
      • Support value streams are internally facing and provide the foundational support for an organization to operate.

      An effective method for ensuring all value streams have been considered is to understand that there can be different end-value receivers.

      APQC Framework

      Help define your inventory of sales, marketing, and customer services processes.

      Operating Processes

      1. Develop Vision and Strategy
      2. Develop and Manage Products and Services
      3. Market and Sell Products and Services
      4. Deliver Physical Products
      5. Deliver Services

      Management and Support Processes

      1. Manage Customer Service
      2. Develop and Manage Human Capital
      3. Manage Information Technology (IT)
      4. Manage Financial Resources
      5. Acquire, Construct, and Manage Assets
      6. Manage Enterprise Risk, Compliance, Remediation, and Resiliency
      7. Manage External Relationships
      8. Develop and Manage Business Capabilities

      Source: APQC, 2020

      If you do not have a documented process model, you can use the APQC Framework to help define your inventory of sales business processes.

      APQC’s Process Classification Framework is a taxonomy of cross-functional business processes intended to allow the objective comparison of organizational performance within and among organizations.

      Go to this link

      Process mapping hierarchy

      This image includes explanations for the following PCF levels:  Level 1 - Category; Level 2 - Process Group; Level 3 - Process; Level 4 - Activity; Level 5 - Task

      APQC provides a process classification framework. It allows organizations to effectively define their processes and manage them appropriately.

      THE APQC PROCESS CLASSIFICATION FRAMEWORK (PCF)® was developed by non-profit APQC, a global resource for benchmarking and best practices, and its member companies as an open standard to facilitate improvement through process management and benchmarking, regardless of industry, size, or geography. The PCF organizes operating and management processes into 12 enterprise level categories, including process groups and over 1,000 processes and associated activities. To download the full PCF or industry-specific versions of the PCF as well as associated measures and benchmarking, visit www.apqc.org/pcf.

      Cross-industry classification framework

      Level 1 Level Level 3 Level 4

      Market and sell products and services

      Understand markets, customers, and capabilities Perform customer and market intelligence analysis Conduct customer and market research

      Market and sell products and services

      Develop sales strategy Develop sales forecast Gather current and historic order information

      Deliver services

      Manage service delivery resources Manage service delivery resource demand Develop baseline forecasts
      ? ? ? ?

      Info-Tech Insight

      Focus your initial assessment on the level 1 processes that matter to your organization. This allows you to target your scant resources on the areas of optimization that matter most to the organization and minimize the effort required from your business partners.

      You may need to iterate the assessment as challenges are identified. This allows you to be adaptive and deal with emerging issues more readily and become a more responsive partner to the business.

      1.4.2 List your key CRM processes

      1-3 hours

      1. Reflect on your organization’s CRM capabilities and processes.
      2. Refer to tab 4, “Process Importance,” in your Get the Most Out of Your CRM Workbook. You can use your own processes if you prefer. Consult tab 10. “Framework (Reference)” in the Workbook to explore additional capabilities.
      3. Use your CRM goals as a guide.

      Get the Most Out of Your CRM Workbook

      This is a screenshot from the APQC Cross-Industry Process Classification Framework, adapted to list key CRM processes

      *Adapted from the APQC Cross-Industry Process Classification Framework, 2019.

      Step 1.5

      Understand CRM Costs

      Activities

      1.5.1 List CRM-related costs (optional)

      Map Current-State Capabilities

      This step will walk you through the following activities:

      • Define your business capabilities
      • List your key CRM processes

      This step involves the following participants:

      • Finance Representatives
      • CRM Optimization Team

      Outcomes of this step

      • Current CRM and related operating costs

      1.5.1 List CRM-related costs (optional)

      3+ hours

      Before you can make changes and optimization decisions, you need to understand the high-level costs associated with your current application architecture. This activity will help you identify the types of technology and people costs associated with your current systems.

      1. Identify the types of technology costs associated with each current system:
        1. System Maintenance
        2. Annual Renewal
        3. Licensing
      2. Identify the cost of people associated with each current system:
        1. Full-Time Employees
        2. Application Support Staff
        3. Help Desk Tickets
      3. Use the Get the Most Out of Your CRM Workbook, tab “9. Costs (Optional),” to complete this exercise.

      This is a screenshot of an example of a table which lays out CRM and Associated Costs.

      Get the Most Out of Your CRM Workbook

      Phase 2

      Assess Your Current State

      • 2.1 Conduct a Gap Analysis for CRM Processes
      • 2.2 Assess User Satisfaction
      • 2.3 Review Your Satisfaction With the Vendor and Product

      Get the Most Out of Your CRM

      This phase will guide you through the following activities:

      • Determine process relevance
      • Perform a gap analysis
      • Perform a user satisfaction survey
      • Assess software and vendor satisfaction

      This phase involves the following participants:

      • CRM optimization team
      • Users across functional areas of your CRM and related technologies

      Step 2.1

      Conduct a Gap Analysis for CRM Processes

      Activities

      • 2.1.1 Determine process relevance
      • 2.1.2 Perform process gap analysis

      Assess Your Current State

      This step will walk you through the following activities:

      • Determine process relevance
      • Perform a gap analysis

      This step involves the following participants:

      • CRM optimization team

      Outcomes of this step

      • Gap analysis for CRM-related processes (current vs. desired state)

      2.1.1 Determine process relevance

      1-3 hours

      1. Open tab “4. Process Importance,” in the Get the Most Out of Your CRM Workbook.
      2. Rate each process for level of importance to your organization on the following scale:
        • Crucial
        • Important
        • Secondary
        • Unimportant
        • Not applicable

      This image contains a screenshot of tab 4 of the Get the most out of your CRM Workbook.

      Get the Most Out of Your CRM Workbook

      2.1.2 Perform process gap analysis

      1-3 hours

      1. Open tab “5. Process Assessment,” in the Get the Most Out of Your CRM Workbook.
      2. For each line item, identify your current state and your desired state on the following scale:
        • Not important
        • Poor
        • Moderate
        • Good
        • Excellent

      This is a screenshot of Tab 5 of the Get the Most Out of your CRM Workshop

      Get the Most Out of Your CRM Workbook

      Step 2.2

      Assess User Satisfaction

      Activities

      • 2.2.1 Prepare and complete a user satisfaction survey
      • 2.2.2 Enter user satisfaction

      Assess Your Current State

      This step will walk you through the following activities:

      • Preparation and completion of an application portfolio assessment (APA)
      • Entry of the user satisfaction scores into the workbook

      This step involves the following participants:

      • CRM optimization team
      • Users across functional areas of CRM and related technologies

      Outcomes of this step

      • Understanding of user satisfaction across applications and processes
      • Insight into CRM data quality

      Benefits of the Application Portfolio Assessment

      This is a screenshot of the application  Overview tab

      Assess the health of the application portfolio

      • Get a full 360-degree view of the effectiveness, criticality, and prevalence of all relevant applications to get a comprehensive view of the health of the applications portfolio.
      • Identify opportunities to drive more value from effective applications, retire nonessential applications, and immediately address at-risk applications that are not meeting expectations.

      This is a screenshot of the Finance Overview tab

      Provide targeted department feedback

      • Share end-user satisfaction and importance ratings for core IT services, IT communications, and business enablement to focus on the right end-user groups or lines of business, and ramp up satisfaction and productivity.

      This is a screenshot of the application  Overview tab

      Insight into the state of data quality

      • Data quality is one of the key issues causing poor CRM user satisfaction and business results. This can include the relevance, accuracy, timeliness, or usability of the organization’s data.
      • Targeted, open-ended feedback around data quality will provide insight into where optimization efforts should be focused.

      2.2.1 Prepare and complete a user satisfaction survey

      1 hour

      Option 1: Use Info-Tech’s Application Portfolio Assessment to generate your user satisfaction score. This tool not only measures application satisfaction but also elicits great feedback from users regarding support they receive from the IT team.

      1. Download the CRM Application Inventory Tool.
      2. Complete the “Demographics” tab (tab 2).
      3. Complete the “Inventory” tab (tab 3).
        1. Complete the inventory by treating each process within the organization as a separate row. Use the processes identified in the process gap analysis as a reference.
        2. Treat every department as a separate column in the department section. Feel free to add, remove, or modify department names to match your organization.
        3. Include data quality for all applications applicable.

      Option 2: Use the method of choice to elicit current user satisfaction for each of the processes identified as important to the organization.

      1. List processes identified as important (from the Get the Most Out of Your CRM Workbook, tab 4, “Process Importance”).
      2. Gather user contact information by department.
      3. Ask users to rate satisfaction: Extremely Satisfied, Satisfied, Neutral, Dissatisfied, and Extremely Dissatisfied (on Get the Most Out of Your CRM Workbook, tab 5. “Process Assessment”).

      This image contains a screenshot of the CRM Application Inventory Tool Tab

      Understand user satisfaction across capabilities and departments within your organization.

      Download the CRM Application Inventory Tool

      2.2.2 Enter user satisfaction

      20 minutes

      Using the results from the Application Portfolio Assessment or your own user survey:

      1. Open your Get the Most Out of Your CRM Workbook, tab “5. Process Assessment.”
      2. For each process, record up to three different department responses.
      3. Enter the answers to the survey for each line item using the drop-down options:
        • Extremely Satisfied
        • Satisfied
        • Neutral
        • Dissatisfied
        • Extremely Dissatisfied

      This is a screenshot of Tab 5 of the Get the most out of your CRM Workbook

      Understand user satisfaction across capabilities and departments within your organization.

      Get the Most Out of Your CRM Workbook

      Step 2.3

      Review Your Satisfaction With the Vendor and Product

      Activities

      2.3.1 Rate your vendor and product satisfaction

      2.3.2 Enter SoftwareReviews scores from your CRM Product Scorecard (optional)

      Assess Your Current State

      This step will walk you through the following activities:

      • Rate your vendor and product satisfaction
      • Compare with survey data from SoftwareReviews

      This step involves the following participants:

      • CRM Owner(s)
      • Procurement Representative
      • Vendor Contracts Manager

      Outcomes of this step

      • Quantified satisfaction with vendor and product

      Use a SoftwareReviews Product Scorecard to evaluate your satisfaction compared to other organizations.

      This is a screenshot of the SoftwareReviews Product Scorecard

      Source: SoftwareReviews, March 2019

      Where effective IT leaders spend their time

      This image contains two lists.  One list is where CIOs with  data-verified=80% satisfaction score, and the other list is CIOs with <80% satisfaction score.">

      Info-Tech Insight

      The data shows that effective IT leaders invest a significant amount of time (8%) on vendor management initiatives.

      Be proactive in managing you calendar and block time for these important tasks.

      CIOs who prioritize vendor management see improved results

      Analysis of CIOs’ calendars revealed that how CIOs spend their time has a correlation to both stakeholder IT satisfaction and CEO-CIO alignment.

      Those CIOs that prioritized vendor management were more likely to have a business satisfaction score greater than 80%.

      This image demonstrates that CIOs who spend time with the team members of their direct reports delegate management responsibilities to direct reports and spend less time micromanaging, and CIOs who spend time on vendor management align rapidly changing business needs with updated vendor offerings.

      2.3.1 Rate your vendor and product satisfaction

      30 minutes

      Use Info-Tech’s vendor satisfaction survey to identify optimization areas with your CRM product(s) and vendor(s).

      Option 1 (recommended): Conduct a satisfaction survey using SoftwareReviews. This option allows you to see your results in the context of the vendor landscape.

      Download the Get the Most Out of Your CRM Workbook

      Option 2: Use your Get the Most Out of Your CRM Workbook, tab “6. Vendor Optimization,” to review your satisfaction with your software.

      SoftwareReviews’ Customer Relationship Management

      This is a screenshot of tab 6 of the Get the most out of your CRM Workbook.

      2.3.2 Enter SoftwareReviews scores (optional)

      30 minutes

      1. Download the scorecard for your CRM product from the SoftwareReviews website. (Note: Not all products are represented or have sufficient data, so a scorecard may not be available.)
      2. Use your Get the Most Out of Your CRM Workbook, tab “6. Vendor Optimization,” to record the scorecard results.
      3. Use your Get the Most Out of Your CRM Workbook, tab “6. Vendor Optimization,” to flag areas where your score may be lower than the product scorecard. Brainstorm ideas for optimization.

      Download the Get the Most Out of Your CRM Workbook

      SoftwareReviews’ Customer Relationship Management

      This is a screenshot of the optional vendor optimization scorecard

      Phase 3

      Build Your Optimization Roadmap

      • 3.1 Identify Key Optimization Areas
      • 3.2 Compile Optimization Assessment Results

      Get the Most Out of Your CRM

      This phase will walk you through the following activities:

      • Identify key optimization areas
      • Create an optimization roadmap

      This phase involves the following participants:

      • CRM Optimization Team

      Build your optimization roadmap

      Address process gaps

      • CRM and related technologies are invaluable to sales, marketing, and customer service enablement, but they must have supported processes driven by business goals.
      • Identify areas where capabilities need to be improved and work towards.

      Support user satisfaction

      • The best technology in the world won’t deliver business results if it is not working for the users who need it.
      • Understand concerns, communicate improvements, and support users in all roles.

      Improve data quality

      • Data quality is unique to each business unit and requires tolerance, not perfection.
      • Implement a set of data quality initiatives that are aligned with overall business objectives and aimed at addressing data practices and the data itself.

      Proactively manage vendors

      • Vendor management is a critical component of technology enablement and IT satisfaction.
      • Assess your current satisfaction against those of your peers and work towards building a process that is best fit for your organization.

      Info-Tech Insight

      Enabling a high-performing, customer-centric sales, marketing, and customer service operations program requires excellent management practices and continuous optimization efforts.

      Technology portfolio and architecture is important, but we must go deeper. Taking a holistic view of CRM technologies in the environments in which they operate allows for the inclusion of people and process improvements – this is key to maximizing business results.

      Using a formal CRM optimization initiative will drive business-IT alignment, identify IT automation priorities, and dig deep into continuous process improvement.

      Step 3.1

      Identify Key Optimization Areas

      Activities

      • 3.1.1 Explore process gaps
      • 3.1.2 Analyze user satisfaction
      • 3.1.3 Assess data quality
      • 3.1.4 Analyze product satisfaction and vendor management

      Build Your Optimization Roadmap

      This step will guide you through the following activities:

      • Explore existing process gaps
      • Identify the impact of processes on user satisfaction
      • Identify the impact of data quality on user satisfaction
      • Review your overall product satisfaction and vendor management

      This step involves the following participants:

      • CRM Optimization Team

      Outcomes of this step

      • Application optimization plan

      3.1.1 Explore process gaps

      1 hour

      1. Review the compiled CRM Process Assessment in the Get the Most Out of Your CRM Workbook, tab “7. Process Prioritization.”
      2. These are processes you should prioritize.
      • The activities in the rest of Step 3.1 help you create optimization strategies for the different areas of improvement these processes relate to: user satisfaction, data quality, product satisfaction, and vendor management.
    • Consolidate your optimization strategies in the Get the Most Out of Your CRM Workbook, tab “8. Optimization Roadmap.” (See next slide for screenshot.)
    • This image consists of the CRM Process Importance Rankings

      Get the Most Out of Your CRM Workbook

      Plan your product optimization strategy for each area of improvement

      This is a screenshot from the Get the most out of your CRM Workbook, with the Areas of Improvement column  highlighted in a red box.

      3.1.2 Analyze user satisfaction

      1 hour

      1. Use the APA survey results from activity 2.2.1 (or your own internal survey) to identify areas where the organization is performing low in user satisfaction across the CRM portfolio.
        1. Understand application portfolio and IT service satisfaction.
        2. Identify cost savings opportunities from unused or unimportant apps.
        3. Build a roadmap for improving user IT services.
        4. Manage needs by department and seniority.
      2. Consolidate your optimization strategies in the Get the Most Out of Your CRM Workbook, tab “8. Optimization Roadmap.” (See next slide for screenshot.)

      this is an image of the Business & IT Communications Overview Tab from the Get the Most Out of Your CRM Workbook

      Get the Most Out of Your CRM Workbook

      Plan your user satisfaction optimization strategy

      This is a screenshot from the Get the most out of your CRM Workbook, with the Optimization Strategies column  highlighted in a red box.

      Next steps in improving your data quality

      Data Quality Management Effective Data Governance Data-Centric Integration Strategy Extensible Data Warehousing
      • Prevention is ten times cheaper than remediation. Stop fixing data quality with band-aid solutions and start fixing it by healing it at the source of the problem.
      • Data governance enables data-driven insight. Think of governance as a structure for making better use of data.
      • Every enterprise application involves data integration. Any change in the application and database ecosystem requires you to solve a data integration problem.
      • A data warehouse is a project; but successful data warehousing is a program. An effective data warehouse requires planning beyond the technology implementation.
      • Data quality is unique to each business unit and requires tolerance, not perfection. If the data allows the business to operate at the desired level, don’t waste time fixing data that may not need to be fixed.
      • Collaboration is critical. The business may own the data, but IT understands the data. Data governance will not work unless the business and IT work together.
      • Data integration is becoming more and more critical for downstream functions of data management and for business operations to be successful. Poor integration holds back these critical functions.
      • Governance, not technology, needs to be the core support system for enabling a data warehouse program.
      • Implement a set of data quality initiatives that are aligned with overall business objectives and aimed at addressing data practices and the data itself.
      • Data governance powers the organization up the data value chain through policies and procedures, master data management, data quality, and data architecture.
      • Build your data integration practice with a firm foundation in governance and reference architecture. Ensure your process is scalable and sustainable.
      • Leverage an approach that focuses on constructing a data warehouse foundation that can address a combination of operational, tactical, and ad hoc business needs.
      • Develop a prioritized data quality improvement project roadmap and long-term improvement strategy.
      • Create a roadmap to prioritize initiatives and delineate responsibilities among data stewards, data owners, and members of the data governance steering committee.
      • Support the flow of data through the organization and meet the organization’s requirements for data latency, availability, and relevancy.
      • Invest time and effort to put together pre-project governance to inform and provide guidance to your data warehouse implementation.
      • Build related practices with more confidence and less risk after achieving an appropriate level of data quality.
      • Ensure buy-in from the business and IT stakeholders. Communicate initiatives to end users and executives to reduce resistance.
      • Data availability must be frequently reviewed and repositioned to continue to grow with the business.
      • Select the most suitable architecture pattern to ensure the data warehouse is “built right” at the very beginning.

      Build Your Data Quality Program

      Establish Data Governance

      Build a Data Integration Strategy

      Build an Extensible Data Warehouse Foundation

      3.1.3 Assess data quality

      1 hour

      1. Use your APA survey results (if available) to identify areas where the organization is performing low in data quality initiatives. Common areas for improvement include:
        • Overall data quality management
        • Effective data governance
        • Poor data integration
        • The need to implement extensible data warehousing
      2. Consolidate your optimization strategies in the Get the Most Out of Your CRM Workbook, tab “8. Optimization Roadmap.” (See next slide for screenshot.)

      This is an image of the Business & IT Communications Overview tab from the Get the most out of your CRM Workbook

      Get the Most Out of Your CRM Workbook

      Plan your data quality optimization strategy

      This is a screenshot from the Get the most out of your CRM Workbook, with the Optimization Strategies column  highlighted in a red box.

      Use Info-Tech’s vendor management initiative (VMI)

      Create a right-size, right-fit strategy for managing the vendors relevant to your organization.

      A crowd chart is depicted, with quadrants for strategic value, and Vendor spend/switching cost.

      Info-Tech Insight

      A VMI is a formalized process within an organization, responsible for evaluating, selecting, managing, and optimizing third-party providers of goods and services.

      The amount of resources you assign to managing vendors depends on the number and value of your organization’s relationships. Before optimizing your vendor management program around the best practices presented in this blueprint, assess your current maturity and build the process around a model that reflects the needs of your organization.

      Info-Tech uses VMI interchangeably with the terms “vendor management office (VMO),” “vendor management function,” “vendor management process,” and “vendor management program.”

      Jump Start Your Vendor Management Initiative

      3.1.4 Analyze product satisfaction and vendor management

      1 hour

      1. Use the Get the Most Out of Your CRM Workbook, tab “6. Vendor Optimization.”
      2. Download the SoftwareReviews Vendor Scorecard.
      3. Using the scorecards, compare your results with those of your peers.
      4. Consolidate areas of improvement and optimization strategies in the Get the Most Out of Your CRM Workbook, tab “8. Optimization Roadmap.” (See next slide for screenshot.)

      See previous slide for help around implementing a vendor management initiative.

      This is a screenshot from the Get the most out of your CRM Workbook, with the Areas for Optimization column  highlighted in a red box.

      Get the Most Out of Your CRM Workbook

      Plan your vendor management optimization strategy

      This is a screenshot from the Get the most out of your CRM Workbook, with the Optimization Strategies column  highlighted in a red box.

      Step 3.2

      Compile Optimization Assessment Results

      Activities

      • 3.2.1 Identify key optimization areas

      Build Your Optimization Roadmap

      This step will guide you through the following activities:

      • Use your work from previous activities and prioritization to build your list of optimization activities and lay them out on a roadmap

      This step involves the following participants:

      • CRM Optimization Team

      Outcomes of this step

      • Application optimization plan

      3.2.1 Identify key optimization areas

      1-3 hours

      Before you can make changes and optimization decisions, you need to understand the high-level costs associated with your current application architecture. This activity will help you identify the types of technology and people costs associated with your current systems.

      1. Consolidate your findings and identify optimization priorities (Step 3.1).
      2. Prioritize those most critical to the organization, easiest to change, and whose impact will be highest.
      3. Use the information gathered from exercise 1.5.1 on Get the Most Out of Your CRM Workbook, tab “9. Costs (Optional).”
      4. These costs could affect the priority or timeline of the initiatives. Consolidate your thoughts on your Get the Most Out of Your CRM Workbook, tab 8, “Optimization Roadmap.” Note: There is no column specific to costs on tab 8.

      This is meant as a high-level roadmap. For formal, ongoing optimization project management, refer to “Build a Better Backlog” (Phase 2 of the Info-Tech blueprint Deliver on Your Digital Product Vision).

      This is a screenshot from the Get the most out of your CRM Workbook, with the Priority; Owner; and Timeline columns highlighted in a red box.

      Next steps: Manage your technical debt

      Use a holistic assessment of the “interest” paid on technical debt to quantify and prioritize risk and enable the business make better decisions.

      • Technical debt is an IT risk, which in turn is a category of business risk.
      • The business must decide how to manage business risk.
      • At the same time, business decision makers may not be aware of technical debt or be able to translate technical challenges into business risk. IT must help the business make decisions around IT risk by describing the risk of technical debt in business terms and by outlining the options available to address risk.
      • Measure the ongoing business impact (the “interest” paid on technical debt) to establish the business risk of technical debt. Consider a range of possible impacts including direct costs, lost goodwill, lost flexibility and resilience, and health, safety, and compliance impacts.
      • When weighing these impacts, the business may choose to accept the risk of technical debt if the cost of addressing the debt outweighs the benefit. But it’s critically important that the business accepts that risk – not IT.

      Manage Your Technical Debt

      Take it a step further…

      Deliver on Your Digital Product Vision

      Phase 2: Build a Better Product Backlog

      Build a structure for your backlog that supports your product vision.

      Deliver on Your Digital Product Vision

      Build a better backlog

      An ongoing CRM optimization effort is best facilitated through a continuous Agile process. Use info-Tech’s developed tools to build out your backlog.

      The key to a better backlog is a common structure and guiding principles that product owners and product teams can align to.

      Info-Tech Insight

      Exceptional customer value begins with a clearly defined backlog focused on items that will create the greatest human and business benefits.

      Activity Participants

      Backlog Activity

      Quality Filter

      Product Manager

      Product Owner

      Dev Team

      Scrum Master

      Business

      Architects

      Sprint

      Sprint Planning

      “Accepted”

      Ready

      Refine

      “Ready”

      Qualified

      Analysis

      “Qualified”

      Ideas

      Intake

      “Backlogged”

      A product owner and the product backlog are critical to realize the benefits of Agile development

      A product owner is accountable for defining and prioritizing the work that will be of the greatest value to the organization and its customers. The backlog is the key to facilitating this process and accomplishing the most fundamental goals of delivery.

      For more information on the role of a product owner, see Build a Better Product Owner.

      Highly effective Agile teams spend 28% of their time on product backlog management and roadmapping (Quantitative Software Management, 2015).

      1. Manage Stakeholders

      • Stakeholders need to be kept up to speed on what the future holds for a product, or at least they should be heard. This task falls to the product owner.

      2. Inform and Protect the Team

      • The product owner is a servant leader of the team. They need to protect the team from all the noise and give them the time they need to focus on what they do best: develop.

      3. Maximize Value to the Product

      • Sifting through all of these voices and determining what is valuable, or what is most valuable, falls to the product owner.

      A backlog stores and organizes PBIs at various stages of readiness.

      Your backlog must give you a holistic understanding of demand for change in the product

      A well-formed backlog can be thought of as a DEEP backlog:

      Detailed Appropriately: PBIs are broken down and refined as necessary.

      Emergent: The backlog grows and evolves over time as PBIs are added and removed.

      Estimated: The effort a PBI requires is estimated at each tier.

      Prioritized: The PBI’s value and priority are determined at each tier.

      Ideas; Qualified; Ready

      3 - IDEAS

      Composed of raw, vague, and potentially large ideas that have yet to go through any formal valuation.

      2 - QUALIFIED

      Researched and qualified PBIs awaiting refinement.

      1 - READY

      Discrete, refined PBIs that are ready to be placed in your development teams’ sprint plans.

      Summary of Accomplishment

      Get the Most Out of Your CRM

      CRM technology is critical to facilitate an organization’s relationships with customers, service users, employees, and suppliers. CRM implementation should not be a one-and-done exercise. There needs to be an ongoing optimization to enable business processes and optimal organizational results.

      Get the Most Out of Your CRM allows organizations to proactively implement continuous assessment and optimization of a customer relationship management system. This includes:

      • Alignment and prioritization of key business and technology drivers
      • Identification of CRM processes including classification and gap analysis
      • Measurement of user satisfaction across key departments
      • Improved vendor relations
      • Data quality initiatives

      This formal CRM optimization initiative will drive business-IT alignment, identify IT automation priorities, and dig deep into continuous process-improvement.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

      Contact your account representative for more information

      workshops@infotech.com
      1-866-670-8889

      Research Contributors

      Ben Dickie

      Ben Dickie
      Research Practice Lead
      Info-Tech Research Group

      Ben Dickie is a Research Practice Lead at Info-Tech Research Group. His areas of expertise include customer experience management, CRM platforms, and digital marketing. He has also led projects pertaining to enterprise collaboration and unified communications.

      Scott Bickley

      Scott Bickley
      Practice Lead & Principal Research Director
      Info-Tech Research Group

      Scott Bickley is a Practice Lead & Principal Research Director at Info-Tech Research Group focused on vendor management and contract review. He also has experience in the areas of IT asset management (ITAM), software asset management (SAM), and technology procurement, along with a deep background in operations, engineering, and quality systems management.

      Andy Neil

      Andy Neil
      Practice Lead, Applications
      Info-Tech Research Group

      Andy is Senior Research Director, Data Management and BI, at Info-Tech Research Group. He has over 15 years of experience in managing technical teams, information architecture, data modeling, and enterprise data strategy. He is an expert in enterprise data architecture, data integration, data standards, data strategy, big data, and the development of industry-standard data models.

      Bibliography

      Armel, Kate. “Data-driven Estimation, Management Lead to High Quality.” Quantitative Software Management Inc. 2015. Web.

      Chappuis, Bertil, and Brian Selby. “Looking beyond Technology to Drive Sales Operations.” McKinsey & Company, 24 June 2016. Web.

      Cross-Industry Process Classification Framework (PCF) Version 7.2.1. APQC, 26 Sept. 2019. Web.

      Fleming, John, and Hater, James. “The Next Discipline: Applying Behavioral Economics to Drive Growth and Profitability.” Gallup, 22 Sept. 2012. Accessed 6 Oct. 2020.

      Hinchcliffe, Dion. “The evolving role of the CIO and CMO in customer experience.” ZDNet, 22 Jan. 2020. Web.

      Karlsson, Johan. “Backlog Grooming: Must-Know Tips for High-Value Products.” Perforce. 18 May 2018. Web. Feb. 2019.

      Klie, L. “CRM Still Faces Challenges, Most Speakers Agree: CRM systems have been around for decades, but interoperability and data siloes still have to be overcome.” CRM Magazine, vol. 23, no. 5, 2019, pp. 13-14.

      Kumar, Sanjib, et al. “Improvement of CRM Using Data Mining: A Case Study at Corporate Telecom Sector.” International Journal of Computer Applications, vol. 178, no. 53, 2019, pp. 12-20, doi:10.5120/ijca2019919413.

      Morgan, Blake. “50 Stats That Prove The Value Of Customer Experience.” Forbes, 24 Sept. 2019. Web.

      Norelus, Ernese, et al. “An Approach to Application Modernization: Discovery and Assessment Phase.” IBM Garage, Medium, 24 Feb 2020. Accessed 4 Mar. 2020.

      “Process Frameworks.” APQC, 4 Nov. 2020. Web.

      “Process vs. Capability: Understanding the Difference.” APCQ, 2017. Web.

      Rubin, Kenneth S. "Essential Scrum: A Practical Guide to the Most Popular Agile Process." Pearson Education, 2012.

      Savolainen, Juha, et al. “Transitioning from Product Line Requirements to Product Line Architecture.” 29th Annual International Computer Software and Applications Conference (COMPSAC'05), IEEE, vol. 1, 2005, pp. 186-195, doi: 10.1109/COMPSAC.2005.160

      Smith, Anthony. “How To Create A Customer-Obsessed Company Like Netflix.” Forbes, 12 Dec. 2017. Web.

      “SOA Reference Architecture – Capabilities and the SOA RA.” The Open Group, TOGAF. Web.

      Taber, David. “What to Do When Your CRM Project Fails.” CIO Magazine, 18 Sept. 2017. Web.

      “Taudata Case Study.” Maximizer CRM Software, 17 Jan. 2020. Web.

      Apply Design Thinking to Build Empathy With the Business

      • Buy Link or Shortcode: {j2store}89|cart{/j2store}
      • member rating overall impact: 8.5/10 Overall Impact
      • member rating average dollars saved: $20,772 Average $ Saved
      • member rating average days saved: 13 Average Days Saved
      • Parent Category Name: Innovation
      • Parent Category Link: /innovation
      • Business satisfaction with IT is low.
      • IT and the business have independently evolving strategy, initiatives, and objectives.
      • IT often exceeds their predicted project costs and has difficulty meeting the business’ expectations of project quality and time-to-market.

      Our Advice

      Critical Insight

      • Business needs are unclear or ambiguous.
      • IT and the business do not know how to leverage each other’s talent and resources to meet their common goals.
      • Not enough steps are taken to fully understand and validate problems.
      • IT can’t pivot fast enough when the business’s needs change.

      Impact and Result

      Product, service, and process design should always start with an intimate understanding of what the business is trying to accomplish and why it is important.

      Apply Design Thinking to Build Empathy With the Business Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should apply experience design to partner with the business, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Research

      Identify goals and objectives for experience design, establish targeted stakeholders, and conduct discovery interviews.

      • Apply Design Thinking to Build Empathy With the Business – Phase 1: Research
      • Stakeholder Discovery Interview Template

      2. Map and iterate

      Create the journey map, design a research study to validate your hypotheses, and iterate and ideate around a refined, data-driven understanding of stakeholder problems.

      • Apply Design Thinking to Build Empathy With the Business – Phase 2: Map and Iterate
      • Journey Map Template
      • Research Study Log Tool
      [infographic]

      Workshop: Apply Design Thinking to Build Empathy With the Business

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Introduction to Journey Mapping

      The Purpose

      Understand the method and purpose of journey mapping.

      Key Benefits Achieved

      Initial understanding of the journey mapping process and the concept of end-user empathy.

      Activities

      1.1 Introduce team and discuss workshop motivations and goals.

      1.2 Discuss overview of journey mapping process.

      1.3 Perform journey mapping case study activity.

      Outputs

      Case Study Deliverables – Journey Map and Empathy Maps

      2 Persona Creation

      The Purpose

      Begin to understand the goals and motivations of your stakeholders using customer segmentation and an empathy mapping exercise.

      Key Benefits Achieved

      Understand the demographic and psychographic factors driving stakeholder behavior.

      Activities

      2.1 Discuss psychographic stakeholder segmentation.

      2.2 Create empathy maps for four segments.

      2.3 Generate problem statements.

      2.4 Identify target market.

      Outputs

      Stakeholder personas

      Target market of IT

      3 Interview Stakeholders and Start a Journey Map

      The Purpose

      Get first-hand knowledge of stakeholder needs and start to capture their perspective with a first-iteration journey map.

      Key Benefits Achieved

      Capture the process stakeholders use to solve problems and empathize with their perspectives, pains, and gains.

      Activities

      3.1 Review discovery interviewing techniques.

      3.2 Review and modify the discovery questionnaire

      3.3 Demonstrate stakeholder interview.

      3.4 Synthesize learnings and begin creating a journey map.

      Outputs

      Customized discovery interview template

      Results of discovery interviewing

      4 Complete the Journey Map and Create a Research Study

      The Purpose

      Hypothesize the stakeholder journey, identify assumptions, plan a research study to validate your understanding, and ideate around critical junctures in the journey.

      Key Benefits Achieved

      Understand the stakeholder journey and ideate solutions with the intention of improving their experience with IT.

      Activities

      4.1 Finish the journey map.

      4.2 Identify assumptions and create hypotheses.

      4.3 Discuss field research and hypothesis testing.

      4.4 Design the research study.

      4.5 Discuss concluding remarks and next steps.

      Outputs

      Completed journey map for one IT process, product, or service

      Research study design and action plan

      Set a Strategic Course of Action for the PMO in 100 Days

      • Buy Link or Shortcode: {j2store}356|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $13,744 Average $ Saved
      • member rating average days saved: 19 Average Days Saved
      • Parent Category Name: Project Management Office
      • Parent Category Link: /project-management-office
      • As a new PMO director, you’ve been thrown into the middle of an unfamiliar organizational structure and a chaotic project environment.
      • The expectations are that the PMO will help improve project outcomes, but beyond that your mandate as PMO director is opaque.
      • You know that the statistics around PMO longevity aren’t good, with 50% of new PMOs closing within the first three years. As early in your tenure as possible, you need to make sure that your stakeholders understand the value that your role could provide to the organization with the right level of buy-in and support.
      • Whether you’re implementing a new PMO or taking over an already existing one, you need to quickly overcome these challenges by rapidly assessing your unfamiliar tactical environment, while at the same time demonstrating confidence and effective leadership to project staff, business stakeholders, and the executive layer.

      Our Advice

      Critical Insight

      • The first 100 days are critical. You have a window of influence where people are open to sharing insights and opinions because you were wise enough to seek them out. If you don’t reach out soon, people notice and assume you’re not wise enough to seek them out, or that you don’t think they are important enough to involve.
      • PMOs most commonly stumble when they shortsightedly provide project management solutions to what are, in fact, more complex, systemic challenges requiring a mix of project management, portfolio management, and organizational change management capabilities. If you fail to accurately diagnose pain points and needs in your first days, you could waste your tenure as PMO leader providing well-intentioned solutions to the wrong project problems.
      • You have diminishing value on your time before skepticism and doubt start to erode your influence. Use your first 100 days to define an appropriate mandate for your PMO, get the right people behind you, and establish buy-in for long-term PMO success.

      Impact and Result

      • Develop an action plan to help leverage your first 100 days on the job. Hit the ground running in your new role with an action plan to achieve realistic goals and milestones in your first 100 days. A results-driven first three months will help establish roots throughout the organization that will continue to feed and grow the PMO beyond your first year.
      • Get to know what you don’t know quickly. Use Info-Tech’s advice and tools to perform a triage of every aspect of PMO accountability as well as harvest stakeholder input to ensure that your PMO meets or exceeds expectations and establishes the right solutions to the organization’s project challenges.
      • Solidify the PMO’s long-term mission. Adopt our stakeholder engagement best practices to ensure that you knock on the right doors early in your tenure. Not only do you need to clarify expectations, but you will ultimately need buy-in from key stakeholders as you move to align the mandate, authority, and resourcing needed for long-term PMO success.

      Set a Strategic Course of Action for the PMO in 100 Days Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out how capitalizing on your first 100 days as PMO leader can help ensure the long-term success of your PMO.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Survey the project landscape

      Get up-to-speed quickly on key PMO considerations by engaging PMO sponsors, assessing stakeholders, and taking stock of your PMO inventory.

      • Set a Strategic Course of Action for the PMO in 100 Days – Phase 1: Survey the Project Landscape
      • Mission Identification and Inventory Tool
      • PMO Director First 100 Days Timeline - MS Project
      • PMO Director First 100 Days Timeline - MS Excel

      2. Gather PMO requirements

      Make your first major initiative as PMO director be engaging the wider pool of PMO stakeholders throughout the organization to determine their expectations for your office.

      • Set a Strategic Course of Action for the PMO in 100 Days – Phase 2: Gather PMO Requirements
      • PMO Requirements Gathering Tool
      • PMO Course of Action Stakeholder Interview Guide

      3. Solidify your PPM goals

      Review the organization’s current PPM capabilities in order to identify your ability to meet stakeholder expectations and define a sustainable mandate.

      • Set a Strategic Course of Action for the PMO in 100 Days – Phase 3: Solidify Your PPM Goals
      • Project Portfolio Management Maturity Assessment Workbook
      • Project Management Maturity Assessment Workbook
      • Organizational Change Management Maturity Assessment Workbook
      • PMO Strategic Expectations Glossary

      4. Formalize the PMO’s mandate

      Communicate your strategic vision for the PMO and garner stakeholder buy-in.

      • Set a Strategic Course of Action for the PMO in 100 Days – Phase 4: Formalize the PMO's Mandate
      • PMO Mandate and Strategy Roadmap Template
      • PMO Director Peer Feedback Evaluation Template
      • PMO Director First 100 Days Self-Assessment Tool
      [infographic]

      Workshop: Set a Strategic Course of Action for the PMO in 100 Days

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Assess the Current Project Ecosystem

      The Purpose

      Quickly develop an on-the-ground view of the organization’s project ecosystem and the PMO’s abilities to effectively serve.

      Key Benefits Achieved

      A comprehensive and actionable understanding of the PMO’s tactical environment

      Activities

      1.1 Perform a PMO SWOT analysis.

      1.2 Assess the organization’s portfolio management, project management, and organizational change management capability levels.

      1.3 Take inventory of the PMO’s resourcing levels, project demand levels, and tools and artifacts.

      Outputs

      Overview of current strengths, weaknesses, opportunities, and threats

      Documentation of your current process maturity to execute key portfolio management, project management, and organizational change management functions

      Stock of the PMO’s current access to PPM personnel relative to total project demand

      2 Analyze PMO Stakeholders

      The Purpose

      Determine stakeholder expectations for the PMO.

      Key Benefits Achieved

      An accurate understanding of others’ expectations to help ensure the PMO’s course of action is responsive to organizational culture and strategy

      Activities

      2.1 Conduct a PMO Mission Identification Survey with key stakeholders.

      2.2 Map the PMO’s stakeholder network.

      2.3 Analyze key stakeholders for influence, interest, and support.

      Outputs

      An understanding of expected PMO outcomes

      A stakeholder map and list of key stakeholders

      A prioritized PMO requirements gathering elicitation plan

      3 Determine Strategic Expectations and Define the Tactical Plan

      The Purpose

      Develop a process and method to turn stakeholder requirements into a strategic vision for the PMO.

      Key Benefits Achieved

      A strategic course of action for the PMO that is responsive to stakeholders’ expectations.

      Activities

      3.1 Assess the PMO’s ability to support stakeholder expectations.

      3.2 Use Info-Tech’s PMO Strategic Expectations glossary to turn raw process and service requirements into specific strategic expectations.

      3.3 Define an actionable tactical plan for each of the strategic expectations in your mandate.

      Outputs

      An understanding of PMO capacity and limits

      A preliminary PMO mandate

      High-level statements of strategy to help support your mandate

      4 Formalize the PMO’s Mandate and Roadmap

      The Purpose

      Establish a final PMO mandate and a process to help garner stakeholder buy-in to the PMO’s long-term vision.

      Key Benefits Achieved

      A viable PMO course of action complete with stakeholder buy-i

      Activities

      4.1 Finalize the PMO implementation timeline.

      4.2 Finalize Info-Tech’s PMO Mandate and Strategy Roadmap Template.

      4.3 Present the PMO’s strategy to key stakeholders.

      Outputs

      A 3-to-5-year implementation timeline for key PMO process and staffing initiatives

      A ready-to-present strategy document

      Stakeholder buy-in to the PMO’s mandate

      2021 IT Talent Trend Report

      • Buy Link or Shortcode: {j2store}516|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: $9,919 Average $ Saved
      • member rating average days saved: 2 Average Days Saved
      • Parent Category Name: Lead
      • Parent Category Link: /lead
      • In March 2020, many organizations were forced to switch to a virtual working world. IT enabled organizations to be successful while working from home. Ultimately, this shift changed the way that we all work, and in turn, the way IT leaders manage talent.
      • Many organizations are considering long-term remote work (Kelly, 2020).
      • Change is starting but is lagging.

      Our Advice

      Critical Insight

      • Increase focus on employee experience to navigate new challenges.
      • A good employee experience is what is best for the IT department.

      Impact and Result

      • The data shows IT is changing in the area of talent management.
      • IT has a large role in enabling organizations to work from home, especially from a technological and logistics perspective. There is evidence to show that they are now expanding their role to better support employees when working from home.
      • Survey respondents identified efforts already underway for IT to improve employee experience and subsequently, IT effectiveness.

      2021 IT Talent Trend Report Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should focus on the employee experience and get an overview of what successful IT leaders are doing differently heading into 2021 – the five new talent management trends.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. DEI: A top talent objective

      The focus on diversity, equity, and inclusion (DEI) initiatives spans the entire organization beyond just HR. Learn which DEI efforts are underway with IT.

      • 2021 IT Talent Trend Report – Trend 1: DEI: A Top Talent Objective

      2. Remote work is here to stay

      Forced work-from-home demonstrated to organizations that employees can be productive while working away from the physical office. Learn more about how remote work is changing work.

      • 2021 IT Talent Trend Report – Trend 2: Remote Work Is Here to Stay

      3. A greater emphasis on wellbeing

      When the pandemic hit, organizations were significantly concerned about how employees were doing. Learn more about wellbeing.

      • 2021 IT Talent Trend Report – Trend 3: A Greater Emphasis on Wellbeing

      4. A shift in skills priorities

      Upskilling and finding sought after skills were challenging before the pandemic. How has it changed since? Learn more about skills priorities.

      • 2021 IT Talent Trend Report – Trend 4: A Shift in Skills Priorities

      5. Uncertainty unlocks performance

      The pandemic and remote work has affected performance. Learn about how uncertainty has impacted performance management.

      • 2021 IT Talent Trend Report – Trend 5: Uncertainty Unlocks Performance
      [infographic]

      Select an ERP Implementation Partner

      • Buy Link or Shortcode: {j2store}591|cart{/j2store}
      • member rating overall impact: 9.5/10 Overall Impact
      • member rating average dollars saved: $77,174 Average $ Saved
      • member rating average days saved: 17 Average Days Saved
      • Parent Category Name: Enterprise Resource Planning
      • Parent Category Link: /enterprise-resource-planning
      • Enterprise application implementations are complex, and their success is critical to business operations.
      • Selecting the right software implementation partner is as important for the success of the ERP initiative as selecting the right software.
      • System implementation often thrusts the product into the spotlight, with the implementation partner being an afterthought, and all too often organizational needs are ignored altogether.

      Our Advice

      Critical Insight

      • ERP implementation is not a one-and-done exercise. Most often it is the start of a multi-year working relationship between the software vendor or systems integrator and your organization. Take the time to find the right fit to ensure success.
      • The conventional approach to ERP implementation partner selection puts the ERP vendor and systems integrators in the driver's seat with little regard to your specific needs as an organization. You need to take an eyes-wide-open approach to your organization’s strengths and weaknesses to properly select and manage the implementation partner relationship.
      • Self-assessment is the critical first step in a successful implementation. Every organization has a unique combination of critical success factors (CSFs) that will be required to unlock the potential of their ERP. You must find the right partner or partners whose strengths complement your weaknesses to ensure your success.
      • Before you start knocking on vendors’ doors, ensure you have a holistic request that encompasses the strategic, tactical, operational, and commodity factors required for the success of your ERP implementation.

      Impact and Result

      • Use Info-Tech’s implementation partner selection process to find the right fit for your organization.
      • Understand the enterprise application CSFs and determine the unique requirements of your organization through this lens.
      • Define your implementation partner requirements separately from your software requirements and allow vendors to respond to those specifically.
      • Use our assessment tools to score and assess the CSFs required to select the right software implementation partners.

      Select an ERP Implementation Partner Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should focus on selecting the right implementation partner, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Identify your strategic needs

      Review the CSFs that are of strategic importance. Evaluating the gaps in your organization's capabilities enables you to choose a partner that can properly support you in your project.

      • Select an ERP Implementation Partner Workbook

      2. Review your tactical, commodity, and operational needs

      Review the CSFs that are of tactical, commodity, and operational importance. Evaluating the gaps in your organization's capabilities enables you to choose a partner that can properly support you in your project.

      3. Build your RFx and evaluate the responses

      Review your RFx and build an initial list of vendor/implementors to reach out to. Finally, build your evaluation checklist to rate the incoming responses.

      • Short-Form RFP Template
      • Long-Form RFP Template
      • Lean RFP Template
      • Supplementary RFx Material
      • RFx Vendor Evaluation Tool
      [infographic]

      Workshop: Select an ERP Implementation Partner

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify Organizational Strategic Needs

      The Purpose

      Review the critical success factors that are of strategic importance. Evaluating the gaps in your organization's capabilities enables you to choose a partner that can properly support you in your project.

      Key Benefits Achieved

      ERP strategy model defined

      Strategic needs identified

      Activities

      1.1 Review the business context.

      1.2 Build your ERP strategy model.

      1.3 Assess your strategic needs.

      Outputs

      ERP strategy model

      ERP strategy model

      Strategic needs analysis

      2 Review Your Tactical, Commodity, and Operational Needs

      The Purpose

      Review the critical success factors that are of tactical, commodity, and operational importance. Evaluating the gaps in your organization's capabilities enables you to choose a partner that can properly support you in your project.

      Key Benefits Achieved

      Tactical, commodity, and operational needs identified

      Activities

      2.1 Assess your tactical needs.

      2.2 Assess your commodity needs.

      2.3 Assess your operational needs.

      Outputs

      Tactical needs analysis

      Commodity needs analysis

      Operational needs analysis

      3 Build Your RFx

      The Purpose

      Review your RFx and build an initial list of vendor/implementors to reach out to. Finally, build your evaluation checklist to rate the incoming responses.

      Key Benefits Achieved

      Draft RFI or RFP

      Target vendor list

      Activities

      3.1 Decide on an RFI or RFP.

      3.2 Complete the RFx with the needs analysis.

      3.3 Build a list of targeted vendors

      Outputs

      Draft RFI or RFP

      Draft RFI or RFP

      Target vendor list

      4 Evaluate Vendors

      The Purpose

      Build a scoring template for use in vendor evaluation to ensure consistent comparison criteria are used.

      Key Benefits Achieved

      A consistent and efficient evaluation process

      Activities

      4.1 Assign weightings to the evaluation criteria.

      4.2 Run a vendor evaluation simulation to validate the process.

      Outputs

      Completed partner evaluation tool

      Prepare for Negotiations More Effectively

      • Buy Link or Shortcode: {j2store}224|cart{/j2store}
      • member rating overall impact: 8.0/10 Overall Impact
      • member rating average dollars saved: $6,000 Average $ Saved
      • member rating average days saved: 4 Average Days Saved
      • Parent Category Name: Vendor Management
      • Parent Category Link: /vendor-management
      • IT budgets are increasing, but many CIOs feel their budgets are inadequate to accomplish what is being asked of them.
      • Eighty percent of organizations don’t have a mature, repeatable, scalable negotiation process.
      • Training dollars on negotiations are often wasted or ineffective.

      Our Advice

      Critical Insight

      • Negotiations are about allocating risk and money – how much risk is a party willing to accept at what price point?
      • Using a cross-functional/cross-insight team structure for negotiation preparation yields better results.
      • Soft skills aren’t enough and theatrical negotiation tactics aren’t effective.

      Impact and Result

      A good negotiation process can help:

      • Maximize budget dollars.
      • Improve vendor performance.
      • Enhance relationships internally and externally.

      Prepare for Negotiations More Effectively Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should create and follow a scalable process for preparing to negotiate with vendors, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Before

      Throughout this phase, the 12 steps for negotiation preparation are identified and reviewed.

      • Prepare for Negotiations More Effectively – Phase 1: Before
      • Before Negotiating Tool
      [infographic]

      Workshop: Prepare for Negotiations More Effectively

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 12 Steps to Better Negotiation Preparation

      The Purpose

      Improve negotiation preparation.

      Understand how to use the Info-Tech Before Negotiating Tool.

      Key Benefits Achieved

      A scalable framework for negotiation preparation will be created.

      The Before Negotiating Tool will be configured for the customer’s environment.

      Activities

      1.1 Establish specific negotiation goals and ranges.

      1.2 Identify and assess alternatives to a negotiated agreement.

      1.3 Identify and evaluate assumptions made by the parties.

      1.4 Conduct research.

      1.5 Identify and evaluate relationship issues.

      1.6 Identify and leverage the team structure.

      1.7 Identify and address leverage issues.

      1.8 Evaluate timeline considerations.

      1.9 Create a strategy.

      1.10 Draft a negotiation agenda.

      1.11 Draft and answer questions.

      1.12 Rehearse (informal and formal).

      Outputs

      Sample negotiation goals and ranges will be generated via a case study to demonstrate the concepts and how to use the Before Negotiating Tool (this will apply to each Planned Activity)

      Sample alternatives will be generated

      Sample assumptions will be generated

      Sample research will be generated

      Sample relationship issues will be generated

      Sample teams will be generated

      Sample leverage items will be generated

      Sample timeline issues will be generated

      A sample strategy will be generated

      A sample negotiation agenda will be generated

      Sample questions and answers will be generated

      Sample rehearsals will be conducted

      2024 Tech Trends

      • Buy Link or Shortcode: {j2store}289|cart{/j2store}
      • member rating overall impact: 10
      • Parent Category Name: Innovation
      • Parent Category Link: /improve-your-core-processes/strategy-and-governance/innovation

      AI has revolutionized the landscape, placing the spotlight firmly on the generative enterprise.

      The far-reaching impact of generative AI across various sectors presents fresh prospects for organizations to capitalize on and novel challenges to address as they chart their path for the future. AI is more than just a fancy auto-complete. At this point it may look like that, but do not underestimate the evolutive power.

      In this year's Tech Trends report, we explore three key developments to capitalize on these opportunities and three strategies to minimize potential risks.

      Generative AI will take the lead.

      As AI transforms industries and business processes, IT and business leaders must adopt a deliberate and strategic approach across six key domains to ensure their success.

      Seize Opportunities:

      • Business models driven by AI
      • Automation of back-office functions
      • Advancements in spatial computing

      Mitigate Risks:

      • Ethical and responsible AI practices
      • Incorporating security from the outset
      • Ensuring digital sovereignty

      Create a Game Plan to Implement Cloud Backup the Right Way

      • Buy Link or Shortcode: {j2store}469|cart{/j2store}
      • member rating overall impact: 7.0/10 Overall Impact
      • member rating average dollars saved: $2,000 Average $ Saved
      • member rating average days saved: 5 Average Days Saved
      • Parent Category Name: Storage & Backup Optimization
      • Parent Category Link: /storage-and-backup-optimization
      • Cloud adoption is frequently driven by hype rather than careful consideration of the best-fit solution.
      • IT is frequently rushed into cloud adoption without appropriate planning.
      • Organizations frequently lack appropriate strategies to deal with cloud-specific backup challenges.
      • Insufficient planning for cloud backup can exacerbate problems rather than solving them, leading to poor estimates of the cost and effort involved, budget overruns, and failure to meet requirements.

      Our Advice

      Critical Insight

      • The cloud isn’t a magic bullet, but it tends to deliver the most value to organizations with specific use cases – frequently smaller organizations who are looking to avoid the cost of building or upgrading a data center.
      • Cloud backup does not necessarily reduce backup costs so much as it moves them around. Cloud backup distributes costs over a longer term. Organizations need to compare the difference in CAPEX and OPEX to determine if making the move makes financial sense.
      • The cloud can deliver a great deal of value for organizations who are looking to reduce the operational effort demanded by an existing tape library for second- or third-tier backups.
      • Data security risks in some cases may be overstated, depending on what on-premises security is available. However, targeting backup to the cloud introduces other risks that need to be considered before implementation is given the green light.

      Impact and Result

      • Understand if cloud backup is the right solution for actual organizational needs.
      • Make an informed decision about targeting backup to the cloud by considering the big picture TCO and effort level involved in adoption.
      • Have a ready strategy to mitigate the most common challenges with cloud adoption projects.
      • Develop a roadmap that lays out the required step-by-step to implement cloud backup.

      Create a Game Plan to Implement Cloud Backup the Right Way Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Understand the benefits and risks of targeting backups to the cloud

      Build a plan to mitigate the risks associated with backing data up in the cloud.

      • Storyboard: Create a Game Plan to Implement Cloud Backup the Right Way

      2. Determine if the cloud can meet the organization's data requirements

      Assess if the cloud is a good fit for your organization’s backup data.

      • Cloud Backup Implementation Game Plan Tool

      3. Mitigate the Challenges of Backing Up to the Cloud

      Build a cloud challenge contingency plan.

      4. Build a Cloud Backup Implementation Roadmap

      Perform a gap analysis to determine cloud backup implementation initiatives.

      Infographic

      Workshop: Create a Game Plan to Implement Cloud Backup the Right Way

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Evaluate the business case for targeting backup at the cloud

      The Purpose

      Understand how cloud backup will affect backup and recovery processes

      Determine backup and recovery objectives

      Assess the value proposition of cloud backup

      Key Benefits Achieved

      A high-level understanding of the benefits of moving to cloud backup

      A best-fit analysis of cloud backup in comparison to organizational needs

      Activities

      1.1 Document stakeholder goals for cloud backup

      1.2 Document present backup processes

      1.3 Document ideal backup processes

      1.4 Review typical benefits of cloud backup

      Outputs

      Documented stakeholder goals

      Current backup process diagrams

      Ideal backup process diagram

      2 Identify candidate data sets and assess opportunities and readiness

      The Purpose

      Identify candidate data sets for cloud-based backup

      Determine RPOs and RTOs for candidate data sets

      Identify potential value specific to each data set for targeting backup at the cloud

      Evaluate organizational readiness for targeting backup at the cloud

      Key Benefits Achieved

      Documented recovery objectives

      Recommendations for cloud backup based on actual organizational needs and readiness

      Activities

      2.1 Document candidate data sets

      2.2 Determine recovery point and recovery time objectives for candidate data sets

      2.3 Identify potential value of cloud-based backup for candidate data sets

      2.4 Discuss the risk and value of cloud-based backup versus an on-premises solution

      2.5 Evaluate organizational readiness for cloud backup

      2.6 Identify data sets to move to the cloud

      Outputs

      Validated list of candidate data sets

      Specific RPOs and RTOs for core data sets

      An assessment of the value of cloud backup for data sets

      A tool-based recommendation for moving backups to the cloud

      3 Mitigate the challenges of backing up to the cloud

      The Purpose

      Understand different cloud provider models and their specific risks

      Identification of how cloud backup will affect IT infrastructure and personnel

      Strategize ways to mitigate the most common challenges of implementing cloud backup

      Understand the client/vendor relationship in cloud backup

      Understand the affect of cloud backup on data security

      Key Benefits Achieved

      Verified best-fit cloud provider model for organizational needs

      Verified strategy for meeting the most common challenges for cloud-based backup

      A strong understanding of how cloud backup will change IT

      Strategies for approaching vendors to ensure a strong footing in negotiations and clear expectations for the client/vendor relationship

      Activities

      3.1 Discuss the impact of cloud backup on infrastructure and IT environment

      3.2 Create a cloud backup risk contingency plan

      3.3 Document compliance and security regulations

      3.4 Identify client and vendor responsibilities for cloud backup

      3.5 Discuss and document the impact of cloud backup on IT roles and responsibilities

      3.6 Compile a list of implementation intiatives

      3.7 Evaluate the financial case for cloud backup

      Outputs

      Cloud risk assessment

      Documented contingency strategies for probabe risks

      Negotiation strategies for dealing with vendors

      A committed go/no-go decision on the value of cloud backup weighted against the effort of implementation

      4 Build a cloud backup implementation roadmap

      The Purpose

      Create a road map for implementing cloud backup

      Key Benefits Achieved

      Determine any remaining gaps between the present state and the ideal state for cloud backup

      Understand the steps and time frame for implementing cloud backup

      Allocate roles and responsibilities for the implementation intitiative

      A validated implementation road map

      Activities

      4.1 Perform a gap analysis to generate a list of implementation intiatives

      4.2 Prioritize cloud backup initiatives

      4.3 Assess risks and dependencies for critical implementation initiatives

      4.4 Assign ownership over implementation tasks

      4.5 Determine road map time frame and structure

      4.6 Populate the roadmap with cloud backup initiatives

      Outputs

      A validated gap analysis

      A prioritized list of cloud backup initiatives

      Documented dependencies and risks associated with implementation tasks

      A roadmap for targeting backups at the cloud

      Create a Data Management Roadmap

      • Buy Link or Shortcode: {j2store}122|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $100,135 Average $ Saved
      • member rating average days saved: 36 Average Days Saved
      • Parent Category Name: Data Management
      • Parent Category Link: /data-management

      Data has quickly become one of the most valuable assets in any organization. But when it comes to strategically and effectively managing those data assets, many businesses find themselves playing catch-up. The stakes are high because ineffective data management practices can have serious consequences, from poor business decisions and missed revenue opportunities to critical cybersecurity risks.

      Successful management and consistent delivery of data assets requires collaboration between the business and IT and the right balance of technology, process, and resourcing solutions.

      Build an effective and collaborative data management practice

      Data management is not one-size-fits-all. Cut through the noise around data management and create a roadmap that is right for your organization:

      • Align data management plans with business requirements and strategic plans.
      • Create a collaborative plan that unites IT and the business in managing data assets.
      • Design a program that can scale and evolve over time.
      • Perform data strategy planning and incorporate data capabilities into your broader plans.
      • Identify gaps in current data services and the supporting environment and determine effective corrective actions.

      This blueprint will help you design a data management practice that builds capabilities to support your organization’s current use of data and its vision for the future.

      Create a Data Management Roadmap Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Create a Data Management Roadmap Storyboard – Use this deck to help you design a data management practice and turn data into a strategic enabler for the organization.

      Effective data delivery and management provides the business with new and improved opportunities to leverage data for business operations and decision making. This blueprint will help you design a data management practice that will help your team build capabilities that align to the business' current usage of data and its vision for the future.

      • Create a Data Management Roadmap – Phases 1-2

      2. Data Management Strategy Planning Tools – Use these tools to align with the business and lay the foundations for the success of your data management practice.

      Begin by using the interview guide to engage stakeholders to gain a thorough understanding of the business’ challenges with data, their strategic goals, and the opportunities for data to support their future plans. From there, these tools will help you identify the current and target capabilities for your data management practice, analyze gaps, and build your roadmap.

      • Data Strategy Planning Interview Guide
      • Data Management Assessment and Planning Tool
      • Data Management Project Charter Template

      3. Stakeholder Communication and Assessment Tools – Use these templates to develop a communication strategy that will convey the value of the data management project to the organization and meet the needs of key stakeholders.

      Strong messaging around the value and purpose of the data management practice is essential to ensure buy-in. Use these templates to build a business case for the project and socialize the idea of data management across the various levels of the organization while anticipating the impact on and reactions from key stakeholders.

      • Data Management Communication/Business Case Template
      • Project Stakeholder and Impact Assessment Tool

      4. Data Management Strategy Work Breakdown Structure Template – Use this template to maintain strong project management throughout your data management project.

      This customizable template will support an organized approach to designing a program that addresses the business’ current and evolving data management needs. Use it to plan and track your deliverables and outcomes related to each stage of the project.

      • Data Management Strategy Work Breakdown Structure Template

      5. Data Management Roadmap Tools – Use these templates to plan initiatives and create a data management roadmap presentation.

      Create a roadmap for your data management practice that aligns to your organization’s current needs for data and its vision for how it wants to use data over the next 3-5 years. The initiative tool guides you to identify and record all initiative components, from benefits to costs, while the roadmap template helps you create a presentation to share your project findings with your executive team and project sponsors.

      • Initiative Definition Tool
      • Data Management Roadmap Template

      6. Track and Measure Benefits Tool – Use this tool to monitor the project’s progress and impact.

      Benefits tracking enables you to measure the effectiveness of your project and make adjustments where necessary to realize expected benefits. This tool will help you track benefit metrics at regular intervals to report progress on goals and identify benefits that are not being realized so that you can take remedial action.

      • Track and Measure Benefits Tool

      Infographic

      Workshop: Create a Data Management Roadmap

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Develop Data Strategies

      The Purpose

      Understand the business’s vision for data and the role of the data management practice.

      Determine business requirements for data.

      Map business goals and strategic plans to create data strategies.

      Key Benefits Achieved

      Understanding of business’s vision for data

      Unified vision for data management (business and IT)

      Identification of the business’s data strategies

      Activities

      1.1 Establish business context for data management.

      1.2 Develop data management principles and scope.

      1.3 Develop conceptual data model (subject areas).

      1.4 Discuss strategic information needs for each subject area.

      1.5 Develop data strategies.

      1.6 Identify data management strategies and enablers.

      Outputs

      Practice vision

      Data management guiding principles

      High-level data requirements

      Data strategies for key data assets

      2 Assess Data Management Capabilities

      The Purpose

      Determine the current and target states of your data management practice.

      Key Benefits Achieved

      Clear understanding of current environment

      Activities

      2.1 Determine the role and scope of data management within the organization.

      2.2 Assess current data management capabilities.

      2.3 Set target data management capabilities.

      2.4 Identify performance gaps.

      Outputs

      Data management scope

      Data management capability assessment results

      3 Analyze Gaps and Develop Improvement Initiatives

      The Purpose

      Identify how to bridge the gaps between the organization’s current and target environments.

      Key Benefits Achieved

      Creation of key strategic plans for data management

      Activities

      3.1 Evaluate performance gaps.

      3.2 Identify improvement initiatives.

      3.3 Create preliminary improvement plans.

      Outputs

      Data management improvement initiatives

      4 Design Roadmap and Plan Implementation

      The Purpose

      Create a realistic and action-oriented plan for implementing and improving the capabilities for data management.

      Key Benefits Achieved

      Completion of a Data Management Roadmap

      Plan for how to implement the roadmap’s initiatives

      Activities

      4.1 Align data management initiatives to data strategies and business drivers.

      4.2 Identify dependencies and priorities

      4.3 Build a data management roadmap (short and long term)

      4.4 Create a communication plan

      Outputs

      Data management roadmap

      Action plan

      Communication plan

      Further reading

      Contents

      Executive Brief
      Analyst Perspective
      Executive Summary
      Phase 1: Build Business and User Context
      Phase 2: Assess Data Management and Build Your Roadmap
      Additional Support
      Related Research
      Bibliography

      Create a Data Management Roadmap

      Ensure the right capabilities to support your data strategy.

      EXECUTIVE BRIEF

      Analyst Perspective

      Establish a data management program to realize the data strategy vision and data-driven organization.

      Data is one of the most valuable organizational assets, and data management is the foundation – made up of plans, programs, and practices – that delivers, secures, and enhances the value of those assets.

      Digital transformation in how we do business and innovations like artificial intelligence and automation that deliver exciting experiences for our customers are all powered by readily available, trusted data. And there’s so much more of it.

      A data management roadmap designed for where you are in your business journey and what’s important to you provides tangible answers to “Where do we start?” and “What do we do?”

      This blueprint helps you build and enhance data management capabilities as well as identify the next steps for evaluating, strengthening, harmonizing, and optimizing these capabilities, aligned precisely with business objectives and data strategy.

      Andrea Malick
      Director, Research & Advisory, Data & Analytics Practice
      Info-Tech Research Group

      Frame the problem

      Who this research is for
      • Data management professionals looking to improve the organization’s ability to leverage data in value-added ways
      • Data governance managers and data analysts looking to improve the effectiveness and value of their organization’s data management practice
      This research will help you
      • Align data management plans with business requirements and strategic plans.
      • Create a collaborative plan that unites IT and the business in managing the organization’s data assets.
      • Design a data management program that can scale and evolve over time.
      This research will also assist
      • Business leaders creating plans to leverage data in their strategic planning and business processes
      • IT professionals looking to improve the environment that manages and delivers data
      This research will also help you
      • Perform data strategy planning and incorporate data capabilities and plans into your broader plans.
      • Identify gaps in current data services and the supporting environment and determine effective corrective actions.

      Executive Summary

      Your Challenge
      • The organizational appetite for data is increasing, with growing demands for data to better support business processes and inform decision making.
      • For data to be accessible and trustworthy for the business it must be effectively managed throughout its lifecycle.
      • With so much data circulating throughout our systems and a steady flow via user activity and business activities, it is imperative that we understand our data environment, focus our data services and oversight on what really matters, and work closely with business leads to ensure data is an integral part of the digital solution.
      Common Obstacles
      • Despite the growing focus on data, many organizations struggle to develop an effective strategy for managing their data assets.
      • Successful management and consistent delivery of data assets throughout their lifecycle requires the collaboration of the business and IT and the balance of technology, process, and resourcing solutions.
      • Employees are doing their best to just get things done with their own spreadsheets and familiar patterns of behavior. It takes leadership to pause those patterns and take a thoughtful enterprise and strategic approach to a more streamlined – and transformed – business data service.
      Info-Tech’s Approach
      • Incremental approach: Building a mature and optimized practice doesn’t occur overnight – it takes time and effort. Use this blueprint’s approach and roadmap results to support your organization in building a practice that prioritizes scope, increases the effectiveness of your data management practice, and improves your alignment with business data needs.
      • Build smart: Don’t do data management for data management’s sake; instead, align it to business requirements and the business’ vision for the organization’s data. Ensure initiatives and program investments best align to business priorities and support the organization in becoming more data driven and data centric.

      Info-Tech Insight

      Use value streams and business capabilities to develop a prioritized and practical data management plan that provides the highest business satisfaction in the shortest time.

      Full page illustration of the 'Create a Data Management Roadmap' using the image of a cargo ship labelled 'Data Management' moving in the direction of 'Business Strategy'. The caption at the top reads 'Data Management capabilities create new business value by augmenting data & optimizing it for analytics. Data is a digital imprint of organizational activities.'

      Data Management Capabilities

      A similar concept to the last one, with a ship moving toward 'Business Strategy', except the ship is cross-sectioned with different capabilities filling the interior of the silhouette. Below are different steps in data management 'Data Creation', 'Data Ingestion', 'Data Accumulation, 'Data Augmentation', 'Data Delivery', and 'Data Consumption'.

      Data is a business asset and needs to be treated like one

      Data management is an enabler of the business and therefore needs to be driven by business goals and objectives. For data to be a strategic asset of the business, the business and IT processes that support its delivery and management must be mature and clearly executed.

      Business Drivers
      1. Client Intimacy/Service Excellence
      2. Product and Service Innovations
      3. Operational Excellence
      4. Risk and Compliance Management
      Data Management Enablers
      • Data Governance
      • Data Strategy Planning
      • Data Architecture
      • Data Operations Management
      • Data Risk Management
      • Data Quality Management

      Industry spotlight: Risk management in the financial services sector

      REGULATORY
      COMPLIANCE

      Regulations are the #1 driver for risk management.

      US$11M:

      Fine incurred by a well-known Wall Street firm after using inaccurate data to execute short sales orders.
      “To successfully leverage customer data while maintaining compliance and transparency, the financial sector must adapt its current data management strategies to meet the needs of an ever-evolving digital landscape.” (Phoebe Fasulo, Security Scorecard, 2021)

      Industry spotlight: Operational excellence in the public sector

      GOVERNMENT
      TRANSPARENCY

      With frequent government scandals and corruption dominating the news, transparency to the public is quickly becoming a widely adopted practice at every level of government. Open government is the guiding principle that the public has access to the documents and proceedings of government to allow for effective public oversight. With growing regulations and pressure from the public, governments must adopt a comprehensive data management strategy to ensure they remain accountable to their rate payers, residents, businesses, and other constituents.

      1. Transparency Transparency is not just about access; it’s about sharing and reuse.
      2. Social and commercial value Everything from finding your local post office to building a search engine requires access to data.
      3. Participatory government Open data enables citizens to be more directly informed and involved in decision making.

      Industry spotlight: Operational excellence and client intimacy in major league sports

      SPORTS
      ANALYTICS

      A professional sports team is essentially a business that is looking for wins to maximize revenue. While they hope for a successful post-season, they also need strong quarterly results, just like you. Sports teams are renowned for adopting data-driven decision making across their organizations to do everything from improving player performance to optimizing tickets sales. At the end of the day, to enable analytics you must have top-notch information management.

      Team Performance Benefits
      1. Talent identification
      2. In-game decision making
      3. Injury reduction
      4. Athlete performance
      5. Bargaining agreement
      Team Performance Benefits
      1. Fan engagement
      2. Licensing
      3. Sports gambling
      (Deloitte Insights, 2020)
      Industry leaders cite data, and the insights they glean from it, as their means of standing apart from their competitors.

      Industry spotlight: Operational excellence and service delivery within manufacturing and supply chain services

      SUPPLY CHAIN
      EFFICIENCY

      Data offers key insights and opportunities when it comes to supply chain management. The supply chain is where the business strategy gets converted to operational service delivery of the business. Proper data management enables business processes to become more efficient, productive, and profitable through the greater availability of quality data and analysis.

      Fifty-seven percent of companies believe that supply chain management gives them a competitive advantage that enables them to further develop their business (FinancesOnline, 2021).

      Involving Data in Your Supply Chain

      25%

      Companies can reap a 25% increase in productivity, a 20% gain in space usage, and a 30% improvement in stock use efficiency if they use integrated order processing for their inventory system.

      36%

      Thirty-six percent of supply chain professionals say that one of the top drivers of their analytics initiatives is the optimization of inventory management to balance supply and demand.
      (Source: FinancesOnline, 2021)

      Industry spotlight: Intelligent product innovation and strong product portfolios differentiate consumer retailers and CPGs

      INFORMED PRODUCT
      DEVELOPMENT
      Consumer shopping habits and preferences are notoriously variable, making it a challenge to develop a well-received product. Information and insights into consumer trends, shopping preferences, and market analysis support the probability of a successful outcome.

      Maintaining a Product Portfolio
      What is selling? What is not selling?

      Product Development
      • Based on current consumer buying patterns, what will they buy next?
      • How will this product be received by consumers?
      • What characteristics do consumers find important?
      A combination of operational data and analytics data is required to accurately answer these questions.
      Internal Data
      • Organizational sales performance
      External Data
      • Competitor performance
      • Market analysis
      • Consumer trends and preferences
      Around 75% of ideas fail for organizational reasons – viability or feasibility or time to market issues. On the other hand, around 20% of product ideas fail due to user-related issues – not valuable or usable (Medium, 2020).

      Changes in business and technology are changing how organizations use and manage data

      The world moves a lot faster today

      Businesses of today operate in real time. To maintain a competitive edge, businesses must identify and respond quickly to opportunities and events.

      To effectively do this businesses must have accurate and up-to-date data at their fingertips.

      To support the new demands around data consumption, data velocity (pace in which data is captured, organized, and analyzed) must also accelerate.

      Data Management Implications
      • Strong integration capabilities
      • Intelligent and efficient systems
      • Embedded data quality management
      • Strong transparency into the history of data and its transformation

      Studies and projections show a clear case of how data and its usage will grow and evolve.

      Zettabyte Era

      64.2

      More Data

      The amount of data created, consumed, and stored globally is forecast to increase rapidly, reaching 64.2 zettabytes in 2020 and projected to grow to over 180 zettabyes in 2025 (Statista, 2021).

      Evolving Technologies

      $480B

      Cloud Proliferation

      Global end-user spending on public cloud services is expected to exceed $480 billion next year (Info-Tech, 2021).

      To differentiate and remain competitive in today’s marketplace, organizations are becoming more data-driven

      Pyramid with a blue tip. Sublevels from top down are labelled 'Analytical Companies', 'Analytical Aspirations', 'Localized Analytics', and 'Analytically Impaired'.

      Analytic Competitor

      “Given the unforgiving competitive landscape, organizations have to transform now, and correctly. Winning requires an outcome-focused analytics strategy.” (Ramya Srinivasan, Forbes, 2021)
      Data and the use of data analytics has become a centerpiece to effective modern business. Top-performing organizations across a variety of industries have been cited as using analytics five times more than lower performers (MIT Sloan).

      The strategic value of data

      Power intelligent and transformative organizational performance through leveraging data.

      Respond to industry disruptors

      Optimize the way you serve your stakeholders and customers

      Develop products and services to meet ever-evolving needs

      Manage operations and mitigate risk

      Harness the value of your data

      Despite investments in data initiatives, organizations are carrying high levels of data debt

      Data debt is the accumulated cost that is associated with the suboptimal governance of data assets in an enterprise, like technical debt.

      Data debt is a problem for 78% of organizations.

      40%

      of organizations say individuals within the business do not trust data insights.

      66%

      of organizations say a backlog of data debt is impacting new data management initiatives.

      33%

      of organizations are not able to get value from a new system or technology investment.

      30%

      of organizations are unable to become data-driven.

      (Source: Experian, 2020)

      The journey to being data-driven

      The journey to becoming a data-driven organization requires a pit stop at data enablement.

      The Data Economy

      Diagram of 'The Data Economy' with three points on an arrow. 'Data Disengaged: You have a low appetite for data and rarely use data for decision making.' 'Data Enabled: Technology, data architecture, and people and processes are optimized and supported by data governance.' 'Data Driven: You are differentiating and competing on data and analytics, described as a “data first” organization. You’re collaborating through data. Data is an asset.'

      Measure success to demonstrate tangible business value

      Put data management into the context of the business:
      • Tie the value of data management and its initiatives back to the business capabilities that are enabled.
      • Leverage the KPIs of those business capabilities to demonstrate tangible and measurable value. Use terms and language that will resonate with senior leadership.

      Don’t let measurement be an afterthought:

      Start substantiating early on how you are going to measure success as your data management program evolves.

      Build a right-sized roadmap

      Formulate an actionable roadmap that is right-sized to deliver value in your organization.

      Key considerations:
      • When building your data management roadmap, ensure you do so through an enterprise lens. Be cognizant of other initiatives that might be coming down the pipeline that may require you to align your data governance milestones accordingly.
      • Apart from doing your planning with consideration for other big projects or launches that might be in-flight and require the time and attention of your data management partners, also be mindful of the more routine yet still demanding initiatives.
      • When doing your roadmapping, consider factors like the organization’s fiscal cycle, typical or potential year-end demands, and monthly/quarterly reporting periods and audits. Initiatives such as these are likely to monopolize the time and focus of personnel key to delivering on your data management milestones
      Sample milestones:
      • Data Management Leadership & Org Structure Definition
        Define the home for data management, as approved by senior leadership.
      • Data Management Charter and Policies
        Create a charter for your program and build/refresh associated policies.
      • Data Culture Diagnostic
        Understand the organization’s current data culture, perception of data, value of data, and knowledge gaps.
      • Use Case Build and Prioritization
        Build a use case that is tied to business capabilities. Prioritize accordingly.
      • Business Data Glossary/Catalog
        Build and/or refresh the business’ glossary for addressing data definitions and standardization issues.
      • Tools & Technology
        Explore the tools and technology offering in the data management space that would serve as an enabler to the program (e.g. RFI, RFP).

      Insight summary

      Overarching insight

      Your organization’s value streams and the associated business capabilities require effectively managed data. Whether building customer service excellence or getting ahead of cyberattacks, a data management practice is the dependable mainstay supporting business operations and transformation.

      Insight 1

      Data – it’s your business.
      Data is a digital imprint of business activities. Data architecture and flows are reflective of the organizational business architecture. Take data management capabilities as seriously as other core business capabilities.

      Insight 2

      Take a data-oriented approach.
      Data management must be data-centric – with technology and functional enablement built around the data and its structure and flows. Maintain the data focus during project’s planning, delivery, and evaluation stages.

      Insight 3

      Get the business into the data business.
      Data is not “IT’s thing.” Just as a bank helps you properly allocate your money to achieve your financial goals, IT will help you implement data management to support your business goals, but the accountability for data resides with the business.

      Tactical insight

      Data management is the program and environment we build once we have direction, i.e. a data strategy, and we have formed an ongoing channel with the guiding voice of the business via data governance. Without an ultimate goal in a strategy or the real requirements of the business, what are we building data systems and processes for? We are used to tech buzz words and placing our hope in promising innovations like artificial intelligence. There are no shortcuts, but there are basic proven actions we can take to meet the digital revolution head on and let our data boost our journey.

      Key deliverable:

      Data Management Roadmap Template

      Use this template to guide you in translating your project's findings and outcomes into a presentation that can be shared with your executive team and project sponsors.

      Sample of the 'Data Management Roadmap Template' key deliverable.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      Data Management Assessment and Planning Tool

      Use this tool to support your team in assessing and designing the capabilities and components of your organization's data management practice. Sample of the 'Data Management Assessment and Planning Tool' deliverable.

      Data Culture Diagnostic and Scorecard

      Sample of the 'Data Culture Diagnostic and Scorecard' deliverable.

      Leverage Info-Tech’s Data Culture Diagnostic to understand how your organization scores across 10 areas relating to data culture.

      Business Capability Map

      This template takes you through a business capability and value stream mapping to identify the data capabilities required to enable them. Sample of the 'Business Capability Map' deliverable.

      Measure the value of this blueprint

      Leverage this blueprint’s approach to ensure your data management initiatives align and support your key value streams and their business capabilities.
      • Aligning your data management program and its initiatives to your organization’s business capabilities is vital for tracing and demonstrating measurable business value for the program.
      • This alignment of data management with value streams and business capabilities enables you to use business-defined KPIs and demonstrate tangible value.

      Project outcome

      Metric

      Timely data delivery Time of data delivery to consumption
      Improved data quality Data quality scorecard metrics
      Data provenance transparency Time for data auditing (from report/dashboard to the source)
      New reporting and analytic capabilities Number of level 2 business capabilities implemented as solutions
      In Phase 1 of this blueprint, we will help you establish the business context, define your business drivers and KPIs, and understand your current data management capabilities and strengths.

      In Phase 2, we will help you develop a plan and a roadmap for addressing any gaps and improving the relevant data management capabilities so that data is well positioned to deliver on those defined business metrics.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Create a Data Management Roadmap project overview

      1. Build Business Context and Drivers for the Data Management Program 2. Assess Data Management and Build Your Roadmap
      Best-Practice Toolkit

      1.1 Review the Data Management Framework

      1.2 Understand and Align to Business Drivers

      1.3 Build High-Value Use Cases

      1.4 Create a Vision

      2.1 Assess Data Management

      2.2 Build Your Data Management Roadmap

      2.3 Organize Business Data Domains

      Guided Implementation
      • Call 1
      • Call 2
      • Call 3
      • Call 4
      • Call 5
      • Call 6
      • Call 7
      • Call 8
      • Call 9
      Phase Outcomes
      • An understanding of the core components of an effective data management program
      • Your organization’s business capabilities and value streams
      • A business capability map for your organization
      • High-value use cases for data management
      • Vision and guiding principles for data management
      • An understanding of your organization’s current data management capabilities
      • Definition of target-state capabilities and gaps
      • Roadmap of priority data management initiatives
      • Business data domains and ownership

      Guided Implementation

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 8 to 12 calls over the course of 4 to 6 months.

      What does a typical GI on this topic look like?

      Phase 1

      Phase 2

      Call #1: Understand drivers, business context, and scope of data management at your organization. Learn about Info-Tech’s approach and resources.

      Call #2: Get a detailed overview of Info-Tech’s approach, framework, Data Culture Diagnostic, and blueprint.

      Call #3:Align your business capabilities with your data management capabilities. Begin to develop a use case framework.

      Call #4:Further discuss alignment of business capabilities to data management capabilities and use case framework.

      Call #5: Assess your current data management capabilities and data environment. Review your Data Culture Diagnostic Scorecard, if applicable.

      Call #6: Plan target state and corresponding initiatives.

      Call #7: Identify program risks and formulate a roadmap.

      Call #8: Identify and prioritize improvements. Define a RACI chart.

      Call #9: Summarize results and plan next steps.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com1-888-670-8889
      Day 1 Day 2 Day 3 Day 4 Day 5
      Activities
      Understand and contextualize

      1.1 Review your data strategy.

      1.2 Learn data management capabilities.

      1.3 Discuss DM capabilities cross-dependencies and interactions.

      1.4 Develop high-value use cases.

      Assess current DM capabilities and set improvement targets

      2.1 Assess you current DM capabilities.

      2.2 Set targets for DM capabilities.

      Formulate and prioritize improvement initiatives

      3.1 Formulate core initiatives for DM capabilities improvement.

      3.2 Discuss dependencies across the initiatives and prioritize them.

      Plan for delivery dates and assign RACI

      4.1 Plan dates and assign RACI for the initiatives.

      4.2 Brainstorm initiatives to address gaps and enable business goals.

      Next steps and wrap-up (offsite)

      5.1 Complete in-progress deliverables from previous four days.

      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Deliverables
      1. Understanding of the data management capabilities and their interactions and logical dependencies
      2. Use cases
      1. DM capability assessment results
      2. DM vision and guiding principles
      1. Prioritized DM capabilities improvement initiatives
      1. DM capabilities improvement roadmap
      2. Business data domains and ownership
      1. Workshop final report with key findings and recommendations

      Full page diagram of the 'Data & Analytics landscape'. Caption reads 'The key to landscaping your data environment lies in ensuring foundational disciplines are optimized in a way that recognizes the interdependency among the various disciplines.' Many foundational disciplines are color-coded to a legend determining whether its 'accountability sits with IT' or 'with the business; CDO'. An arrow labeled 'You Are Here' points to 'Data Management', which is coded in both colors meaning both IT and the business are accountable.

      What is data management and why is it needed?

      “Data management is the development, execution, and supervision of plans, policies, programs and practices that deliver, control, protect and enhance the value of data and information assets throughout their lifecycles.” (DAMA International, 2017)

      Achieving successful management and consistent delivery of data assets throughout their lifecycle requires the collaboration of the business and IT and the balance of technology, process, and resourcing solutions.

      Who:

      This research is designed for:
      • Data management heads and professionals looking to improve their organization’s ability to leverage data in value-added ways.
      • Data management and IT professionals looking to optimize the data environment, from creation and ingestion right through to consumption.

      Are your data management capabilities optimized to support your organization’s data use and demand?

      What is the current situation?

      Situation
      • The volume and variety of data are growing exponentially and show no sign of slowing down.
      • Business landscapes and models are evolving.
      • Users and stakeholders are becoming more and more data-centric, with maturing and demanding expectations.
      Complication
      • Organizations struggle to develop a comprehensive approach to optimizing data management.
      • In their efforts to keep pace with the demands for data, data management groups often adopt a piecemeal approach that includes turning to tools as a means to address the needs.
      • Data architecture, models, and designs fail to deliver real and measurable business impact and value. Technology ROI is not realized.
      Info-Tech Insight

      A data strategy should never be formulated disjointed from the business. Ensure the data strategy aligns with the business strategy and supports the business architecture.

      Info-Tech’s Data Management Framework

      What Is Data Management?

      Data management is the development, execution, and supervision of plans, policies, programs and practices that deliver, control, protect and enhance the value of data and information assets throughout their lifecycles.” (DAMA International, 2017)

      The three-tiered Data Management Framework, tiers are labelled 'Data Management Enablers', 'Information Dimensions', and 'Business Information'.

      Adapted from DAMA-DMBOK and Advanced Knowledge Innovations Global Solutions

      Info-Tech’s Approach

      Info-Tech’s Data Management Framework is designed to show how an organization’s business model sits as the foundation of its data management practice. Drawing from the requirements of the underpinning model, a practice is designed and maintained through the creation and application of the enablers and dimensions of data management.

      Build a data management practice that is centered on supporting the business and its use of key data assets

      Business Resources

      Data subject areas provide high-level views of the data assets that are used in business processes and enable an organization to perform its business functions.

      Classified by specific subjects, these groups reflect data elements that, when used effectively, are able to support analytical and operational use cases of data.

      This layer is representative of the delivery of the data assets and the business’ consumption of the data.

      Data is an integral business asset that exists across all areas of an organization

      Equation stating 'Trustworthy and Usable Data' plus 'Well-Designed and Executed Processes' equals 'Business Capabilities and Functions'.
      Data Management Framework with only the bottom tier highlighted.

      For a data management practice to be effective it ultimately must show how its capabilities and operations better support the business in accessing and leveraging its key data assets.*

      *This project focuses on building capabilities for data management. Leverage our data quality management research to support you in assessing the performance of this model.

      Information dimensions support the different types of data present within an organization’s environment

      Information Dimensions

      Components at the Information Dimensions layer manage the different types of data and information present with an environment.

      At this layer, data is managed based on its type and how the business is looking to use and access the data.

      Custom capabilities are developed at this level to support:

      • Structured data
      • Semi-structured data
      • Unstructured data
      The types, formats, and structure of the data are managed at this level using the data management enablers to support their successful execution and performance.
      Data Management Framework with only the middle tier highlighted.

      Build a data management practice with strong process capabilities

      Use these guiding principles to contextualize the purpose and value for each data management enabler.

      Data Management Framework with only the top tier highlighted.

      Data Management Enablers

      Info-Tech categorizes data management enablers as the processes that guide the management of the organization’s data assets and support the delivery.

      Govern and Direct

      • Ensures data management practices and processes follow the standards and policies outlined for them
      • Manages the executive oversight of the broader practice

      Align and Plan

      • Aligns data management plans to the business’ data requirements
      • Creates the plans to guide the design and execution of data management components

      Build, Acquire, Operate, Deliver, and Support

      • Executes the operations that manage data as it flows through the business environment
      • Manages the business’ risks in relation to its data assets and the level of security and access required

      Monitor and Improve

      • Analyzes the performance of data management components and the quality of business data
      • Creates and execute plans to improve the performance of the practice and the quality and use of data assets

      Use Info-Tech’s assessment framework to support your organization’s data management planning

      Info-Tech employs a consumer-driven approach to requirements gathering in order to support a data management practice. This will create a vision and strategic plan that will help to make data an enabler to the business as it looks to achieve its strategic objectives.

      Data Strategy Planning

      To support the project in building an accurate understanding of the organization’s data requirements and the role of data in its operations (current and future), the framework first guides organizations on a business and subject area assessment.

      By focusing on data usage and strategies for unique data subject areas, the project team will be better able to craft a data management practice with capabilities that will generate the greatest value and proactively handle evolving data requirements.

      Arrow pointing right.

      Data Management Assessment

      To support the design of a fit-for-purpose data management practice that aligns with the business’ data requirements this assessment will guide you in:

      • Determining the target capabilities for the different dimensions of data management.
      • Identifying the interaction dependencies and coordination efforts required to build a successful data management practice.

      Create a Data Management Roadmap

      Phase 1

      Build Business Context and Drivers for the Data Management Program

      Phase 1

      1.1 Review the Data Management Framework

      1.2 Understand and Align to Business Drivers

      1.3 Build High-Value Use Cases

      1.4 Create a Vision

      Phase 2

      2.1 Assess Data Management

      2.2 Build Your Data Management Roadmap

      2.3 Organize Business Data Domains

      This phase will walk you through the following activities:

      • Identify your business drivers and business capabilities.
      • Align data management capabilities with business goals.
      • Define scope and vision of the data management plan.
      • This phase involves the follow

      This phase involves the following participants:

      • Data Management Lead/Information Management Lead, CDO, Data Lead
      • Senior Business Leaders
      • Business SMEs
      • Data Owners, Records Managers, Regulatory Subject Matter Experts (e.g. Legal Counsel, Security)

      Step 1.1

      Review the Data Management Framework

      Activities

      1.1.1 Walk through the main parts of the best-practice Data Management Framework

      This step will guide you through the following activities:

      • Understand the main disciplines and makeup of a best-practice data management program.
      • Determine which data management capabilities are considered high priority by your organization.

      Outcomes of this step

      • A foundation for data management initiative planning that’s aligned with the organization’s business architecture: value streams, business capability map, and strategy map
      Build Business Context and Drivers
      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      Full page diagram of the 'Data & Analytics landscape'. Caption reads 'The key to landscaping your data environment lies in ensuring foundational disciplines are optimized in a way that recognizes the interdependency among the various disciplines.' Many foundational disciplines are color-coded to a legend determining whether its 'accountability sits with IT' or 'with the business; CDO'. An arrow labeled 'You Are Here' points to 'Data Management', which is coded in both colors meaning both IT and the business are accountable.

      Full page illustration of the 'Create a Data Management Roadmap' using the image of a cargo ship labelled 'Data Management' moving in the direction of 'Business Strategy'. The caption at the top reads 'Data Management capabilities create new business value by augmenting data & optimizing it for analytics. Data is a digital imprint of organizational activities.'

      Data Management Capabilities

      A similar concept to the last one, with a ship moving toward 'Business Strategy', except the ship is cross-sectioned with different capabilities filling the interior of the silhouette. Below are different steps in data management 'Data Creation', 'Data Ingestion', 'Data Accumulation, 'Data Augmentation', 'Data Delivery', and 'Data Consumption'.

      Build a Robust & Comprehensive Data Strategy

      Business Strategy

      Organizational Goals & Objectives

      Business Drivers

      Industry Drivers

      Current Environment

      Data Management Capability Maturity Assessment

      Data Culture Diagnostic

      Regulatory and Compliance Requirements

      Data Strategy

      Organizational Drivers and Data Value

      Data Strategy Objectives & Guiding Principles

      Data Strategy Vision and Mission

      Data Strategy Roadmap

      People: Roles and Organizational Structure

      Data Culture & Data Literacy

      Data Management and Tools

      Risk and Feasibility

      Unlock the Value of Data

      Generate Game-Changing Insights

      Fuel Data-Driven Decision Making

      Innovate and Transform With Data

      Thrive and Differentiate With a Data-Driven Culture

      Elevate Organizational Data IQ

      Build a Foundation for Data Valuation

      What is a data strategy and why is it needed?

      • Your data strategy is the vehicle for ensuring data is poised to support your organization’s strategic objectives.
      • For any CDO or equivalent data leader, a robust and comprehensive data strategy is the number one tool in your toolkit for generating measurable business value from data.
      • The data strategy will serve as the mechanism for making high-quality, trusted, and well-governed data readily available and accessible to deliver on your organizational mandate.

      What is driving the need to formulate or refresh your organization’s data strategy?

      Who:

      This research is designed for:

      • Chief Data Officer (CDO) or equivalent
      • Head of Data
      • Chief Analytics Officer (CAO)
      • Head of Digital Transformation
      • CIO

      Info-Tech Insight

      A data strategy should never be formulated disjointed from the business. Ensure the data strategy aligns with the business strategy and supports the business architecture.

      Info-Tech’s Data Governance Framework

      Model of Info-Tech's Data Governance Framework titled 'Key to Data Enablement'. There are inputs, a main Data Governance cycle, and a selection of outputs. The inputs are 'Business Strategy' and 'Data Strategy' injected into the cycle via 'Strategic Goals & Objectives'. The cycle consists of 'Operating Model', 'Policies & Procedures', 'Data Literacy & Culture', 'Enterprise Projects & Services', 'Data Management', 'Data Privacy & Security', 'Data Leadership', and 'Data Ownership & Stewardship'. The latter two are part of 'Enterprise Governance's 'Oversight & Alignment' cycle. Outputs are 'Defined Data Accountability & Responsibility', 'Knowledge & Common Understanding of Data Assets', 'Trust & Confidence in Traceable Data', 'Improved Data ROI & Reduced Data Debt', and 'Support of Ethical Use of Data in a Data-Driven Culture'.

      What is data governance and why is it needed?

      • Data governance is an enabling framework of decision rights, responsibilities, and accountabilities for data assets across the enterprise.
      • It should deliver agreed-upon models that are conducive to your organization’s operating culture, where there is clarity on who can do what with which data and via what means.
      • It is the key enabler for bringing high-quality, trusted, secure, and discoverable data to the right users across your organization.
      • It promotes and drives responsible and ethical use and handling of data while helping to build and foster an organizational culture of data excellence.

      Do you feel there is a clear definition of data accountability and responsibility in your organization?

      Who:

      This research is designed for:

      • Chief Data Officer (CDO) or equivalent
      • Head of Data Governance, Lead Data Governance Officer
      • Head of Data
      • Head of Digital Transformation
      • CIO

      Info-Tech Insight

      Data governance should not sit as an island in your organization. It must continuously align with the organization’s enterprise governance function.

      A diagram titled 'Data Platform Selection - Make complex tasks simple by applying proven methodology to connect businesses to software' with five steps. '1. Formalize a Business Strategy', '2. Identify Platform Specific Considerations', '3. Execute Data Platform Architecture Selection', 'Select Software', 'Achieve Business Goals'.

      Info-Tech’s Data Platform Framework

      Data pipeline for versatile and scalable data delivery

      a diagram showing the path from 'Data Creation' to 'Data Accumulation', to 'Engineering & Augmentation', to 'Data Delivery'. Each step has a 'Fast Lane', 'Operational Lane', and 'Curated Lane'.

      What are the data platform and practice and why are they needed?

      • The data platform and practice are two parts of the data and analytics equation:
        • The practice is about the operating model for data; that is, how stakeholders work together to deliver business value on your data platform. These stakeholders are a combination of business and IT from across the organization.
        • The platform is a combination of the architectural components of the data and analytics landscape that come together to support the role the business plays day to day with respect to data.
      • Don’t jump directly into technology: use Info-Tech tools to solve and plan first.
      • Create a continuous roadmap to implement and evolve your data practice and platform.
      • Promote collaboration between the business and IT by clearly defining responsibilities.

      Does your data platform effectively serve your reporting and analytics capabilities?

      Who:

      This research is designed for:

      • Data and Information Leadership
      • Enterprise Information Architect
      • Data Architect
      • Data Engineer/Modeler

      Info-Tech Insight

      Info-Tech’s approach is driven by business goals and leverages standard data practice and platform patterns. This enables the implementation of critical and foundational data and analytics components first and subsequently facilitates the evolution and development of the practice and platform over time.

      Info-Tech’s Reporting and Analytics Framework

      Formulating an enterprise reporting and analytics strategy requires the business vision and strategies to first be substantiated. Any optimization to the data warehouse, integration, and source layers is in turn driven by the enterprise reporting and analytics strategy.
      A diagram of the 'Reporting and Analytics Framework' with 'Business vision/strategies' fed through four stages beginning with 'Business Intelligence: Reporting & Analytics Strategy', 'Data Warehouse: Data Warehouse/ Data Lake Strategy', 'Integration and Translation: Data Integration Strategy', 'Sources: Source Strategy (Content/Quality)'
      The current states of your integration and warehouse platforms determine what data can be used for BI and analytics.
      Your enterprise reporting and analytics strategy is driven by your organization’s vision and corporate strategy.

      What is reporting and analytics and why is it needed?

      • Reporting and analytics bridges the gap between an organization’s data assets and consumable information that facilitates insight generation and informed or evidence-based decision making.
      • The reporting and analytics strategy drives data warehouse and integration strategies and the data needs to support business decisions.
      • The reporting and analytics strategy ensures that the investment made in optimizing the data environment to support reporting and analytics is directly aligned with the organization’s needs and priorities and hence will deliver measurable business value.

      Do you have a strategy to enable self-serve analytics? What does your operating model look like? Have you an analytics CoE?

      Who:

      This research is designed for:

      • Head of BI and Analytics
      • CIO or Business Unit (BU) Leader looking to improve reporting and analytics
      • Applications Lead

      Info-Tech Insight

      Formulating an enterprise reporting and analytics strategy requires the business vision and strategies to first be substantiated. Any optimization to the data warehouse, integration, and source layer is in turn driven by the enterprise reporting and analytics strategy.

      Info-Tech’s Data Architecture Framework

      Info-Tech’s methodology:
        1. Prioritize your core business objectives and identify your business driver.
        2. Learn how business drivers apply to specific tiers of Info-Tech’s five-tier data architecture model.
        3. Determine the appropriate tactical pattern that addresses your most important requirements.
      Visual diagram of the first two parts of the methodology on the left. Objectives apply to the data architecture model, which appropriates tactical patterns, which leads to a focus.
        1. Select the areas of the five-tier architecture to focus on.
        2. Measure your current state.
        3. Set the targets of your desired optimized state.
        1. Roadmap your tactics.
        2. Manage and communicate change.
      Visual diagram of the third part of the methodology on the left. A roadmap of tactics leads to communicating change.

      What is data architecture and why is it needed?

      • Data architecture is the set of rules, policies, standards, and models that govern and define the type of data collected and how it is used, stored, managed, and integrated within the organization and its database systems.
      • In general, the primary objective of data architecture is the standardization of data for the benefit of the organization.

      Is your architecture optimized to sustainably deliver readily available and accessible data to users?

      Who:

      This research is designed for:

      • Data Architects or their equivalent
      • Enterprise Architects
      • Head of Data
      • CIO
      • Database Administrators

      Info-Tech Insight

      Data architecture is not just about models. Viewing data architecture as just technical data modeling can lead to a data environment that does not aptly serve or support the business. Identify your business’ priorities and adapt your data architecture to those needs.

      A diagram titled 'Build Your Data Quality Program'. '1. Data Quality & Data Culture Diagnostics Business Landscape Exercise', '2. Business Strategy & Use Cases', '3. Prioritize Use Cases With Poor Quality'. 'Info-Tech Insight: As data is ingested, integrated, and maintained in the various streams of the organization's system and application architecture, there are multiple points where the quality of the data can degrade.' A data flow diagram points out how 'Data quality issues can occur at any stage of the data flow', and that it is better to 'Fix data quality root causes here' during the 'Data Creation', 'Data Ingestion', and 'Data Accumulation & Engineering' stages in order 'to prevent expensive cures here' in the 'Data Delivery' and 'Reporting & Analytics' stages.

      What is data quality management and why is it needed?

      • Data is the foundation of decisions made at data-driven organizations.
      • Data quality management ensures that foundation is sustainably solid.
      • If there are problems with the organization’s underlying data, it can have a domino effect on many downstream business functions.
      • The transformational insights that executives are constantly seeking can be uncovered by a data quality practice that makes high-quality, trustworthy information readily available to the business users who need it.

      Do your users have an optimal level of trust and confidence in the quality of the organization’s data?

      Who:

      This research is designed for:

      • Chief Data Officer (CDO) or equivalent Head of Data
      • Chief Analytics Officer (CAO)
      • Head of Digital Transformation
      • CIO

      Info-Tech Insight

      Data quality suffers most at the point of entry. The resulting domino effect of error propagation makes these errors among the most costly forms of data quality errors. Fix data ingestion, whether through improving your application and database design or improving your data ingestion policy, and you will fix a majority of data quality issues.

      Info-Tech’s Enterprise Content Management Framework

      Drivers Governance Information Architecture Process Policy Systems Architecture
      Regulatory, Legal –›
      Efficiency, Cost-Effectiveness –›
      Customer Service –›
      User Experience –›
      • Establish decision-making committee
      • Define and formalize roles (RACI, charter)
      • Develop policies
      • Create business data glossary
      • Decide who approves documents in workflow
      • Operating models
      • Information categories (taxonomy)
      • Classifications, retention periods
      • Metadata (for findability and as tags in automated workflows)
      • Review and approval process, e.g. who approves
      • Process for admins to oversee performance of IM service
      • Process for capturing and classifying incoming documents
      • Audit trails and reporting process
      • Centralized index of data and records to be tracked and managed throughout their lifecycle
      • Data retention policy
      • E-signature policy
      • Email policy
      • Information management policies
      • Access/privacy rules
      • Understand the flow of content through multiple systems (e.g. email, repositories)
      • Define business and technical requirements to select a new content management platform/service
      • Improve integrations
      • Right-size solutions for use case (e.g. DAM)
      • Communication/Change Management
      • Data Literacy

      What is enterprise content management and why is it needed?

      “Enterprise Content Management is the systematic collection and organization of information that is to be used by a designated audience – business executives, customers, etc. Neither a single technology nor a methodology nor a process, it is a dynamic combination of strategies, methods and tools used to capture, manage, store, preserve and deliver information supporting key organizational processes through its entire lifecycle.” (AIIM, 2021)

      • Changing your ECM capabilities is about changing organizational behavior; take an all-hands-on-deck approach to make the most of information gathering, create a vested interest, and secure buy-in.
      • It promotes and drives responsible and ethical use and handling of content while helping to build and foster an organizational culture of information excellence.

      Who:

      This research is designed for:

      • Information Architect
      • Chief Data Officer (CDO)
      • Head of Data, Information Management
      • Records Management
      • CIO

      Info-Tech Insight

      ECM is critical to becoming a digital and modernized operation, where both structured data (such as sales reports) and unstructured content (such as customer sentiment in social media) are brought together for a 360-degree view of the customer or for a comprehensive legal discovery.

      Metadata management/Data cataloging

      Overview

      Metadata is structured information that describes, explains, locates, or otherwise makes it easier to retrieve, use, or manage an information resource. Metadata is often called data about data or information about information (NISO).

      Metadata management is the function that manages and maintains the technology and processes that creates, processes, and stores metadata created by business processes and data.

      90%

      The majority of data is unstructured information like text, video, audio, web server logs, social media, and more (MIT Sloan, 2021).
      As data becomes more unstructured, complex, and manipulated, the importance and value of metadata will grow exponentially and support improved:
      • Data consumption
      • Quality management
      • Risk management

      Value of Effective Metadata Management

      • Supports the traceability of data through an environment.
      • Creates standards and logging that enable information and data to be searchable and cataloged.
      • Metadata schemas enable easier transferring and distribution of data across different environments.
      Data about data: The true value of metadata and the management practices supporting it is its ability to provide deeper understanding and auditability to the data assets and processes of the business.
      Metadata supports the use of:
      Big Data
      Unstructured data
      Content and Documents
      Unstructured and semi-structured data
      Structured data
      Master, reference, etc.

      Critical Success Factors of Metadata Management

      • Consistent and documented data standards and definitions
      • Architectural planning for metadata
      • Incorporation of metadata into system design and the processing of data
      • Technology to support metadata creation, collection, storage, and reviews (metadata repository, meta marts, etc.)

      Info-Tech’s Data Integration Framework

      On one hand…

      Data has massive potential to bring insight to an organization when combined and analyzed in creative ways.

      On the other hand…

      It is difficult to bring data together from different sources to generate insights and prevent stale data.

      How can these two ideas be reconciled?

      Answer: Info-Tech’s Data Integration Onion Framework summarizes an organization’s data environment at a conceptual level and is used to design a common data-centric integration environment.

      A diagram of the 'Data Integration Onion Framework' with five layers: 'Enterprise Business Processes', 'Enterprise Analytics', 'Enterprise Integration', 'Enterprise Data Repositories', and 'Enterprise Data' at the center.
      Info-Tech’s Data Integration Onion Framework
      Data-centric integration is the solution you need to bring data together to break down data silos.

      What is data integration and why is it needed?

      • To get more value from their information, organizations are relying on increasingly more complex data sources. These diverse data sources have to be properly integrated to unlock the full potential of that data.
      • Integrating large volumes of data from the many varied sources in an organization has incredible potential to yield insights, but many organizations struggle with creating the right structure for that blending to take place, and that leads to the formation of data silos.
      • Data-centric integration capabilities can break down organizational silos. Once data silos are removed and all the information that is relevant to a given problem is available, problems with operational and transactional efficiencies can be solved, and value from business intelligence (BI) and analytics can be fully realized.

      Is your integration near real time and scalable?

      Who:

      This research is designed for:

      • Data Engineers
      • Business Analysts
      • Data Architects
      • Head of Data Management
      • Enterprise Architects

      Info-Tech Insight

      Every IT project requires data integration. Any change in the application and database ecosystem requires you to solve a data integration problem.

      Info-Tech’s Master Data Management Framework

      Master data management (MDM) “entails control over Master Data values and identifiers that enable consistent use, across systems, of the most accurate and timely data about essential business entities” (DAMA, 2017).

      The Data Management Framework from earlier with tier 2 item 'Reference and Master' highlighted.

      Fundamental objective of MDM: Enable the business to see one view of critical data elements across the organization.

      Phases of the MDM Framework. 'Phase 1: Build a Vision for MDM' entails a 'Readiness Assessment', then both 'Identify the Master Data Needs of the Business' and 'Create a Strategic Vision'. 'Phase 2: Create a Plan and Roadmap for the Organization’s MDM Program' entails 'Assess Current MDM Capabilities', then 'Initiative Planning', then 'Strategic Roadmap'.

      What is MDM and why is it needed?

      • Master data management (MDM) “entails control over Master Data values and identifiers that enable consistent use, across systems, of the most accurate and timely data about essential business entities” (DAMA, 2017).
      • The fundamental objective of MDM is to enable the business to see one view of critical data elements across the organization.
      • What is included in the scope of MDM?
        • Party data (employees, customers, etc.)
        • Product/service data
        • Financial data
        • Location data

      Is there traceability and visibility into your data’s lineage? Does your data pipeline facilitate that single view across the organization?

      Who:

      This research is designed for:

      • Chief Data Officer (CDO)
      • Head of Data Management, CIO
      • Data Architect
      • Head of Data Governance, Data Officer

      Info-Tech Insight

      Successful MDM requires a comprehensive approach. To be successfully planned, implemented, and maintained it must include effective capabilities in the critical processes and subpractices of data management.

      Data Modeling Framework

      • The framework consists of the business, enterprise, application, and implementation layers.
      • The Business Layer encodes real-world business concepts via the conceptual model.
      • The Enterprise Layer defines all enterprise data asset details and their relationships.
      • The Application Layer defines the data structures as used by a specific application.
      • The Implementation Layer defines the data models and artifacts for use by software tools.
      Data Modeling Framework with items from the 'Implementation Layer' contributing to items in the 'Application Layer' and 'Enterprise Layer' before turning into a 'Conceptual Model' in the 'Business Layer'.

      Model hierarchy

      • The Conceptual data model describes the organization from a business perspective.
      • The Message model is used to describe internal- and external-facing messages and is equivalent to the canonical model.
      • The Enterprise model depicts the whole organization and is divided into domains.
      • The Analytical model is built for specific business use cases.
      • Application models are application-specific operational models.
      Model hierarchy with items from the 'Implementation Layer' contributing to items in the 'Application Layer' and 'Enterprise Layer' before turning into a 'Conceptual Model' in the 'Business Layer'.

      Info-Tech Insight

      The Conceptual model acts as the root of all the models required and used by an organization.

      Data architecture and modeling processes

      A diagram moving from right to left through 5 phases: 'Business concepts defined and organized', 'Business concepts enriched with attribution', 'Physical view of the data, still vendor agnostic', 'The view being used by developers and business', and 'Manage the progression of your data assets'.

      Info-Tech Insight

      The Conceptual data model adds relationships to your business data glossary terms and is the first step of the modeling journey.

      Data operations

      Objectives of Data Operations Management

      • Implement and follow policies and procedures to manage data at each stage of its lifecycle.
      • Maintain the technology supporting the flow and delivery of data (applications, databases, systems, etc.).
      • Control the delivery of data within the system environment.

      Indicators of Successful Data Operations Management

      • Effective delivery of data assets to end users.
      • Successful maintenance and performance of the technical environment that collects, stores, delivers, and purges organizational data.
      'Data Lifecycle' with steps 'Create', 'Acquire', 'Store', 'Maintain', 'Use', and 'Archive/Destroy'.
      This data management enabler has a heavy focus on the management and performance of data systems and applications.
      It works closely with the organization’s technical architecture to support successful data delivery and lifecycle management (data warehouses, repositories, databases, networks, etc.).

      Step 1.2

      Understand and Align to Business Drivers

      Activities

      1.2.1 Define your value streams

      1.2.2 Identify your business capabilities

      1.2.3 Categorize your organization’s key business capabilities

      1.2.4 Develop a strategy map tied to data management

      This step will guide you through the following activities:

      • Leverage your organization’s existing business capability map or initiate the formulation of a business capability map.
      • Determine which business capabilities are considered high priority by your organization.
      • Map your organization’s strategic objectives to value streams and capabilities to communicate how objectives are realized with the support of data.

      Outcomes of this step

      • A foundation for data management initiative planning that’s aligned with the organization’s business architecture: value streams, business capability map, and strategy map

      Build Business Context and Drivers

      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      Identifying value streams

      Value streams connect business goals to organization’s value realization activities. They enable an organization to create and capture value in the marketplace by engaging in a set of interconnected activities.
      There are several key questions to ask when endeavouring to identify value streams.

      Key Questions

      • Who are your customers?
      • What are the benefits we deliver to them?
      • How do we deliver those benefits?
      • How does the customer receive the benefits?

      1.2.1 Define value streams

      1-3 hours

      Input: Business strategy/goals, Financial statements, Info-Tech’s industry-specific business architecture

      Output: List of organization-specific value streams, Detailed value stream definition(s)

      Materials: Whiteboard/kanban board, Info-Tech’s Reference Architecture Template – contact your Account Representative for details, Other industry standard reference architecture models: BIZBOK, APQC, etc., Info-Tech’s Archimate models

      Participants: Enterprise/Business Architect, Business Analysts, Business Unit Leads, CIO, Departmental Executive & Senior managers

      Unify the organization’s perspective on how it creates value.

      1. Write a short description of the value stream that includes a statement about the value provided and a clear start and end for the value stream. Validate the accuracy of the descriptions with your key stakeholders.
      2. Consider:
        • How does the organization deliver those benefits?
        • How does the customer receive the benefits?
        • What is the scope of your value stream? What will trigger the stream to start and what will the final value be?
      3. Avoid:
        • Don’t start with a blank page. Use Info-Tech’s business architecture models for sample value streams.

      Contact your Account Representative for access to Info-Tech’s Reference Architecture Template

      Define or validate the organization’s value streams

      Value streams connect business goals to the organization’s value realization activities. These value realization activities, in turn, depend on data.

      If the organization does not have a business architecture function to conduct and guide Activity 1.2.1, you can leverage the following approach:

      • Meet with key stakeholders regarding this topic, then discuss and document your findings.
      • When trying to identify the right stakeholders, consider: Who are the decision makers and key influencers? Who will impact this piece of business architecture–related work? Who has the relevant skills, competencies, experience, and knowledge about the organization?
      • Engage with these stakeholders to define and validate how the organization creates value. Consider:
        • Who are your main stakeholders? This will depend on the industry in which you operate. For example, they could be customers, residents, citizens, constituents, students, patients.
        • What are your stakeholders looking to accomplish?
        • How does your organization’s products and/or services help them accomplish that?
        • What are the benefits your organization delivers to them and how does your organization deliver those benefits?
        • How do your stakeholders receive those benefits?

      Align data management to the organization’s value realization activities.

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.

      Info-Tech Insight

      Your organization’s value streams and the associated business capabilities require effectively managed and governed data. Without this, you could face elevated operational costs, missed opportunities, eroded stakeholder satisfaction, negative impact to reputation and brand, and/or increased exposure to business risk.

      Example of value streams – Retail Banking

      Value streams connect business goals to the organization’s value realization activities.

      Example value stream descriptions for: Retail Banking

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities. Example Value Stream for Retail Banking with five value chains. 'Attract Customers: Retail banks design new products to fill gaps in their product portfolios by analyzing the market for changing customer needs and new competitor offerings or pricing; Pricing a product correctly through analysis and rate setting is a delicate balance and fundamental to a bank’s success.' 'Supply Loans and Mortgages and Credit Cards: Selecting lending criteria helps banks decide on the segment of customer they should take on and the degree of risk they are willing to accept.' 'Provide Core Banking Services: Servicing includes the day-to-day interactions with customers for onboarding, payments, adjustments, and offboarding through multiple banking channels; Customer retention and growing share of wallet are crucial capabilities in servicing that directly impact the growth and profitability of retail banks.' 'Offer Card Services: Card servicing involves quick turnarounds on card delivery and acceptance at a large number of merchants; Accurate billing and customizable spending alerts are crucial in ensuring that the customer understands their spending habits.' 'Grow Investments and Manage Wealth: Customer retention can be increased through effective wealth management and additional services that will increase the number of products owned by a customer.'

      For this value stream, download Info-Tech’s Industry Reference Architecture for Retail Banking.

      Example of value streams – Higher Education

      Value streams connect business goals to the organization’s value realization activities.

      Example value stream descriptions for: Higher Education

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities. Example Value Stream for Higher Education with five value chains. 'Shape Institutional Research: Institutional research provides direct benefits to both partners and faculty, ensuring efficient use of resources and compliance with ethical and methodological standards; This value stream involves all components of the research lifecycle, from planning and resourcing to delivery and commercialization.' 'Facilitate Curriculum Design: Curriculum design is the process by which learning content is designed and developed to achieve desired student outcomes; Curriculum management capabilities include curriculum planning, design and commercialization, curriculum assessment, and instruction management.' 'Design Student Support Services: Support services design and development provides a range of resources to assist students with academic success, such as accessibility, health and counseling, social services, housing, and academic skills development.' 'Manage Academic Administration: Academic administration involves the broad capabilities required to attract and enroll students in institutional programs; This value stream involves all components related to recruitment, enrollment, admissions, and retention management.' 'Deliver Student Services: Delivery of student services comes after curricular management, support services design, and academic administration. It comprises delivery of programs and services to enable student success; Program and service delivery capabilities include curriculum delivery, convocation management, and student and alumni support services.'

      For this value stream, download Info-Tech’s Industry Reference Architecture for Higher Education.

      Example of value streams – Local Government

      Value streams connect business goals to the organization’s value realization activities.

      Example value stream descriptions for: Local Government

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities. Example Value Stream for Local Government with five value chains. 'Sustain Land, Property, and the Environment: Local governments act as the stewards of the regional land and environment that are within their boundaries; Regional government bodies are responsible for ensuring that the natural environment is protected and sustained for future citizens in the form of parks and public land.' 'Facilitate Civic Engagement: Local governments engage with constituents to maintain a high quality of life through art, culture, and education.' 'Protect Local Health and Safety: Health concerns are managed by a local government through specialized campaigns and clinics; Emergency services are provided by the local authority to protect and react to health and safety concerns including police and firefighting services.' 'Grow the Economy: Economic growth is a cornerstone of a strong local government. Growth comes from flourishing industries, entrepreneurial success, high levels of employment, and income from tourism.' 'Provide Regional Infrastructure: Local governments ensure that infrastructure is built, maintained, and effective in meeting the needs of constituents. (Includes: electricity, water, sustainable energy sources, waste collection, transit, and local transportation.'

      For this value stream, download Info-Tech’s Industry Reference Architecture for Local Government.

      Example of value streams – Manufacturing

      Value streams connect business goals to the organization’s value realization activities.

      Example value stream descriptions for: Manufacturing

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities. Example Value Stream for Manufacturing with three value chains. 'Design Product: Manufacturers proactively analyze their respective markets for any new opportunities or threats; They design new products to serve changing customer needs or to rival any new offerings by competitors; A manufacturer’s success depends on its ability to develop a product that the market wants at the right price and quality level.' 'Produce Product: Optimizing production activities is an important capability for manufacturers. Raw materials and working inventories need to be managed effectively to minimize wastage and maximize the utilization of the production lines; Processes need to be refined continuously over time to remain competitive and the quality of the materials and final products needs to be strictly managed.' 'Sell Product: Once produced, manufacturers need to sell the products. This is done through distributors, retailers, and, in some cases, directly to the end consumer; After the sale, manufacturers typically have to deliver the product, provide customer care, and manage complaints; Manufacturers also randomly test their end products to ensure they meet quality requirements.'

      For this value stream, download Info-Tech’s Industry Reference Architecture for Manufacturing.

      Define the organization’s business capabilities in a business capability map

      A business capability defines what a business does to enable value creation. Business capabilities represent stable business functions and typically will have a defined business outcome.

      Business capabilities can be thought of as business terms defined using descriptive nouns such as “Marketing” or “Research and Development.”

      If your organization doesn’t already have a business capability map, you can leverage the following approach to build one. This initiative requires a good understanding of the business. By working with the right stakeholders, you can develop a business capability map that speaks a common language and accurately depicts your business.

      Working with the stakeholders as described in the slide entitled “Define or validate the organization’s value streams”:

      • Analyze the value streams to identify and describe the organization’s capabilities that support them.
      • Consider the objective of your value stream. (This can highlight which capabilities support which value stream.)
      • As you initiate your engagement with your stakeholders, don’t start a blank page. Leverage the examples on the next slides as a starting point for your business capability map.
      • When using these examples, consider: What are the activities that make up your particular business? Keep the ones that apply to your organization, remove the ones that don’t, and add any needed.

      Align data management to the organization’s value realization activities.

      Info-Tech Insight

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data management program must support.

      For more information, refer to Info-Tech’s Document Your Business Architecture.

      1.2.2 Identify your business capabilities

      Input: List of confirmed value streams and their related business capabilities

      Output: Business capability map with value streams for your organization

      Materials: Your existing business capability map, Business Alignment worksheet provided in the Data Management Assessment and Planning Tool, Info-Tech’s Document Your Business Architecture blueprint

      Participants: Key business stakeholders, Data stewards, Data custodians, Data leads and administrators

      Confirm your organization's existing business capability map or initiate the formulation of a business capability map:

      • If you have an existing business capability map, meet with the relevant business owners/stakeholders to confirm that the content is accurate and up to date. Confirm the value streams (how your organization creates and captures value) and their business capabilities reflect the organization’s current business environment.
      • If you do not have an existing business capability map, complete this activity to initiate the formulation of a map (value streams and related business capabilities):
        1. Define the organization’s value streams. Meet with senior leadership and other key business stakeholders to define how your organization creates and captures value.
        2. Define the relevant business capabilities. Meet with senior leadership and other key business stakeholders to define the business capabilities.

      Note: A business capability defines what a business does to enable value creation. Business capabilities are business terms defined using nouns such as “Marketing” or “Research and Development.” They represent stable business functions, are unique and independent of one another, and typically will have a defined business outcome.

      Example business capability map – Retail Banking

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip: Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data management program.

      Example business capability map for: Retail Banking

      Example business capability map for Retail Banking with value stream items as column headers, and rows 'Enabling', 'Shared', and 'Defining'.

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Retail Banking.

      Example business capability map – Higher Education

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip: Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data management program.

      Example business capability map for: Higher Education

      Example business capability map for Higher Education with value stream items as column headers, and rows 'Enabling', 'Shared', and 'Defining'.

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Higher Education.

      Example business capability map – Local Government

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip: Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.

      Example business capability map for: Local Government

      Example business capability map for Local Government with value stream items as column headers, and rows 'Enabling', 'Shared', and 'Defining'.

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Local Government.

      Example business capability map – Manufacturing

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip: Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.

      Example business capability map for: Manufacturing

      Example business capability map for Manufacturing with value stream items as column headers, and rows 'Enabling', 'Shared', and 'Defining'.

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Manufacturing.

      Example business capability map – Retail

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip: Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.

      Example business capability map for: Retail

      Example business capability map for Retail with value stream items as column headers, and rows 'Enabling', 'Shared', and 'Defining'.

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Retail.

      1.2.3 Categorize your organization’s key capabilities

      Input: Strategic insight from senior business stakeholders on the business capabilities that drive value for the organization

      Output: Business capabilities categorized and prioritized (e.g. cost advantage creators, competitive advantage differentiators, high value/high risk) See next slide for an example

      Materials: Your existing business capability map or the business capability map derived in Activity 1.2.2

      Participants: Key business stakeholders, Data stewards, Data custodians, Data governance working group

      Determine which capabilities are considered high priority in your organization.

      1. Categorize or heatmap the organization’s key capabilities. Consult with senior and other key business stakeholders to categorize and prioritize the business’ capabilities. This will aid in ensuring your data governance future-state planning is aligned with the mandate of the business. One approach to prioritizing capabilities with business stakeholders is to examine them through the lens of cost advantage creators, competitive advantage differentiators, and/or by high value/high risk.
      2. Identify cost advantage creators. Focus on capabilities that drive a cost advantage for your organization. Highlight these capabilities and prioritize programs that support them.
      3. Identify competitive advantage differentiators. Focus on capabilities that give your organization an edge over rivals or other players in your industry.

      This categorization/prioritization exercise helps highlight prime areas of opportunity for building use cases, determining prioritization, and the overall optimization of data and data governance.

      For more information, refer to Info-Tech’s Document Your Business Architecture.

      Example of business capabilities categorization or heatmapping – Retail

      This exercise is useful in ensuring the data governance program is focused and aligned to support the priorities and direction of the business.

      • Depending on the mandate from the business, priority may be on developing cost advantage. Hence the capabilities that deliver efficiency gains are the ones considered to be cost advantage creators.
      • The business’ priority may be on maintaining or gaining a competitive advantage over its industry counterparts. Differentiation might be achieved in delivering unique or enhanced products, services, and/or experiences, and the focus will tend to be on the capabilities that are more end-stakeholder-facing (e.g. customer-, student-, patient,- and/or constituent-facing). These are the organization’s competitive advantage creators.

      Example: Retail

      Example business capability map for Retail with capabilities categorized into Cost Advantage Creators and Competitive Advantage creators via a legend. Value stream items as column headers, and rows 'Enabling', 'Shared', and 'Defining'.

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Retail.

      1.2.4 Develop a strategy map tied to data management

      Input: Strategic objectives as outlined by the organization’s business strategy and confirmed by senior leaders

      Output: A strategy map that maps your organizational strategic objectives to value streams, business capabilities, and ultimately data programs

      Materials: Your existing business capability map or the one created in Activity 1.2.2, Business strategy (see next slide for an example)

      Participants: Key business stakeholders, Data stewards, Data custodians, Data governance working group

      Identify the strategic objectives for the business. Knowing the key strategic objectives will drive business–data governance alignment. It’s important to make sure the right strategic objectives of the organization have been identified and are well understood.

      1. Meet with senior business leaders and other relevant stakeholders to help identify and document the key strategic objectives for the business.
      2. Leverage their knowledge of the organization’s business strategy and strategic priorities to visually represent how these map to value streams, business capabilities, and ultimately data and data governance needs and initiatives. Tip: Your map is one way to visually communicate and link the business strategy to other levels of the organization.
      3. Confirm the strategy mapping with other relevant stakeholders.

      Example of a strategy map tied to data management

      • Strategic objectives are the outcomes the organization is looking to achieve.
      • Value streams enable an organization to create and capture value in the market through interconnected activities that support strategic objectives.
      • Business capabilities define what a business does to enable value creation in value streams.
      • Data capabilities and initiatives are descriptions of action items on the data and data governance roadmap that will enable one or multiple business capabilities in its desired target state.

      Info-Tech Tip: Start with the strategic objectives, then map the value streams that will ultimately drive them. Next, link the key capabilities that enable each value stream. Then map the data and data governance initiatives that support those capabilities. This process will help you prioritize the data initiatives that deliver the most value to the organization.

      Example: Retail

      Example of a strategy map tied to data management with diagram column headers 'Strategic Objectives' (are realized through...) 'Value Streams' (are enabled by...) 'Key Capabilities' (are driven by...) 'Data Capabilities and Initiatives'. Row headers are objectives and fields are composed of three examples of each column header.

      For this strategy map, download Info-Tech’s Industry Reference Architecture for Retail.

      Step 1.3

      Build High-Value Use Cases for Data Management

      Activities

      1.3.1 Build high-value use cases

      This step will guide you through the following activities:

      • Understand the main disciplines and makeup of a best-practice data management program.
      • Determine which data management capabilities are considered high priority by your organization.

      Outcomes of this step

      • A foundation for data management initiative planning that’s aligned with the organization’s business architecture: value streams, business capability map, and strategy map

      Build Business Context and Drivers

      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      1.3.1 Build high-value use cases

      Input: Value streams and business capabilities as defined by business leaders, Business stakeholders’ subject area expertise, Data custodian systems, integration, and data knowledge

      Output: Use cases that articulate data-related challenges, needs, or opportunities that are tied to defined business capabilities and hence, if addressed, will deliver measurable value to the organization

      Materials: Your business capability map from Activity 1.2.2, Info-Tech’s Data Use Case Framework Template, Whiteboard or flip charts (or shared screen if working remotely), Markers/pens

      Participants: Key business stakeholders, Data stewards and business SMEs, Data custodians, Data leads and administrators

      This business needs gathering activity will highlight and create relevant use cases around data-related problems or opportunities that are clear and contained and, if addressed, will deliver value to the organization.

      1. Bring together key business stakeholders (data owner, stewards, SMEs) from a particular line of business as well the relevant data custodian(s) to build cases for their units. Leverage the business capability map you created for facilitating this act.
      2. Leverage Info-Tech’s Data Use Case Framework Template as seen on the next slide.
      3. Have the stakeholders move through each breakout session outlined in the use case worksheet. Use flip charts or a whiteboard to brainstorm and document their thoughts.
      4. Debrief and document results in the Data Use Case Framework Template.
      5. Repeat this exercise with as many lines of the business as possible, leveraging your business capability map to guide your progress and align with business value.

      Tip: Don’t conclude these use case discussions without substantiating what measures of success will be used to demonstrate the business value of the effort to produce the desired future state, as relevant to each particular use case.

      Download Info-Tech’s Data Use Case Framework Template

      Data use cases

      Sample Data

      The following is the list of use cases as articulated by key stakeholders at [Organization Name].

      The stakeholders see these as areas that are relevant and highly valuable for delivering strategic value to [Organization Name].

      Use Case 1: Customer/Student/Patient/Resident 360 View

      Use Case 2: Project/Department Financial Performance

      Use Case 3: Vendor Lifecycle Management

      Use Case 4: Project Risk Management

      Prioritization of use cases

      Example table for use case prioritization. Column headers are 'Use Case', 'Order of Priority', and 'Comments'. Fields are empty.

      Use case 1

      Sample Data

      Problem statement:

      • We are not realizing our full growth potential because we do not have a unified 360 view of our customers/clients/[name of external stakeholder].
      • This impacts: our cross-selling; upselling; talent acquisition and retention; quality of delivery; ability to identify and deliver the right products, markets, and services...

      If we could solve this:

      • We would be able to better prioritize and position ourselves to meet evolving customer needs.
      • We would be able to optimize the use of our limited resources.

      Use case 1: challenges, risks, and opportunities

      Sample Data

      1. What is the number one risk you need to alleviate?
        • Loss of potential revenue, whether from existing or net new customers.
          • How?
            • By not maximizing opportunities with customers or even by losing customers; by not understanding or addressing their greatest needs
            • By not being able to win potential new customers because we don’t understand their needs
      2. What is the number one opportunity you wish to see happen?
        • The ability to better understand and anticipate the needs of both existing and potential customers.
      3. What is the number one pain point you have when working with data?
        • I can’t do my job with confidence because it’s not based on comprehensive, sound, reliable data. My group spends significant time reconciling data sets with little time left for data use and analysis.
      4. What are your challenges in performing the activity today?
        • I cannot pull together customer data in a timely manner due to having a high level of dependence on specific individuals with institutional knowledge rather than having easy access to information.
        • It takes too much time and effort to pull together what we know about a customer.
        • The necessary data is not consolidated or readily/systematically available for consumption.
        • These challenges are heightened when dealing with customers across markets.

      Use case 1 (cont'd)

      Sample Data

      1. What does “amazing” look like if we solve this perfectly?
        • Employees have immediate, self-service access to necessary information, leading to better and more timely decisions. This results in stronger business and financial growth.
      2. What other business unit activities/processes will be impacted/improved if we solve this?
        • Marketing/bid and proposal, staffing, procurement, and contracting strategy
      3. What compliance/regulatory/policy concerns do we need to consider in any solution?
        • PII, GDPR, HIPAA, CCPA, etc.
      4. What measures of success/change should we use to prove the value of the effort (KPIs/ROI)?
        • Win rate, number of services per customer, gross profit, customer retention, customer satisfaction scores, brand awareness, and net promoter score
      5. What are the steps in the process/activity today?
        • Manual aggregation (i.e. pull data from systems into Excel), reliance on unwritten knowledge, seeking IT support, canned reports

      Use case 1 (cont'd)

      Sample Data

      1. What are the applications/systems used at each step?
        • Salesforce CRM, Excel, personal MS Access databases, SharePoint
      2. What data elements (domains) are involved, created, used, or transformed at each step?
        • Bid and proposal information, customer satisfaction, forecast data, list of products, corporate entity hierarchy, vendor information, key staffing, recent and relevant news, and competitor intelligence

      Use case worksheet

      Objective: This business needs gathering activity will help you highlight and create relevant use cases around data-related problems or opportunities. They should be clear and contained and, if addressed, will deliver value to the organization.

      1.

      What business capability (or capabilities) in your business area is this use case tied to?

      Examples: Demand Planning, Assortment Planning, Allocation & Replenishment, Fulfillment Planning, Customer Management
      2.

      What are your data-related challenges in performing this today?

      Use case worksheet (cont’d.)

      Objective: This business needs gathering activity will help you highlight and create relevant use cases around data-related problems or opportunities. They should be clear and contained and, if addressed, will deliver value to the organization.

      3.

      What are the steps in the process/activity today?

      4.

      What are the applications/systems used at each step today?

      5.

      What data domains are involved, created, used, or transformed at each step today?

      Use case worksheet (cont’d.)

      Objective: This business needs gathering activity will help you highlight and create relevant use cases around data-related problems or opportunities. They should be clear and contained and, if addressed, will deliver value to the organization.

      6.

      What does an ideal or improved state look like?

      7.

      What other business units, business capabilities, activities, or processes will be impacted and/or improved if this were to be solved?

      8.

      Who are the stakeholders impacted by these changes? Who needs to be consulted?

      9.

      What are the risks to the organization (business capability, revenue, reputation, customer loyalty, etc.) if this is not addressed?

      Use case worksheet (cont’d.)

      Objective: This business needs gathering activity will help you highlight and create relevant use cases around data-related problems or opportunities. They should be clear and contained and, if addressed, will deliver value to the organization.

      10.

      What compliance, regulatory, or policy concerns do we need to consider in any solution?

      11.

      What measures of success or change should we use to prove the value of the effort (KPIs/ROI)? What is the measurable business value of doing this?

      Use case worksheet (cont’d.)

      Objective: This business needs gathering activity will help you highlight and create relevant use cases around data-related problems or opportunities. They should be clear and contained and, if addressed, will deliver value to the organization.

      10.

      Conclusion: What are the data capabilities that need to be optimized, addressed, or improved to support or help realize the business capability (or capabilities) highlighted in this use case?

      (Tip: This will inform your future-state data capabilities optimization planning and roadmapping activities.)

      Data Management Workshop
      Use Case 1: Covid-19 Emergency Management

      [SAMPLE]

      Problem Statement

      Inability to provide insights to DPH due to inconsistent data, inaccurate reporting, missing governance, and unknown data sources resulting in decisions that impact citizens being made without accurate information.

      Challenges
      • Data is not suitable for analytics. It takes lot of effort to clean data.
      • Data intervals are not correct and other data quality issues.
      • The roles are not clearly defined.
      • Lack of communication between key stakeholders.
      • Inconsistent data/reporting/governance in the agencies. This has resulted in number of issues for Covid-19 emergency management. Not able to report accurately on number of cases, deaths, etc.
      • Data collection systems changed overtime (forms, etc.).
      • GIS has done all the reporting. However, why GIS is doing all the reporting is not clear. GIS provides critical information for location. Reason: GIS was ready with reporting solution ArcGIS.
      • Problem with data collection, consolidation, and providing hierarchical view.
      • Change in requirements, metrics – managing crisis by email and resulting in creating one dashboard after another. Not sure whether these dashboards being used.
      • There is a lot of manual intervention and repeated work.
      What Does Amazing Look Like?
      • One set of dashboards (or single dashboard) – too much time spend on measure development
      • Accurate and timely data
      • Automated data
      • Access to granular data (for researchers and other stakeholders)
      • Clear ownership of data and analytics
      • It would have been nice to have governance already prior to this crisis
      • Proper metrics to measure usage and value
      • Give more capabilities such as predictive analytics, etc.
      Related Processes/Impact
      • DPH
      • Schools
      • Business
      • Citizens
      • Resources & Funding
      • Data Integration & GIS
      • Data Management
      • Automated Data Quality
      Compliance
      • HIPAA, FERPA, CJIS, IRS
      • FEMA
      • State compliance requirement – data classification
      • CDC
      • Federal data-sharing agreements/restrictions
      Benefits/KPIs
      • Reduction in cases
      • Timely response to outbreak
      • Better use of resources
      • Economic impact
      • Educational benefits
      • Trust and satisfaction

      Data Management Workshop
      Use Case 1: Covid-19 Emergency Management

      [SAMPLE]

      Problem Statement

      Inability to provide insights to DPH due to inconsistent data, inaccurate reporting, missing governance, and unknown data sources resulting in decisions that impact citizens being made without accurate information.

      Current Steps in Process Activity (Systems)
      1. Collect data through Survey123 using ArcGIS (hospitals are managed to report by 11 am) – owned KYEM
      2. KYEM stores this information/data
      3. Deduplicate data (emergency preparedness group)
      4. Generate dashboard using ArcGIS
      5. Map to monitor status of the update
      6. Error correction using web portal (QAQC)
      7. Download Excel/CVS after all 97 hospital reports
      8. Sent to federal platform (White House, etc.)
      9. Generate reports for epidemiologist (done manually for public reporting)
      Data Flow diagram

      Data flow diagram.

      SystemsData Management Dimensions
      1. Data Governance
      2. Data Quality
      3. Data Integrity
      4. Data Integration
      1. Data Architecture
      2. Metadata
      3. Data Warehouse, Reporting & Analytics
      4. Data Security

      Data Management Workshop
      Use Case 1: Covid-19 Emergency Management

      [SAMPLE]

      Problem Statement

      Inability to provide insights to DPH due to inconsistent data, inaccurate reporting, missing governance, and unknown data sources resulting in decisions that impact citizens being made without accurate information.

      List Future Process Steps

      Prior to COVID-19 Emergency Response:

      • ArcGIS data integrated available in data warehouse/data lake.
      • KYEM data integrated and available in data warehouse/data lake.
      • CHFS data integrated and available in data warehouse/data lake.
      • Reporting standards and tools framework established.

      After COVID-19 Emergency Response:

      • Collect data through Survey123 using ArcGIS (hospitals are managed to report by 11 am) – owned KYEM.
      • Error correction using web portal (QAQC).
      • Generate reports/dashboard/files as per reporting/analytical requirements:
        • Federal reporting
        • COVID dashboards
        • Epidemiologist reports
        • Lab reporting
      Future Process and Data Flow

      Data flow diagram with future processes.

      Step 1.4

      Create a Vision and Guiding Principles for Data Management

      Activities

      1.4.1 Craft a vision

      1.4.2 Create guiding principles

      This step will guide you through the following activities:

      • Leverage your organization’s existing business capability map or initiate the formulation of a business capability map, guided by info-Tech’s approach.
      • Determine which business capabilities are considered high priority by your organization.
      • Map your organization’s strategic objectives to value streams and capabilities to communicate how objectives are realized with the support of data.

      Outcomes of this step

      • A foundation for data management initiative planning that’s aligned with the organization’s business architecture: value streams, business capability map, and strategy map

      Build Business Context and Drivers

      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      1.4.1 Craft a vision

      Input: Organizational vision and mission statements, Stakeholder survey results and elicitation findings, Use cases, Business and data capability map

      Output: Vision and mission statements

      Materials: Markers and pens, Whiteboard, Online whiteboard, Vision samples and templates

      Participants: Key business stakeholders, Data managers, Data owners, Business leads and SMEs, Project team, Project sponsor

      Complete the vision statement to set the direction, the “why,” for the changes we’re making. The vision is a reference point that should galvanize everyone in the organization and set guardrails for technical and process decisions to follow.

      1. Bring together key business stakeholders (content owners, SMEs, and relevant IT custodians) to craft a data management vision statement.
      2. Start by brainstorming keywords, such as customer-focused, empower the business, service excellence, findable and manageable, protected, accessible, paperless.
      3. Highlight the keywords that resonate most with the group. Refer to example vision statements for ideas.

      Create a common data management vision that is consistently communicated to the organization

      A data management program should be an enterprise-wide initiative.

      • To create a strong vision for data management, there must be participation from the business and IT. A common vision will articulate the state the organization wishes to achieve and how it will reach that state. Visioning helps to develop long-term goals and direction.
      • Once the vision is established, it must be effectively communicated to everyone, especially those who are involved in creating, managing, disposing, or archiving data.
      • The data management program should be periodically refined. This will ensure the organization continues to incorporate best methods and practices as the organization grows and data needs evolve.
      Stock image of a megaphone with multiple icons pouring from its opening.

      Info-Tech Tips

      • Use information from the stakeholder interviews to derive business goals and objectives.
      • Work to integrate different opinions and perspectives into the overall vision for data management.
      • Brainstorm guiding principles for content and understand the overall value to the organization.

      Create compelling vision and mission statements for the organization’s future data management practice

      A vision represents the way your organization intends to be in the future.

      A clear vision statement helps align the entire organization to the same end goal.

      Your vision should be brief, concise, and inspirational; it is attempting to say a lot in a few words, so be very thoughtful and careful with the words you choose. Consider your strengths across departments – business and IT, the consumers of your services, and your current/future commitments to service quality.

      Remember that a vision statement is internally facing for other members of your company throughout the process.

      A mission expresses why you exist.

      While your vision is a declaration of where your organization aspires to be in the future, your mission statement should communicate the fundamental purpose of the data management practice.

      It identifies the function of the practice, what it produces, and its high-level goals that are linked to delivering timely, high-quality, relevant, and valuable data to business processes and end users. Consider if the practice is responsible for providing data for analytical and/or operational use cases.

      A mission statement should be a concise and clear statement of purpose for both internal and external stakeholders.

      “The Vision is the What, Where or Who you want the company to become. The Mission is the WHY the company exists, it is your purpose, passion or cause.” (Doug Meyer-Cuno, Forbes, 2021)

      Data Management Vision and Mission Statements: Draft

      Vision and mission statements crafted by the workshop participants. These statements are to be reviewed, refined into a single version, approved by members of the senior leadership team, and then communicated to the wider organization.

      Corporate

      Group 1

      Group 2

      Vision:
      Create and maintain an institution of world-class excellence.
      Vision: Vision:
      Mission:
      Foster an economic and financial environment conducive to sustainable economic growth and development.
      Mission: Mission:

      Information management framework

      The information management framework is a way to organize all the ECM program’s guidelines and artifacts

      Information management framework with 'Information Management Vision' above six principles. Below them are 'Information Management Policies' and 'Information Management Standards and Procedures.'

      The vision is a statement about the organization’s goals and provides a basis to guide decisions and rally employees toward a shared goal.

      The principles or themes communicate the organization’s priorities for its information management program.

      Policies are a set of official guidelines that determine a course of action. For example: Company is committed to safety for its employees.

      Procedures are a set of actions for doing something. For example: Company employees will wear protective gear while on the production floor.

      Craft your vision

      Use the insights you gathered from users and stakeholders to develop a vision statement
      • The beginning of a data management practice is a clear set of goals and key performance indicators (KPIs).
        A good set of goals takes time and input from senior leadership and stakeholders.
      • The data management program lead is selling a compelling vision of what is possible.
      • The vision also helps set the scope and expectations about what the data management program lead is and is not doing.
      • Be realistic about what you can do and how long it will take to see a difference.
      Table comparing the talk (mission statements, vision statements, and values) with the walk (strategies/goals, objectives, and tactical plans). Example vision statements:
      • The organization is dedicated to creating an enabling structure that helps the organization get the right information to the right people at the right time.
      • The organization is dedicated to creating a program that recognizes data as an asset, establishing a data-centric culture, and ensuring data quality and accessibility to achieve service excellence.
      The vision should be short, memorable, inspirational and draw a clear picture of what that future-state data management experience looks like.

      Is it modern and high end, with digital self-service?

      Is it a trusted and transparent steward of customer assets?

      1.4.2 Create guiding principles

      Input: Sample data management guiding principles, Stakeholder survey results and elicitation findings, Use cases, Business and data capability map

      Output: Data management guiding principles

      Materials: Markers and pens, Whiteboard, Online whiteboard, Guiding principles samples and templates

      Participants: Key business stakeholders, Data managers, Data owners, Business leads and SMEs, Project team, Project sponsor

      Draft a set of guiding principles that express your program’s values as a framework for decisions and actions and keep the data strategy alive.

      1. Bring together key business stakeholders (data owners, SMEs, and relevant IT custodians) to craft a set of data management guiding principles.
      2. Refer to industry sample guiding principles for data management.
      3. Discuss what’s important to stakeholders and owners, e.g. security, transparency, integrity. Good guiding principles address real challenges.
      4. A helpful tip: Craft principles as “We will…” statements for the problems you’ve identified.

      Twelve data management universal principles

      [SAMPLE]
      Principle Definitions
      Data Is Accessible Data is accessible across the organization based on individuals’ roles and privileges.
      Treat Data as an Asset Treat data as a most valuable foundation to make right decisions at the right time. Manage the data lifecycle across organization.
      Manage Data Define strategic enterprise data management that defines, integrates, and effectively retrieves data to generate accurate, consistent insights.
      Define Ownership & Stewardship Organizations should clearly appoint data owners and data stewards and ensure all team members understand their role in the company’s data management system.
      Use Metadata Use metadata to ensure data is properly managed by tacking how data has been collected, verified, reported, and analyzed.
      Single Source of Truth Ensure the master data maintenance across the organization.
      Ensure Data Quality Ensure data integrity though out the lifecycle of data by establishing a data quality management program.
      Data Is Secured Classify and maintain the sensitivity of the data.
      Maximize Data Use Extend the organization’s ability to make the most of its data.
      Empower the Users Foster data fluency and technical proficiency through training to maximize optimal business decision making.
      Share the Knowledge Share and publish the most valuable insights appropriately.
      Consistent Data Definitions Establish a business data glossary that defines consistent business definitions and usage of the data.

      Create a Data Management Roadmap

      Phase 2

      Assess Data Management and Build Your Roadmap

      Phase 1

      1.1 Review the Data Management Framework

      1.2 Understand and Align to Business Drivers

      1.3 Build High-Value Use Cases

      1.4 Create a Vision

      Phase 2

      2.1 Assess Data Management

      2.2 Build Your Data Management Roadmap

      2.3 Organize Business Data Domains

      This phase will walk you through the following activities:

      • Understand your current data management capabilities.
      • Define target-state capabilities required to achieve business goals and enable the data strategy.
      • Identify priority initiatives and planning timelines for data management improvements.

      This phase involves the following participants:

      • Data Management Lead/Information Management Lead, CDO, Data Lead
      • Senior Business Leaders
      • Business SMEs
      • Data owners, records managers, regulatory subject matter experts (e.g. legal counsel, security)

      Step 2.1

      Assess Your Data Management Capabilities

      Activities

      2.1.1 Define current state of data management capabilities

      2.1.2 Set target state and identify gaps

      This step will guide you through the following activities:

      • Assess the current state of your data management capabilities.
      • Define target-state capabilities required to achieve business goals and enable the data strategy.
      • Identify gaps and prioritize focus areas for improvement.

      Outcomes of this step

      • A prioritized set of improvement areas aligned with business value stream and drivers

      Assess Data Management and Build Your Roadmap

      Step 2.1 Step 2.2 Step 2.3

      Define current state

      The Data Management Assessment and Planning Tool will help you analyze your organization’s data requirements, identify data management strategies, and systematically develop a plan for your target data management practice.
      • Based on Info-Tech’s Data Management Framework, evaluate the current-state performance levels for your organization’s data management practice.
      • Use the CMMI maturity index to assign values 1 to 5 for each capability and enabler.

      A visualization of stairs numbered up from the bottom. Main headlines of each step are 'Initial and Reactive', 'Managed while developing DG capabilities', 'Defined DG capabilities', 'Quantitatively Managed by DG capabilities', and 'Optimized'.

      Sample of the 'Data Management Current State Assessment' form the Data Management Assessment and Planning Tool.

      2.1.1 Define current state

      Input: Stakeholder survey results and elicitation findings, Use cases, Business and data management capability map

      Output: Current-state data management capabilities

      Materials: Data Management Assessment and Planning Tool

      Participants: Key business stakeholders, Business leads and SMEs, Project team, Project sponsor, Data leads, Data custodians

      Assign a maturity level value from 1 to 5 for each question in the assessment tool, organized into capabilities, e.g. Data Governance, Data Quality, Risk.

      1. Bring together key business stakeholders (data owners, SMEs, and relevant IT custodians) to assign current-state maturity levels in each question of the worksheet.
      2. Remember that there is more distance between levels 4 and 5 than there is between 1 and 2 – the distance between levels is not even throughout.
      3. To help assign values, think of the higher levels as representing cross-enterprise standardization, monitored for continuous improvement, formalized and standardized, while the lower levels mean applied within individual units, not formalized or tracked for performance.
      4. In tab 4, “Current State Assessment,” populate a current-state value for each item in the Data Management Capabilities worksheet.
      5. Once you’ve entered values in tab 4, a visual and summary report of the results will be generated on tab 5, “Current State Results.”

      2.1.2 Set target state and identify gaps

      Input: Stakeholder survey results and elicitation findings, Use cases, Business and data management capability map to identify priorities

      Output: Target-state data management capabilities, Gaps identification and analysis

      Materials: Data Management Assessment and Planning Tool

      Participants: Key business stakeholders, Business leads and SMEs, Project team, Project sponsor, Data leads, Data custodians

      Assign a maturity level value from 1 to 5 for each question in the assessment tool, organized into capabilities, e.g., Data Governance, Data Quality, Risk.

      1. Bring together key business stakeholders (data owners, SMEs, and relevant IT custodians) to assign target-state maturity levels in each question of the worksheet.
      2. Remember that there is more distance between levels 4 and 5 than there is between 1 and 2 – the distance between levels is not even throughout.
      3. To help assign values, think of the higher levels as representing cross-enterprise standardization, monitored for continuous improvement, formalized and standardized, while the lower levels mean applied within individual units, not formalized or tracked for performance.
      4. In tab 6, “Target State & Gap Analysis,” enter maturity values in each item of the Capabilities worksheet in the Target State column.
      5. Once you’ve assigned both target-state and current-state values, the tool will generate a gap analysis chart on tab 7, “Gap Analysis Results,” where you can start to decide first- and second-line priorities.

      Step 2.2

      Build Your Data Management Roadmap

      Activities

      2.2.1 Describe gaps

      2.2.2 Define gap initiatives

      2.2.2 Build a data management roadmap

      This step will guide you through the following activities:

      • Identify and understand data management gaps.
      • Develop data management improvement initiatives.
      • Build a data management–prioritized roadmap.

      Outcomes of this step

      • A foundation for data management initiative planning that’s aligned with the organization’s business architecture: value streams, business capability map, and strategy map

      Assess Data Management and Build Your Roadmap

      Step 2.1 Step 2.2 Step 2.3

      2.2.1 Describe gaps

      Input: Target-state maturity level

      Output: Detail and context about gaps to lead planners to specific initiatives

      Materials: Data Management Assessment and Planning Tool

      Participants: Key business stakeholders, Business leads and SMEs, Project team, Project sponsor, Data leads, Data custodians

      Based on the gaps result, describe the nature of the gap, which will lead to specific initiatives for the data management plan:

      1. In tab 6, “Target State & Gap Analysis,” the same tab where you entered your target-state maturity level, enter additional context about the nature and extent of each gap in the Gap Description column.
      2. Based on the best-practices framework we walked through in Phase 1, note the specific areas that are not fully developed in your organization; for example, we don’t have a model of our environment and its integrations, or there isn’t an established data quality practice with proactive monitoring and intervention.

      2.2.2 Define gap initiatives

      Input: Gaps analysis, Gaps descriptions

      Output: Data management initiatives

      Materials: Data Management Assessment and Planning Tool

      Participants: Key business stakeholders, Business leads and SMEs, Project team, Project sponsor, Data leads, Data custodians

      Based on the gap analysis, start to define the data management initiatives that will close the gaps and help the organization achieve its target state.

      1. In tab 6, “Target State & Gap Analysis,” the same tab where you entered your target-state maturity level, note in the Gap Initiative column what actions you can take to address the gap for each item. For example, if we found through diagnostics and use cases that users didn’t understand the meaning of their data or reports, an initiative might be, “Build a standard enterprise business data catalog.”
      2. It’s an opportunity to brainstorm, to be creative, and think about possibilities. We’ll use the roadmap step to select initiatives from this list.
      3. There are things we can do right away to make a difference. Acknowledge the resources, talent, and leadership momentum you already have in your organization and leverage those to find activities that will work in your culture. For example, one company held a successful Data Day to socialize the roadmap and engage users.

      2.2.3 Build a data management roadmap

      Input: Gap initiatives, Target state and current-state assessment

      Output: Data management initiatives and roadmap

      Materials: Data Management Assessment and Planning Tool

      Participants: Key business stakeholders, Business leads and SMEs, Project team, Project sponsor, Data leads, Data custodians

      Start to list tangible actions you will take to address gaps and achieve data objectives and business goals along with timelines and responsibility:

      1. With an understanding of your priority areas and specific gaps, and referring back to your use cases, draw up specific initiatives that you can track, measure, and align with your original goals.
      2. For example, in data governance, initiatives might include:
        • Assign data owners and stewards for all data assets.
        • Consolidate disparate business data catalogs.
        • Create a data governance charter or terms of reference.
      3. Alongside the initiatives, fill in other detail, especially who is responsible and timing (start and end dates). Assigning responsibility and some time markers will help to keep momentum alive and make the work projects real.

      Step 2.3

      Organize Business Data Domains

      Activities

      2.3.1 Define business data domains and assign owners

      This step will guide you through the following activities:

      • Identify business data domains that flow through and support the systems environment and business processes.
      • Define and organize business data domains with assigned owners, artifacts, and profiles.
      • Apply the domain map to building governance program.

      Outcomes of this step

      • Business data domain map with assigned owners and artifacts

      Assess Data Management and Build Your Roadmap

      Step 2.1 Step 2.2 Step 2.3

      2.3.1 Define business data domains

      Input: Target-state maturity level

      Output: Detail and context about gaps to lead planners to specific initiatives

      Materials: Data Management Assessment and Planning Tool

      Participants: Key business stakeholders, Business leads and SMEs, Project team, Project sponsor, Data leads, Data custodians

      Identify the key data domains for each line of business, where the data resides, and the main contact or owner.

      1. We have an understanding of what the business wants to achieve, e.g. build customer loyalty or comply with privacy laws. But where is the data that can help us achieve that? What systems is that data moving and living in and who, if anyone, owns it?
      2. Define the main business data domains apart from what system it may be spread over. Use the worksheet on the next slide as an example.
      3. Examples of business data domains: Customer, Product, Vendor.
      4. Each domain should have owners and associated business processes. Assign data domain owners, application owners, and business process owners.

      Business and data domains

      [SAMPLE]

      Business Domain App/Data Domains Business Stewards Application Owners Business Owners
      Client Experience and Sales Tech Salesforce (Sales, Service, Experience Clouds), Mulesoft (integration point) (Any team inputting data into the system)
      Quality and Regulatory Salesforce
      Operations Salesforce, Salesforce Referrals, Excel spreadsheets, SharePoint
      Finance Workday, Sage 300 (AccPac), Salesforce, Moneris Finance
      Risk/Legal Network share drive/SharePoint
      Human Resources Workday, Network share drive/SharePoint HR team
      Corporate Sales Salesforce (Sales, Service, Health, Experience Clouds),
      Sales and Client Success Mitel, Outlook, PDF intake forms, Workday, Excel. Sales & Client Success Director, Marketing Director CIO, Sales & Client Success Director, Marketing Director

      Embrace the technology

      Make the available data governance tools and technology work for you:
      • Data catalog
      • Business data glossary
      • Data lineage
      • Metadata management
      While data governance tools and technologies are no panacea, leverage their automated and AI-enabled capabilities to augment your data governance program.
      Array of logos of tech companies whose products are used for this type of work: Informatica, Collibra, Tibco, Alation, Immuta, TopQuadrant, and SoftwareReviews.

      Additional Support

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.
      Photo of an analyst.

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

      Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:
      Sample of the Data Governance Strategy Map slide from earlier.

      Build Your Business and User Context

      Work with your core team of stakeholders to build out your data management roadmap, aligning data management initiatives with business capabilities, value streams, and, ultimately, your strategic priorities.
      Sample of a 'Data Management Enablers' table.

      Formulate a Plan to Get to Your Target State

      Develop a data management future-state roadmap and plan based on an understanding of your current data governance capabilities, your operating environment, and the driving needs of your business.

      Related Info-Tech Research

      Stock image of people pointing to a tablet with a dashboard.

      Build a Robust and Comprehensive Data Strategy

      Key to building and fostering a data-driven culture.
      Sample of the 'Data & Analytics Landscape' slide from earlier.

      Understand the Data and Analytics Landscape

      Optimize your data and analytics environment.
      Stock image of co-workers looking at the same thing.

      Build a Data Pipeline for Reporting and Analytics

      Data architecture best practices to prepare data for reporting and analytics.

      Research Contributors

      Name Position Company
      Anne Marie Smith Board of Directors DAMA International
      Andy Neill Practice Lead, Data & Analytics Info-Tech Research Group
      Dirk Coetsee Research Director, Data & Analytics Info-Tech Research Group
      Graham Price Executive Advisor, Advisory Executive Services Info-Tech Research Group
      Igor Ikonnikov Research Director, Data & Analytics Info-Tech Research Group
      Jean Bujold Senior Workshop Delivery Director Info-Tech Research Group
      Mario Cantin Chief Data Strategist Prodago
      Martin Sykora Director NexJ Analytics
      Michael Blaha Author, Patterns of Data Modeling Consultant
      Rajesh Parab Research Director, Data & Analytics Info-Tech Research Group
      Ranjani Ranganathan Product Manager, Research – Workshop Delivery Info-Tech Research Group
      Reddy Doddipalli Senior Workshop Director Info-Tech Research Group

      Bibliography

      AIIM, “What is Enterprise Content Management (ECM)?” Intelligent Information Management Glossary, AIIM, 2021. Web.

      BABOK V3: A Guide to Business Analysis Body of Knowledge. IIBA, 2014. Web.

      Barton, Dominic, and David Court. "Three Keys To Building a Data-Driven Strategy." McKinsey and Company, 1 Mar. 2013. Web.

      Boston University Libraries. "Data Life Cycle » Research Data Management | Boston University." Research Data Management RSS. Boston University, n.d. Accessed Oct. 2015.

      Chang, Jenny. “97 Supply Chain Statistics You Must Know: 2020 / 2021 Market Share Analysis & Data.” FinancesOnline, 2021. Web.

      COBIT 5: Enabling Information. ISACA, 2013. Web.

      CSC (Computer Sciences Corporation), Big Data Infographic, 2012. Web.

      DAMA International. DAMA-DMBOK Guide. 1st ed., Technics Publications, 2009. Digital.

      DAMA International. “DAMA Guide to the Data Management Body of Knowledge (DAMA-DMBOK2 Guide).” 2nd ed., 2017. Accessed June 2017.

      Davenport, Thomas H. "Analytics in Sports: The New Science of Winning." International Institute for Analytics, 2014. Web.

      Department of Homeland Security. Enterprise Data Management Policy. Department of Homeland Security, 25 Aug. 2014. Web.

      Enterprise Data Management Data Governance Plan. US Federal Student Aid, Feb. 2007. Accessed Oct. 2015.

      Experian. “10 signs you are sitting on a pile of data debt.” Experian, 2020. Accessed 25 June 2021.

      Fasulo, Phoebe. “6 Data Management Trends in Financial Services.” SecurityScorecard, 3 June 2021. Web.

      Georgia DCH Medicaid Enterprise – Data Management Strategy. Georgia Department of Community Health, Feb. 2015. Accessed Oct. 2015.

      Hadavi, Cyrus. “Use Exponential Growth of Data to Improve Supply Chain Operations.” Forbes, 5 Oct. 2021. Web.

      Harbert, Tam. “Tapping the power of unstructured data.” MIT Sloan, 1 Feb. 2021. Web.

      Hoberman, Steve, and George McGeachie. Data Modeling Made Simple with PowerDesigner. Technics Pub, 2011. Print.

      “Information Management Strategy.” Information Management – Alberta. Service Alberta, Nov.-Dec. 2013. Web.

      Jackson, Brian, et al. “2021 Tech Trends.” Info-Tech Research Group, 2021. Web.

      Jarvis, David, et al. “The hyperquantified athlete: Technology, measurement, and the business of sports.” Deloitte Insights, 7 Dec. 2020. Web.

      Bibliography

      Johnson, Bruce. “Leveraging Subject Area Models.” EIMInsight Magazine, vol. 3, no. 4, April 2009. Accessed Sept. 2015.

      Lewis, Larry. "How to Use Big Data to Improve Supply Chain Visibility." Talking Logistics, 14 Sep. 2014. Web.

      McAfee, Andrew, and Erik Brynjolfsson. “Big Data: The Management Revolution,” Harvard Business Review, vol. 90, no. 10, 2012, pp. 60-68.

      Meyer-Cuno, Doug. “Is A Vision Statement Important?” Forbes, 24 Feb. 2021. Web.

      MIT. “Big Data: The Management Revolution.” MIT Center for Digital Business, 29 May 2014. Accessed April 2014.

      "Open Framework, Information Management Strategy & Collaborative Governance.” MIKE2 Methodology RSS, n.d. Accessed Aug. 2015.

      PwC. “Asset Management 2020: A Brave New World.” PwC, 2014. Accessed April 2014.

      Riley, Jenn. Understanding Metadata: What is Metadata, and What is it For: A Primer. NISO, 1 Jan. 2017. Web.

      Russom, Philip. "TDWI Best Practices Report: Managing Big Data." TDWI, 2013. Accessed Oct. 2015.

      Schneider, Joan, and Julie Hall. “Why Most Product Launches Fail.” Harvard Business Review, April 2011. Web.

      Sheridan, Kelly. "2015 Trends: The Growth of Information Governance | Insurance & Technology." InformationWeek. UBM Tech, 10 Dec. 2014. Accessed Nov. 2015.

      "Sports Business Analytics and Tickets: Case Studies from the Pros." SloanSportsConference. Live Analytics – Ticketmaster, Mar. 2013. Accessed Aug. 2015.

      Srinivasan, Ramya. “Three Analytics Breakthroughs That Will Define Business in 2021.” Forbes, 4 May 2021. Web.

      Statista. “Amount of data created, consumed, and stored 2010-2020.” Statista, June 2021. Web.

      “Understanding the future of operations: Accenture Global Operations Megatrends research.” Accenture Consulting, 2015. Web.

      Vardhan, Harsh. “Why So Many Product Ideas Fail?” Medium, 26, Sept. 2020. Web.

      Document Your Cloud Strategy

      • Buy Link or Shortcode: {j2store}468|cart{/j2store}
      • member rating overall impact: 8.9/10 Overall Impact
      • member rating average dollars saved: $35,642 Average $ Saved
      • member rating average days saved: 21 Average Days Saved
      • Parent Category Name: Cloud Strategy
      • Parent Category Link: /cloud-strategy

      Despite the universally agreed-upon benefit of formulating a coherent strategy, several obstacles make execution difficult:

      • Inconsistent understanding of what the cloud means
      • Inability to come to a consensus on key decisions
      • Ungoverned decision-making
      • Unclear understanding of cloud roles and responsibilities

      Our Advice

      Critical Insight

      A cloud strategy might seem like a big project, but it’s just a series of smaller conversations. The methodology presented here is designed to facilitate those conversations, using a curated list of topics, prompts, participant lists, and sample outcomes. We have divided the strategy into four key areas:

      • Vision and alignment
      • People
      • Governance
      • Technology

      Impact and Result

      • A shared understanding of what is necessary to succeed in the cloud
      • An end to ad hoc deployments that solve small problems and create larger ones
      • A unified approach and set of principles that apply to governance, architecture, integration, skills, and roles (and much, much more).

      Document Your Cloud Strategy Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Document Your Cloud Strategy – a phased guide to identifying, validating, and recording the steps you’ll take, the processes you’ll leverage, and the governance you’ll deploy to succeed in the cloud.

      This storyboard comprises four phases, covering mission and vision, people, governance, and technology, and how each of these areas requires forethought when migrating to the cloud.

      • Document Your Cloud Strategy – Phases 1-4

      2. Cloud Strategy Document Template – a template that allows you to record the results of the cloud strategy exercise in a clear, readable way.

      Each section of Document Your Cloud Strategy corresponds to a section in the document template. Once you’ve completed each exercise, you can record your results in the document template, leaving you with an artifact you can share with stakeholders.

      • Cloud Strategy Document Template
      [infographic]

      Workshop: Document Your Cloud Strategy

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Document Your Vision and Alignment

      The Purpose

      Understand and document your cloud vision and its alignment with your other strategic priorities.

      Key Benefits Achieved

      A complete understanding of your strategy, vision, alignment, and a list of success metrics that will help you find your way.

      Activities

      1.1 Record your cloud mission and vision.

      1.2 Document your cloud strategy’s alignment with other strategic plans.

      1.3 Record your cloud guiding principles.

      Outputs

      Documented strategy, vision, and alignment.

      Defined success metrics.

      2 Record Your People Strategy

      The Purpose

      Define how people, skills, and roles will contribute to the broader cloud strategy.

      Key Benefits Achieved

      Sections of the strategy that highlight skills, roles, culture, adoption, and the creation of a governance body.

      Activities

      2.1 Outline your skills and roles strategy.

      2.2 Document your approach to culture and adoption

      2.3 Create a cloud governing body.

      Outputs

      Documented people strategy.

      3 Document Governance Principles

      The Purpose

      This section facilitates governance in the cloud, developing principles that apply to architecture, integration, finance management, and more.

      Key Benefits Achieved

      Sections of the strategy that define governance principles.

      Activities

      3.1 Conduct discussion on architecture.

      3.2 Conduct discussion on integration and interoperability.

      3.3 Conduct discussion on operations management.

      3.4 Conduct discussion on cloud portfolio management.

      3.5 Conduct discussion on cloud vendor management.

      3.6 Conduct discussion on finance management.

      3.7 Conduct discussion on security.

      3.8 Conduct discussion on data controls.

      Outputs

      Documented cloud governance strategy.

      4 Formalize Your Technology Strategy

      The Purpose

      Creation of a formal cloud strategy relating to technology around provisioning, monitoring, and migration.

      Key Benefits Achieved

      Completed strategy sections of the document that cover technology areas.

      Activities

      4.1 Formalize organizational approach to monitoring.

      4.2 Document provisioning process.

      4.3 Outline migration processes and procedures.

      Outputs

      Documented cloud technology strategy.

      Further reading

      Document Your Cloud Strategy

      Get ready for the cloudy future with a consistent, proven strategy.

      Analyst perspective

      Any approach is better than no approach

      The image contains a picture of Jeremy Roberts

      Moving to the cloud is a big, scary transition, like moving from gas-powered to electric cars, or from cable to streaming, or even from the office to working from home. There are some undeniable benefits, but we must reorient our lives a bit to accommodate those changes, and the results aren’t always one-for-one. A strategy helps you make decisions about your future direction and how you should respond to changes and challenges. In Document Your Cloud Strategy we hope to help you accomplish just that: clarifying your overall mission and vision (as it relates to the cloud) and helping you develop an approach to changes in technology, people management, and, of course, governance. The cloud is not a panacea. Taken on its own, it will not solve your problems. But it can be an important tool in your IT toolkit, and you should aim to make the best use of it – whatever “best” happens to mean for you.

      Jeremy Roberts

      Research Director, Infrastructure and Operations

      Info-Tech Research Group

      Executive Summary

      Your Challenge

      The cloud is multifaceted. It can be complicated. It can be expensive. Everyone has an opinion on the best way to proceed – and in many cases has already begun the process without bothering to get clearance from IT. The core challenge is creating a coherent strategy to facilitate your overall goals while making the best use of cloud technology, your financial resources, and your people.

      Common Obstacles

      Despite the universally agreed-upon benefit of formulating a coherent strategy, several obstacles make execution difficult:

      • Inconsistent understanding of what the cloud means
      • Inability to come to a consensus on key decisions
      • Ungoverned decision making
      • Unclear understanding of cloud roles and responsibilities

      Info-Tech’s Approach

      A cloud strategy might seem like a big project, but it’s just a series of smaller conversations. The methodology presented here is designed to facilitate those conversations, using a curated list of topics, prompts, participant lists, and sample outcomes. We have divided the strategy into four key areas:

      1. Vision and alignment
      2. People
      3. Governance
      4. Technology

      The answers might be different, but the questions are the same

      Every organization will approach the cloud differently, but they all need to ask the same questions: When will we use the cloud? What forms will our cloud usage take? How will we manage governance? What will we do about people? How will we incorporate new technology into our environment? The answers to these questions are as numerous as there are people to answer them, but the questions must be asked.

      Your challenge

      This research is designed to help organizations that are facing these challenges or looking to:

      • Ensure that the cloud strategy is complete and accurately reflects organizational goals and priorities.
      • Develop a consistent and coherent approach to adopting cloud services.
      • Design an approach to mitigate risks and challenges associated with adopting cloud services.
      • Create a shared understanding of the expected benefits of cloud services and the steps required to realize those benefits.

      Grappling with a cloud strategy is a top initiative: 43% of respondents report progressing on a cloud-first strategy as a top cloud initiative.

      Source: Flexera, 2021.

      Definition: Cloud strategy

      A document providing a systematic overview of cloud services, their appropriate use, and the steps that an organization will take to maximize value and minimize risk.

      Common obstacles

      These barriers make this challenge difficult to address for many organizations:

      • The cloud means different things to different people, and creating a strategy that is comprehensive enough to cover a multitude of use cases while also being written to be consumable by all stakeholders is difficult.
      • The incentives to adopt the cloud differ based on the expected benefit for the individual customer. User-led decision making and historically ungoverned deployments can make it difficult to reset expectation and align with a formal strategy.
      • Getting all the right people in a room together to agree on the key components of the strategy and the direction undertaken for each one is often difficult.

      Info-Tech’s approach

      Define Your Cloud Vision

      Vision and alignment

      • Mission and vision
      • Alignment to other strategic plans
      • Guiding principles
      • Measuring success

      Technology

      • Monitoring
      • Provisioning
      • Migration

      Governance

      • Architecture
      • Integration and interoperability
      • Operations management
      • Cloud portfolio management
      • Cloud vendor management
      • Finance management
      • Security
      • Data controls

      People

      • Skills and roles
      • Culture and adoption
      • Governing bodies

      Info-Tech’s approach

      Your cloud strategy will comprise the elements listed under “vision and alignment,” “technology,” “governance,” and “people.” The Info-Tech methodology involves breaking the strategy down into subcomponents and going through a three-step process for each one. Start by reviewing a standard set of questions and understanding the goal of the exercise: What do we need to know? What are some common considerations and best practices? Once you’ve had a chance to review, discuss your current state and any gaps: What has been done? What still needs to be done? Finally, outline how you plan to go forward: What are your next steps? Who needs to be involved?

      Review

      • What questions do we need to answer to complete the discussion of this strategy component? What does the decision look like?
      • What are some key terms and best practices we must understand before deciding?

      Discuss

      • What steps have we already taken to address this component?
      • Does anything still need to be done?
      • Is there anything we’re not sure about or need further guidance on?

      Go forward

      • What are the next steps?
      • Who needs to be involved?
      • What questions still need to be asked/answered?
      • What should the document’s wording look like?

      Info-Tech’s methodology for documenting your cloud strategy

      1. Document your vision and alignment

      2. Record your people strategy

      3. Document governance principles

      4. Formalize your technology strategy

      Phase Steps

      1. Record your cloud mission and vision
      2. Document your cloud strategy’s alignment with other strategic plans
      3. Record your cloud guiding principles
      4. Define success
      1. Outline your skills and roles strategy
      2. Document your approach to culture and adoption
      3. Create a cloud governing body

      Document official organizational positions in these governance areas:

      1. Architecture
      2. Integration and interoperability
      3. Operations management
      4. Cloud portfolio management
      5. Cloud vendor management
      6. Finance management
      7. Security
      8. Data controls
      1. Formalize organizational approach to monitoring
      2. Document provisioning process
      3. Outline migration processes and procedures

      Phase Outcomes

      Documented strategy: vision and alignment

      Documented people strategy

      Documented cloud governance strategy

      Documented cloud technology strategy

      Insight summary

      Separate strategy from tactics

      Separate strategy from tactics! A strategy requires building out the framework for ongoing decision making. It is meant to be high level and achieve a large goal. The outcome of a strategy is often a sense of commitment to the goal and better communication on the topic.

      The cloud does not exist in a vacuum

      Your cloud strategy flows from your cloud vision and should align with the broader IT strategy. It is also part of a pantheon of strategies and should exist harmoniously with other strategies – data, security, etc.

      People problems needn’t preponderate

      The cloud doesn’t have to be a great disruptor. If you handle the transition well, you can focus your people on doing more valuable work – and this is generally engaging.

      Governance is a means to an end

      Governing your deployment for its own sake will only frustrate your end users. Articulate the benefits users and the organization can expect to see and you’re more likely to receive the necessary buy-in.

      Technology isn’t a panacea

      Technology won’t solve all your problems. Technology is a force multiplier, but you will still have to design processes and train your people to fully leverage it.

      Key deliverable

      Cloud Strategy Document template

      Inconsistency and informality are the enemies of efficiency. Capture the results of the cloud strategy generation exercises in the Cloud Strategy Document template.

      The image contains a screenshot of the Cloud Strategy Document Template.
      • Record the results of the exercises undertaken as part of this blueprint in the Cloud Strategy Document template.
      • It is important to remember that not every cloud strategy will look exactly the same, but this template represents an amalgamation of best practices and cloud strategy creation honed over several years of advisory service in the space.
      • You know your audience better than anyone. If you would prefer a strategy delivered in a different way (e.g. presentation format) feel free to adapt the Cloud Vision Executive Presentation into a longer strategy presentation.
      • Emphasis is an area where you should exercise discretion as well. A cost-oriented cloud strategy, or one that prioritizes one type of cloud (e.g. SaaS) at the exclusion of others, may benefit from more focus on some areas than others, or the introduction of relevant subcategories. Include as many of these as you think will be relevant.
      • Parsimony is king – if you can distill a concept to its essence, start there. Include additional detail only as needed. You want your cloud strategy document to be read. If it’s too long or overly detailed, you’ll encounter readability issues.

      Blueprint benefits

      IT benefits

      Business benefits

      • A consistent, well-defined approach to the cloud
      • Consensus on key strategy components, including security, architecture, and integration
      • A clear path forward on skill development and talent acquisition/retention
      • A comprehensive resource for information about the organization’s approach to key strategy components
      • Predictable access to cloud services
      • A business-aligned approach to leveraging the resources available in the cloud
      • Efficient and secure consumption of cloud resources where appropriate to do so
      • Answers to questions about the cloud and how it will be leveraged in the environment

      Measure the value of this blueprint

      Don’t take our word for it:

      • Document Your Cloud Strategy has been available for several years in various forms as both a workshop and as an analyst-led guided implementation.
      • After each engagement, we send a survey that asks members how they benefited from the experience. Those who have worked through Info-Tech’s cloud strategy material have given overwhelmingly positive feedback.
      • Additionally, members reported saving between 10 and 20 days and an average of $46,499.
      • Measure the value by calculating the time saved as a result of using Info-Tech’s framework vs. a home-brewed cloud strategy alternative and by comparing the overall cost of a guided implementation or workshop with the equivalent offering from another firm. We’re confident you’ll come out ahead.

      8.8/10 Average reported satisfaction

      13 Days Average reported time savings

      $46,499 Average cost savings

      Executive Brief Case Study

      INDUSTRY: Pharmaceuticals

      SOURCE: Info-Tech workshop

      Pharmaceutical company

      The unnamed pharmaceutical company that is the subject of this case study was looking to make the transition to the cloud. In the absence of a coherent strategy, the organization had a few cloud deployments with no easily discernable overall approach. Representatives of several distinct functions (legal, infrastructure, data, etc.) all had opinions on the uses and abuses of cloud services, but it had been difficult to round everyone up and have the necessary conversations. As a result, the strategy exercise had not proceeded in a speedy or well-governed way. This lack of strategic readiness presented a roadblock to moving forward with the cloud strategy and to work with the cloud implementation partner, tasked with execution.

      Results

      The company engaged Info-Tech for a four-day workshop on cloud strategy documentation. Over the course of four days, participants drawn from across the organization discussed the strategic components and generated consensus statements and next steps. The team was able to formalize the cloud strategy and described the experience as saving 10 days.

      Example output: Document your cloud strategy workshop exercise

      The image contains an example of Document your cloud streatgy workshop exercise.

      Anything in green, the team was reasonably sure they had good alignment and next steps. Those yellow flags warranted more discussion and were not ready for documentation.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation

      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      Workshop

      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting

      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      Guided Implementation

      What does a typical GI on this topic look like?

      Document your vision and alignment

      Record your people strategy

      Document governance principles

      Formalize your technology strategy

      Call #1: Review existing vision/strategy documentation.

      Call #2: Review progress on skills, roles, and governance bodies.

      Call #3: Work through integration, architecture, finance management, etc. based on reqs. (May be more than one call.)

      Call #4: Discuss challenges with monitoring, provisioning, and migration as-needed.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization. A typical GI is 4 to 6 calls over the course of 1 to 3 months

      Workshop Overview

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      Day 1

      Day 2

      Day 3

      Day 4

      Day 5

      Answer
      “so what?”

      Define the
      IT target state

      Assess the IT
      current state

      Bridge the gap and
      create the strategy

      Next steps and
      wrap-up (offsite)

      Activities

      1.1 Introduction

      1.2 Discuss cloud mission and vision

      1.3 Discuss alignment with other strategic plans

      1.4 Discuss guiding principles

      1.5 Define success metrics

      2.1 Discuss skills and roles

      2.2 Review culture and adoption

      2.3 Discuss a cloud governing body

      2.4 Review architecture position

      2.5 Discuss integration and interoperability

      3.1 Discuss cloud operations management

      3.2 Review cloud portfolio management

      3.3 Discuss cloud vendor management

      3.4 Discuss cloud finance management

      3.5 Discuss cloud security

      4.1 Review and formalize data controls

      4.2 Design a monitoring approach

      4.3 Document the workload provisioning process

      4.4 Outline migration processes and procedures

      5.1 Populate the Cloud Strategy Document

      Deliverables

      Formalized cloud mission and vision, along with alignment with strategic plans, guiding principles, and success metrics

      Position statement on skills and roles, culture and adoption, governing bodies, architecture, and integration/interoperability

      Position statements on cloud operations management, portfolio management, vendor management, finance management, and cloud security

      Position statements on data controls, monitoring, provisioning, and migration

      Completed Cloud Strategy Document

      Phase 1

      Document Your Vision and Alignment

      Phase 1

      Phase 2

      Phase 3

      Phase 4

      1.1 Document your mission and vision

      1.2 Document alignment to other strategic plans

      1.3 Document guiding principles

      1.4 Document success metrics

      2.1 Define approach to skills and roles

      2.2 Define approach to culture and adoption

      2.3 Define cloud governing bodies

      3.1 Define architecture direction

      3.2 Define integration approach

      3.3 Define operations management process

      3.4 Define portfolio management direction

      3.5 Define vendor management direction

      3.6 Document finance management tactics

      3.7 Define approach to cloud security

      3.8 Define data controls in the cloud

      4.1 Define cloud monitoring strategy

      4.2 Define cloud provisioning strategy

      4.3 Define cloud migration strategy

      This phase will walk you through the following activities:

      1. Record your cloud mission and vision
      2. Document your cloud strategy’s alignment with other strategic plans
      3. Record your cloud guiding principles
      4. Define success

      This phase has the following outcome:

      • Documented strategy: vision and alignment

      Record your mission and vision

      Build on the work you’ve already done

      Before formally documenting your cloud strategy, you should ensure that you have a good understanding of your overall cloud vision. How do you plan to leverage the cloud? What goals are you looking to accomplish? How will you distribute your workloads between different cloud service models (SaaS, PaaS, IaaS)? What will your preferred delivery model be (public, private, hybrid)? Will you support your cloud deployment internally or use the services of various consultants or managed service providers?

      The answers to these questions will inform the first section of your cloud strategy. If you haven’t put much thought into this or think you could use a deep dive on the fundamentals of your cloud vision and cloud archetypes, consider reviewing Define Your Cloud Vision, the companion blueprint to this one.

      Once you understand your cloud vision and what you’re trying to accomplish with your cloud strategy, this phase will walk you through aligning the strategy with other strategic initiatives. What decisions have others made that will impact the cloud strategy (or that the cloud strategy will impact)? Who must be involved/informed? What callouts must be involved at what point? Do users have access to the appropriate strategic documentation (and would they understand it if they did)?

      You must also capture some guiding principles. A strategy by its nature provides direction, helping readers understand the decisions they should make and why those decisions align with organizational interests. Creating some top-level principles is a useful exercise because those principles facilitate comprehension and ensure the strategy’s applicability.

      Finally, this phase will walk you through the process of measuring success. Once you know where you’d like to go, the principles that underpin your direction, and how your cloud strategy figures into the broader strategic pantheon, you should record what success actually means. If you’re looking to save money, overall cost should be a metric you track. If the cloud is all about productivity, generate appropriate productivity metrics. If you’re looking to expand into new technology or close a datacenter, you will need to track output specific to those overall goals.

      Review: mission and vision

      The overall organizational mission is a key foundational element of the cloud strategy. If you don’t understand where you’re going, how can you begin the journey to get there? This section of the strategy has four key parts that you should understand and incorporate into the beginning of the strategy document. If you haven’t already, review Define Your Cloud Vision for instructions on how to generate these elements.

      1. Cloud vision statement: This is a succinct encapsulation of your overall perspective on the suitability of cloud services for your environment – what you hope to accomplish. The ideal statement includes a scope (who/what does the strategy impact?), a goal (what will it accomplish?), and a key differentiator (what will make it happen?). This is an example: “[Organization] will leverage public cloud solutions and retire existing datacenter and colocation facilities. This transition will simplify infrastructure administration, support and security, while modernizing legacy infrastructure and reducing the need for additional capital expenditure.” You might also consider reviewing your overall cloud archetype (next slide) and including the output of that exercise in the document

      2. Service model decision framework: Services can be provided as software as a service (SaaS), platform as a service (PaaS), infrastructure as a service (IaaS), or they can be colocated or remain on premises. Not all cloud service models serve the same purpose or provide equal value in all circumstances. Understanding how you plan to take advantage of these distinct service models is an important component of the cloud strategy. In this section of the strategy, a rubric that captures the characteristics of the ideal workload for each of the named service models, along with some justification for the selection, is essential. This is a core component of Define Your Cloud Vision, and if you would like to analyze individual workloads, you can use the Cloud Vision Workbook for that purpose.

      3. Delivery model decision framework: Just as there are different cloud service models that have unique value propositions, there are several unique cloud delivery models as well, distinguished by ownership, operation, and customer base. Public clouds are the purview of third-party providers who make them available to paying customers. Private clouds are built for the exclusive use of a designated organization or group of organizations with internal clients to serve. Hybrid clouds involve the use of multiple, interoperable delivery models (interoperability is the key term here), while multi-cloud deployment models incorporate multiple delivery and service models into a single coherent strategy. What will your preferred delivery model be? Why?

      4. Support model decision framework: Once you have a service model nailed down and understand how you will execute on the delivery, the question then becomes about how you will support your cloud deployment going forward. Broadly speaking, you can choose to manage your deployment in house using internal resources (e.g. staff), to use managed service providers for ongoing support, or to hire consultants to handle specific projects/tasks. Each approach has its strengths and weaknesses, and many cloud customers will deploy multiple support models across time and different workloads. A foundational perspective on the support model is a key component of the cloud vision and should appear early in the strategy.

      Understand key cloud concepts: Archetype

      Once you understand the value of the cloud, your workloads’ general suitability for the cloud, and your proposed risks and mitigations, the next step is to define your cloud archetype. Your organization’s cloud archetype is the strategic posture that IT adopts to best support the organization’s goals. Info-Tech’s model recognizes seven archetypes, divided into three high-level archetypes. After consultation with your stakeholders, and based on the results of the suitability and risk assessment activities, define your archetype. The archetype feeds into the overall cloud vision and provides simple insight into the cloud future state for all stakeholders. The cloud vision itself is captured in a “vision statement,” a short summary of the overall approach that includes the overall cloud archetype.

      The image contains an arrow facing vertically up. The pointed end of the arrow is labelled more cloud, and the bottom of the arrow is labelled less cloud.

      We can best support the organization’s goals by:

      Cloud-Focused

      Cloud-Centric

      Providing all workloads through cloud delivery.

      Cloud-First

      Using the cloud as our default deployment model. For each workload, we should ask “why NOT cloud?”

      Cloud-Opportunistic

      Hybrid

      Enabling the ability to transition seamlessly between on-premises and cloud resources for many workloads.

      Integrated

      Combining cloud and traditional infrastructure resources, integrating data and applications through APIs or middleware.

      Split

      Using the cloud for some workloads and traditional infrastructure resources for others.

      Cloud-Averse

      Cloud-Light

      Using traditional infrastructure resources and limiting our use of the cloud to when it is absolutely necessary.

      Anti-Cloud

      Using traditional infrastructure resources and avoiding the use of cloud wherever possible.

      Redesign Your IT Organizational Structure

      • Buy Link or Shortcode: {j2store}275|cart{/j2store}
      • member rating overall impact: 9.2/10 Overall Impact
      • member rating average dollars saved: $71,830 Average $ Saved
      • member rating average days saved: 25 Average Days Saved
      • Parent Category Name: Organizational Design
      • Parent Category Link: /organizational-design

      Most organizations go through an organizational redesign to:

      • Better align to the strategic objectives of the organization.
      • Increase the effectiveness of IT as a function.
      • Provide employees with clarity in their roles and responsibilities.
      • Support new capabilities.
      • Better align IT capabilities to suit the vision.
      • Ensure the IT organization can support transformation initiatives.

      Our Advice

      Critical Insight

      • Organizational redesign is only as successful as the process leaders engage in. It shapes a story framed in a strong foundation of need and a method to successfully implement and adopt the new structure.
      • Benchmarking your organizational redesign to other organizations will not work. Other organizations have different strategies, drivers, and context. It’s important to focus on your organization, not someone else's.
      • You could have the best IT employees in the world, but if they aren’t structured well your organization will still fail in reaching its vision.

      Impact and Result

      • We are often unsuccessful in organizational redesign because we lack an understanding of why this initiative is required or fail to recognize that it is a change initiative.
      • Successful organizational design requires a clear understanding of why it is needed and what will be achieved by operating in a new structure.
      • Additionally, understanding the impact of the change initiative can lead to greater adoption by core stakeholders.

      Redesign Your IT Organizational Structure Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Redesign Your IT Organizational Structure Deck – A defined method of redesigning your IT structure that is founded by clear drivers and consistently considering change management practices.

      The purpose of this storyboard is to provide a four-phased approach to organizational redesign.

      • Redesign Your IT Organizational Structure – Phases 1-4

      2. Communication Deck – A method to communicate the new organizational structure to critical stakeholders to gain buy-in and define the need.

      Use this templated Communication Deck to ensure impacted stakeholders have a clear understanding of why the new organizational structure is needed and what that structure will look like.

      • Organizational Design Communications Deck

      3. Redesign Your IT Organizational Structure Executive Summary Template – A template to secure executive leadership buy-in and financial support for the new organizational structure to be implemented.

      This template provides IT leaders with an opportunity to present their case for a change in organizational structure and roles to secure the funding and buy-in required to operate in the new structure.

      • Redesign Your IT Organizational Structure Executive Summary

      4. Redesign Your IT Organizational Structure Workbook – A method to document decisions made and rationale to support working through each phase of the process.

      This Workbook allows IT and business leadership to work through the steps required to complete the organizational redesign process and document key rationale for those decisions.

      • Redesign Your IT Organizational Structure Workbook

      5. Redesign Your IT Organizational Structure Operating Models and Capability Definitions – A tool that can be used to provide clarity on the different types of operating models that exist as well as the process definitions of each capability.

      Refer to this tool when working through the redesign process to better understand the operating model sketches and the capability definitions. Each capability has been tied back to core frameworks that exist within the information and technology space.

      • Redesign Your IT Organizational Structure Operating Models and Capability Definitions

      Infographic

      Workshop: Redesign Your IT Organizational Structure

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish the Organizational Design Foundation

      The Purpose

      Lay the foundation for your organizational redesign by establishing a set of organizational design principles that will guide the redesign process.

      Key Benefits Achieved

      Clearly articulate why this organizational redesign is needed and the implications the strategies and context will have on your structure.

      Activities

      1.1 Define the org design drivers.

      1.2 Document and define the implications of the business context.

      1.3 Align the structure to support the strategy.

      1.4 Establish guidelines to direct the organizational design process.

      Outputs

      Clear definition of the need to redesign the organizational structure

      Understanding of the business context implications on the organizational structure creation.

      Strategic impact of strategies on organizational design.

      Customized Design Principles to rationalize and guide the organizational design process.

      2 Create the Operating Model Sketch

      The Purpose

      Select and customize an operating model sketch that will accurately reflect the future state your organization is striving towards. Consider how capabilities will be sourced, gaps in delivery, and alignment.

      Key Benefits Achieved

      A customized operating model sketch that informs what capabilities will make up your IT organization and how those capabilities will align to deliver value to your organization.

      Activities

      2.1 Augmented list of IT capabilities.

      2.2 Capability gap analysis

      2.3 Identified capabilities for outsourcing.

      2.4 Select a base operating model sketch.

      2.5 Customize the IT operating model sketch.

      Outputs

      Customized list of IT processes that make up your organization.

      Analysis of which capabilities require dedicated focus in order to meet goals.

      Definition of why capabilities will be outsourced and the method of outsourcing used to deliver the most value.

      Customized IT operating model reflecting sourcing, centralization, and intended delivery of value.

      3 Formalize the Organizational Structure

      The Purpose

      Translate the operating model sketch into a formal structure with defined functional teams, roles, reporting structure, and responsibilities.

      Key Benefits Achieved

      A detailed organizational chart reflecting team structures, reporting structures, and role responsibilities.

      Activities

      3.1 Categorize your IT capabilities within your defined functional work units.

      3.2 Create a mandate statement for each work unit.

      3.3 Define roles inside the work units and assign accountability and responsibility.

      3.4 Finalize your organizational structure.

      Outputs

      Capabilities Organized Into Functional Groups

      Functional Work Unit Mandates

      Organizational Chart

      4 Plan for the Implementation & Change

      The Purpose

      Ensure the successful implementation of the new organizational structure by strategically communicating and involving stakeholders.

      Key Benefits Achieved

      A clear plan of action on how to transition to the new structure, communicate the new organizational structure, and measure the effectiveness of the new structure.

      Activities

      4.1 Identify and mitigate key org design risks.

      4.2 Define the transition plan.

      4.3 Create the change communication message.

      4.4 Create a standard set of FAQs.

      4.5 Align sustainment metrics back to core drivers.

      Outputs

      Risk Mitigation Plan

      Change Communication Message

      Standard FAQs

      Implementation and sustainment metrics.

      Further reading

      Redesign Your IT Organizational Structure

      Designing an IT structure that will enable your strategic vision is not about an org chart – it’s about how you work.

      EXECUTIVE BRIEF

      Analyst Perspective

      Structure enables strategy.

      The image contains a picture of Allison Straker.

      Allison Straker

      Research Director,

      Organizational Transformation

      The image contains a picture of Brittany Lutes.

      Brittany Lutes

      Senior Research Analyst,

      Organizational Transformation

      An organizational structure is much more than a chart with titles and names. It defines the way that the organization operates on a day-to-day basis to enable the successful delivery of the organization’s information and technology objectives. Moreover, organizational design sees beyond the people that might be performing a specific role. People and role titles will and often do change frequently. Those are the dynamic elements of organizational design that allow your organization to scale and meet specific objectives at defined points of time. Capabilities, on the other hand, are focused and related to specific IT processes.

      Redesigning an IT organizational structure can be a small or large change transformation for your organization. Create a structure that is equally mindful of the opportunities and the constraints that might exist and ensure it will drive the organization towards its vision with a successful implementation. If everyone understands why the IT organization needs to be structured that way, they are more likely to support and adopt the behaviors required to operate in the new structure.

      Executive Summary

      Your Challenge

      Your organization needs to reorganize itself because:

      • The current IT structure does not align to the strategic objectives of the organization.
      • There are inefficiencies in how the IT function is currently operating.
      • IT employees are unclear about their role and responsibilities, leading to inconsistencies.
      • New capabilities or a change in how the capabilities are organized is required to support the transformation.

      Common Obstacles

      Many organizations struggle when it comes redesigning their IT organizational structure because they:

      • Jump right into creating the new organizational chart.
      • Do not include the members of the IT leadership team in the changes.
      • Do not include the business in the changes.
      • Consider the context in which the change will take place and how to enable successful adoption.

      Info-Tech’s Approach

      Successful IT organization redesign includes:

      • Understanding the drivers, context, and strategies that will inform the structure.
      • Remaining objective by focusing on capabilities over people or roles.
      • Identifying gaps in delivery, sourcing strategies, customers, and degrees of centralization.
      • Remembering that organizational design is a change initiative and will require buy-in.

      Info-Tech Insight

      A successful redesign requires a strong foundation and a plan to ensure successful adoption. Without these, the organizational chart has little meaning or value.

      Your challenge

      This research is designed to help organizations who are looking to:

      • Redesign the IT structure to align to the strategic objectives of the enterprise.
      • Increase the effectiveness in how the IT function is operating in the organization.
      • Provide clarity to employees around their roles and responsibilities.
      • Ensure there is an ability to support new IT capabilities and/or align capabilities to better support the direction of the organization.
      • Align the IT organization to support a business transformation such as becoming digitally enabled or engaging in M&A activities.

      Organizational design is a challenge for many IT and digital executives

      69% of digital executives surveyed indicated challenges related to structure, team silos, business-IT alignment, and required roles when executing on a digital strategy.

      Source: MIT Sloan, 2020

      Common obstacles

      These barriers make IT organizational redesign difficult to address for many organizations:

      • Confuse organizational design and organizational charts as the same thing.
      • Start with the organizational chart, not taking into consideration the foundational elements that will make that chart successful.
      • Fail to treat organizational redesign as a change management initiative and follow through with the change.
      • Exclude impacted or influential IT leaders and/or business stakeholders from the redesign process.
      • Leverage an operating model because it is trending.

      To overcome these barriers:

      • Understand the context in which the changes will take place.
      • Communicate the changes to those impacted to enable successful adoption and implementation of a new organizational structure.
      • Understand that organizational design is for more than just HR leaders now; IT executives should be driving this change.

      Succeed in Organizational Redesign

      75% The percentage of change efforts that fail.

      Source: TLNT, 2019

      55% The percentage of practitioners who identify how information flows between work units as a challenge for their organization.

      Source: Journal of Organizational Design, 2019

      Organizational design defined

      If your IT strategy is your map, your IT organizational design represents the optimal path to get there.

      IT organizational design refers to the process of aligning the organization’s structure, processes, metrics, and talent to the organization’s strategic plan to drive efficiency and effectiveness.

      Why is the right IT organizational design so critical to success?

      Adaptability is at the core of staying competitive today

      Structure is not just an organizational chart

      Organizational design is a never-ending process

      Digital technology and information transparency are driving organizations to reorganize around customer responsiveness. To remain relevant and competitive, your organizational design must be forward looking and ready to adapt to rapid pivots in technology or customer demand.

      The design of your organization dictates how roles function. If not aligned to the strategic direction, the structure will act as a bungee cord and pull the organization back toward its old strategic direction (ResearchGate.net, 2014). Structure supports strategy, but strategy also follows structure.

      Organization design is not a one-time project but a continuous, dynamic process of organizational self-learning and continuous improvement. Landing on the right operating model will provide a solid foundation to build upon as the organization adapts to new challenges and opportunities.

      Understand the organizational differences

      Organizational Design

      Organizational design the process in which you intentionally align the organizational structure to the strategy. It considers the way in which the organization should operate and purposely aligns to the enterprise vision. This process often considers centralization, sourcing, span of control, specialization, authority, and how those all impact or are impacted by the strategic goals.

      Operating Model

      Operating models provide an architectural blueprint of how IT capabilities are organized to deliver value. The placement of the capabilities can alter the culture, delivery of the strategic vision, governance model, team focus, role responsibility, and more. Operating model sketches should be foundational to the organizational design process, providing consistency through org chart changes.

      Organizational Structure

      The organizational structure is the chosen way of aligning the core processes to deliver. This can be strategic, or it can be ad hoc. We recommend you take a strategic approach unless ad hoc aligns to your culture and delivery method. A good organizational structure will include: “someone with authority to make the decisions, a division of labor and a set of rules by which the organization operates” (Bizfluent, 2019).

      Organizational Chart

      The capstone of this change initiative is an easy-to-read chart that visualizes the roles and reporting structure. Most organizations use this to depict where individuals fit into the organization and if there are vacancies. While this should be informed by the structure it does not necessarily depict workflows that will take place. Moreover, this is the output of the organizational design process.

      Sources: Bizfluent, 2019; Strategy & Business, 2015; SHRM, 2021

      The Technology Value Trinity

      The image contains a diagram of the Technology Value Trinity as described in the text below.

      All three elements of the Technology Value Trinity work in harmony to delivery business value and achieve strategic needs. As one changes, the others need to change as well.

      How do these three elements relate?

      • Digital and IT strategy tells you what you need to achieve to be successful.
      • Operating model and organizational design align resources to deliver on your strategy and priorities. This is done by strategically structuring IT capabilities in a way that enables the organizations vision and considers the context in which the structure will operate.
      • I&T governance is the confirmation of IT’s goals and strategy, which ensures the alignment of IT and business strategy and is the mechanism by which you continuously prioritize work to ensure that what is delivered is in line with the strategy.

      Too often strategy, organizational design, and governance are considered separate practices – strategies are defined without teams and resources to support. Structure must follow strategy.

      Info-Tech’s approach to organizational design

      Like a story, a strategy without a structure to deliver on it is simply words on paper.

      Books begin by setting the foundation of the story.

      Introduce your story by:

      • Defining the need(s) that are driving this initiative forward.
      • Introducing the business context in which the organizational redesign must take place.
      • Outlining what’s needed in the redesign to support the organization in reaching its strategic IT goals.

      The plot cannot thicken without the foundation. Your organizational structure and chart should not exist without one either.

      The steps to establish your organizational chart - with functional teams, reporting structure, roles, and responsibilities defined – cannot occur without a clear definition of goals, need, and context. An organizational chart alone won’t provide the insight required to obtain buy-in or realize the necessary changes.

      Conclude your story through change management and communication.

      Good stories don’t end without referencing what happened before. Use the literary technique of foreshadowing – your change management must be embedded throughout the organizational redesign process. This will increase the likelihood that the organizational structure can be communicated, implemented, and reinforced by stakeholders.

      Info-Tech uses a capability-based approach to help you design your organizational structure

      Once your IT strategy is defined, it is critical to identify the capabilities that are required to deliver on those strategic initiatives. Each initiative will require a combination of these capabilities that are only supported through the appropriate organization of roles, skills, and team structures.

      The image contains a diagram of the various services and blueprints that Info-Tech has to offer.

      Embed change management into organizational design

      Change management practices are needed from the onset to ensure the implementation of an organizational structure.

      For each phase of this blueprint, its important to consider change management. These are the points when you need to communicate the structure changes:

      • Phase 1: Begin to socialize the idea of new organizational structure with executive leadership and explain how it might be impactful to the context of the organization. For example, a new control, governance model, or sourcing approach could be considered.
      • Phase 2: The chosen operating model will influence your relationships with the business and can create/eliminate silos. Ensure IT and business leaders have insight into these possible changes and a willingness to move forward.
      • Phase 3: The new organizational structure could create or eliminate teams, reduce or increase role responsibilities, and create different reporting structures than before. It’s time to communicate these changes with those most impacted and be able to highlight the positive outcomes of the various changes.
      • Phase 4: Should consider the change management practices holistically. This includes the type of change and length of time to reach the end state, communication, addressing active resistors, acquiring the right skills, and measuring the success of the new structure and its adoption.

      Info-Tech Insight

      Do not undertake an organizational redesign initiative if you will not engage in change management practices that are required to ensure its successful adoption.

      Measure the value of the IT organizational redesign

      Given that the organizational redesign is intended to align with the overall vision and objectives of the business, many of the metrics that support its success will be tied to the business. Adapt the key performance indicators (KPIs) that the business is using to track its success and demonstrate how IT can enable the business and improve its ability to reach those targets.

      Strategic Resources

      The percentage of resources dedicated to strategic priorities and initiatives supported by IT operating model. While operational resources are necessary, ensuring people are allocating time to strategic initiatives as well will drive the business towards its goal state. Leverage Info-Tech’s IT Staffing Assessment diagnostic to benchmark your IT resource allocation.

      Business Satisfaction

      Assess the improvement in business satisfaction overall with IT year over year to ensure the new structure continues to drive satisfaction across all business functions. Leverage Info-Tech’s CIO Business Vision diagnostic to see how your IT organization is perceived.

      Role Clarity

      The degree of clarity that IT employees have around their role and its core responsibilities can lead to employee engagement and retention. Consider measuring this core job driver by leveraging Info-Tech’s Employee Engagement Program.

      Customer & User Satisfaction

      Measure customer satisfaction with technology-enabled business services or products and improvements in technology-enabled client acquisition or retention processes. Assess the percentage of users satisfied with the quality of IT service delivery and leverage Info-Tech’s End-User Satisfaction Survey to determine improvements.

      Info-Tech’s methodology for Redesigning Your IT Organization

      Phase

      1. Establish the Organizational Design Foundation

      2. Create the Operating Model Sketch

      3. Formalize the Organizational Structure

      4. Plan for Implementation and Change

      Phase Outcomes

      Lay the foundation for your organizational redesign by establishing a set of organizational design principles that will guide the redesign process.

      Select and customize an operating model sketch that will accurately reflect the future state your organization is striving towards. Consider how capabilities will be sourced, gaps in delivery, and alignment.

      Translate the operating model sketch into a formal structure with defined functional teams, roles, reporting structure, and responsibilities.

      Ensure the successful implementation of the new organizational structure by strategically communicating and involving stakeholders.

      Insight summary

      Overarching insight

      Organizational redesign processes focus on defining the ways in which you want to operate and deliver on your strategy – something an organizational chart will never be able to convey.

      Phase 1 insight

      Focus on your organization, not someone else's’. Benchmarking your organizational redesign to other organizations will not work. Other organizations have different strategies, drivers, and context.

      Phase 2 insight

      An operating model sketch that is customized to your organization’s specific situation and objectives will significantly increase the chances of creating a purposeful organizational structure.

      Phase 3 insight

      If you follow the steps outlined in the first three phases, creating your new organizational chart should be one of the fastest activities.

      Phase 4 insight

      Throughout the creation of a new organizational design structure, it is critical to involve the individuals and teams that will be impacted.

      Tactical insight

      You could have the best IT employees in the world, but if they aren’t structured well your organization will still fail in reaching its vision.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:


      Communication Deck

      Communicate the changes to other key stakeholders such as peers, managers, and staff.

      Workbook

      As you work through each of the activities, use this workbook as a place to document decisions and rationale.

      Reference Deck

      Definitions for every capability, base operating model sketches, and sample organizational charts aligned to those operating models.

      Job Descriptions

      Key deliverable:

      Executive Presentation

      Leverage this presentation deck to gain executive buy-in for your new organizational structure.

      Blueprint benefits

      IT Benefits

      • Create an organizational structure that aligns to the strategic goals of IT and the business.
      • Provide IT employees with clarity on their roles and responsibilities to ensure the successful delivery of IT capabilities.
      • Highlight and sufficiently staff IT capabilities that are critical to the organization.
      • Define a sourcing strategy for IT capabilities.
      • Increase employee morale and empowerment.

      Business Benefits

      • IT can carry out the organization’s strategic mission and vision of all technical and digital initiatives.
      • Business has clarity on who and where to direct concerns or questions.
      • Reduce the likelihood of turnover costs as IT employees understand their roles and its importance.
      • Create a method to communicate how the organizational structure aligns with the strategic initiatives of IT.
      • Increase ability to innovate the organization.

      Executive Brief Case Study

      IT design needs to support organizational and business objectives, not just IT needs.

      INDUSTRY: Government

      SOURCE: Analyst Interviews and Working Sessions

      Situation

      IT was tasked with providing equality to the different business functions through the delivery of shared IT services. The government created a new IT organizational structure with a focus on two areas in particular: strategic and operational support capabilities.

      Challenge

      When creating the new IT structure, an understanding of the complex and differing needs of the business functions was not reflected in the shared services model.

      Outcome

      As a result, the new organizational structure for IT did not ensure adequate meeting of business needs. Only the operational support structure was successfully adopted by the organization as it aligned to the individual business objectives. The strategic capabilities aspect was not aligned to how the various business lines viewed themselves and their objectives, causing some partners to feel neglected.

      Info-Tech offers various levels of support to best suit your needs.

      DIY Toolkit

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation

      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      Workshop

      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting

      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      Guided Implementation

      What does a typical GI on this topic look like?

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization. A typical GI is 8 to 12 calls over the course of 4 to 6 months.

      Phase 1

      Call #1: Define the process, understand the need, and create a plan of action.

      Phase 2

      Call #2: Define org. design drivers and business context.

      Call #3: Understand strategic influences and create customized design principles.

      Call #4: Customize, analyze gaps, and define sourcing strategy for IT capabilities.

      Call #5: Select and customize the IT operating model sketch.

      Phase 3

      Call #6: Establish functional work units and their mandates.

      Call #7: Translate the functional organizational chart to an operational organizational chart with defined roles.

      Phase 4

      Call #8: Consider risks and mitigation tactics associated with the new structure and select a transition plan.

      Call #9: Create your change message, FAQs, and metrics to support the implementation plan.

      Workshop Overview

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      Day 1

      Day 2

      Day 3

      Day 4

      Day 5

      Establish the Organizational Redesign Foundation

      Create the Operating Model Sketch

      Formalize the Organizational Structure

      Plan for Implementation and Change

      Next Steps and
      Wrap-Up (offsite)

      Activities

      1.1 Define the org. design drivers.

      1.2 Document and define the implications of the business context.

      1.3 Align the structure to support the strategy.

      1.4 Establish guidelines to direct the organizational design process.

      2.1 Augment list of IT capabilities.

      2.2 Analyze capability gaps.

      2.3 Identify capabilities for outsourcing.

      2.4 Select a base operating model sketch.

      2.5 Customize the IT operating model sketch.

      3.1 Categorize your IT capabilities within your defined functional work units.

      3.2 Create a mandate statement for each work unit.

      3.3 Define roles inside the work units and assign accountability and responsibility.

      3.4 Finalize your organizational structure.

      4.1 Identify and mitigate key org. design risks.

      4.2 Define the transition plan.

      4.3 Create the change communication message.

      4.4 Create a standard set of FAQs.

      4.5 Align sustainment metrics back to core drivers.

      5.1 Complete in-progress deliverables from previous four days.

      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Deliverables

      1. Foundational components to the organizational design
      2. Customized design principles
      1. Heat mapped IT capabilities
      2. Defined outsourcing strategy
      3. Customized operating model
      1. Capabilities organized into functional groups
      2. Functional work unit mandates
      3. Organizational chart
      1. Risk mitigation plan
      2. Change communication message
      3. Standard FAQs
      4. Implementation and sustainment metrics
      1. Completed organizational design communications deck

      This blueprint is part one of a three-phase approach to organizational transformation

      PART 1: DESIGN

      PART 2: STRUCTURE

      PART 3: IMPLEMENT

      IT Organizational Architecture

      Organizational Sketch

      Organizational Structure

      Organizational Chart

      Transition Strategy

      Implement Structure

      1. Define the organizational design drivers, business context, and strategic alignment.

      2. Create customized design principles.

      3. Develop and customize a strategically aligned operating model sketch.

      4. Define the future-state work units.

      5. Create future-state work unit mandates.

      6. Define roles by work unit.

      7. Turn roles into jobs with clear capability accountabilities and responsibilities.

      8. Define reporting relationships between jobs.

      9. Assess options and select go-forward organizational sketch.

      11. Validate organizational sketch.

      12. Analyze workforce utilization.

      13. Define competency framework.

      14. Identify competencies required for jobs.

      15. Determine number of positions per job

      16. Conduct competency assessment.

      17. Assign staff to jobs.

      18. Build a workforce and staffing plan.

      19. Form an OD implementation team.

      20. Develop change vision.

      21. Build communication presentation.

      22. Identify and plan change projects.

      23. Develop organizational transition plan.

      24. Train managers to lead through change.

      25. Define and implement stakeholder engagement plan.

      26. Develop individual transition plans.

      27. Implement transition plans.

      Risk Management: Create, implement, and monitor risk management plan.

      HR Management: Develop job descriptions, conduct job evaluation, and develop compensation packages.

      Monitor and Sustain Stakeholder Engagement

      Phase 1

      Establish the Organizational Redesign Foundation

      This phase will walk you through the following activities:

      1.1 Define the organizational redesign driver(s)

      1.2 Create design principles based on the business context

      1.3a (Optional Exercise) Identify the capabilities from your value stream

      1.3b Identify the capabilities required to deliver on your strategies

      1.4 Finalize your list of design principles

      This phase involves the following participants:

      • CIO
      • IT Leadership
      • Business Leadership

      Embed change management into the organizational design process

      Articulate the Why

      Changes are most successful when leaders clearly articulate the reason for the change – the rationale for the organizational redesign of the IT function. Providing both staff and executive leaders with an understanding for this change is imperative to its success. Despite the potential benefits to a redesign, they can be disruptive. If you are unable to answer the reason why, a redesign might not be the right initiative for your organization.

      Employees who understand the rationale behind decisions made by executive leaders are 3.6 times more likely to be engaged.

      McLean & Company Engagement Survey Database, 2021; N=123,188

      Info-Tech Insight

      Successful adoption of the new organizational design requires change management from the beginning. Start considering how you will convey the need for organizational change within your IT organization.

      The foundation of your organizational design brings together drivers, context, and strategic implications

      All aspects of your IT organization’s structure should be designed with the business’ context and strategic direction in mind.

      Use the following set of slides to extract the key components of your drivers, business context, and strategic direction to land on a future structure that aligns with the larger strategic direction.

      REDESIGN DRIVERS

      Driver(s) can originate from within the IT organization or externally. Ensuring the driver(s) are easy to understand and articulate will increase the successful adoption of the new organizational structure.

      BUSINESS CONTEXT

      Defines the interactions that occur throughout the organization and between the organization and external stakeholders. The context provides insight into the environment by both defining the purpose of the organization and the values that frame how it operates.

      STRATEGY IMPLICATIONS

      The IT strategy should be aligned to the overall business strategy, providing insight into the types of capabilities required to deliver on key IT initiatives.

      Understand IT’s desired maturity level, alignment with business expectations, and capabilities of IT

      Where are we today?

      Determine the current overall maturity level of the IT organization.

      Where do we want to be as an organization?

      Use the inputs from Info-Tech’s diagnostic data to determine where the organization should be after its reorganization.

      How can you leverage these results?

      The result of these diagnostics will inform the design principles that you’ll create in this phase.

      Leverage Info-Tech’s diagnostics to provide an understanding of critical areas your redesign can support:

      CIO Business Vision Diagnostic

      Management & Governance Diagnostic

      IT Staffing Diagnostic

      The image contains a picture of Info-Tech's maturity ladder.

      Consider the organizational design drivers

      Consider organizational redesign if …

      Effectiveness is a concern:

      • Insufficient resources to meet demand
      • Misalignment to IT (and business) strategies
      • Lack of clarity around role responsibility or accountability
      • IT functions operating in silos

      New capabilities are needed:

      • Organization is taking on new capabilities (digital, transformation, M&A)
      • Limited innovation
      • Gaps in the capabilities/services of IT
      • Other external environmental influences or changes in strategic direction

      Lack of business understanding

      • Misalignment between business and IT or how the organization does business
      • Unhappy customers (internal or external)

      Workforce challenges

      • Frequent turnover or inability to attract new skills
      • Low morale or employee empowerment

      These are not good enough reasons …

      • New IT leader looking to make a change for the sake of change or looking to make their legacy known
      • To work with specific/hand-picked leaders over others
      • To “shake things up” to see what happens
      • To force the organization to see IT differently

      Info-Tech Insight

      Avoid change for change’s sake. Restructuring could completely miss the root cause of the problem and merely create a series of new ones.

      1.1 Define the organizational redesign driver(s)

      1-2 hours

      1. As a group, brainstorm a list of current pain points or inhibitors in the current organizational structure, along with a set of opportunities that can be realized during your restructuring. Group these pain points and opportunities into themes.
      2. Leverage the pain points and opportunities to help further define why this initiative is something you’re driving towards. Consider how you would justify this initiative to different stakeholders in the organization.
      3. Questions to consider:
        1. Who is asking for this initiative?
        2. What are the primary benefits this is intended to produce?
        3. What are you optimizing for?
        4. What are we capable of achieving as an IT organization?
        5. Are the drivers coming from inside or outside the IT organization?
      4. Once you’ve determined the drivers for redesigning the IT organization, prioritize those drivers to ensure there is clarity when communicating why this is something you are focusing time and effort on.

      Input

      Output

      • Knowledge of the current organization
      • Pain point and opportunity themes
      • Defined drivers of the initiative

      Materials

      Participants
      • Whiteboard/flip charts (physical or electronic)
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Communications Deck

      Frame the organizational design within the context of the business

      Workforce Considerations:

      • How does your organization view its people resources? Does it have the capacity to increase the number of resources?
      • Do you currently have sufficient staff to meet the demands of the organization? Are you able to outsource resources when demand requires it?
      • Are the members of your IT organization unionized?
      • Is your workforce distributed? Do time zones impact how your team can collaborate?

      Business Context Consideration

      IT Org. Design Implication

      Culture:

      Culture, "the way we do things here,” has huge implications for executing strategy, driving engagement, and providing a guiding force that ensures organizations can work together toward common goals.

      • What is the culture of your organization? Is it cooperative, traditional, competitive, or innovative? (See appendix for details.)
      • Is this the target culture or a stepping-stone to the ideal culture?
      • How do the attitudes and behaviors of senior leaders in the organization reinforce this culture?

      Consider whether your organization’s culture can accept the operating model and organizational structure changes that make sense on paper.

      Certain cultures may lean toward particular operating models. For example, the demand-develop-service operating model may be supported by a cooperative culture. A traditional organization may lean towards the plan-build-run operating model.

      Ensure you have considered your current culture and added exercises to support it.

      If more capacity is required to accomplish the goals of the organization, you’ll want to prepare the leaders and explain the need in your design principles (to reflect training, upskilling, or outsourcing). Unionized environments require additional consideration. They may necessitate less structural changes, and so your principles will need to reflect other alternatives (hiring additional resources, creative options) to support organizational needs. Hybrid or fully remote workforces may impact how your organization interacts.

      Business context considerations

      Business Context Consideration

      IT Org. Design Implication

      Control & Governance:

      It is important to consider how your organization is governed, how decisions are made, and who has authority to make decisions.

      Strategy tells what you do, governance validates you’re doing the right things, and structure is how you execute on what’s been approved.

      • How do decisions get considered and approved in your organization? Are there specific influences that impact the priorities of the organization?
      • Are those in the organization willing to release decision-making authority around specific IT components?
      • Should the organization take on greater accountability for specific IT components?

      Organizations that require more controls may lean toward more centralized governance. Organizations that are looking to better enable and empower their divisions (products, groups, regions, etc.) may look to embed governance in these parts of the organization.

      For enterprise organizations, consider where IT has authority to make decisions (at the global, local, or system level). Appropriate governance needs to be built into the appropriate levels.

      Business context considerations

      Business Context Consideration

      IT Org. Design Implication

      Financial Constraints:

      Follow the money: You may need to align your IT organization according to the funding model.

      • Do partners come to IT with their budgets, or does IT have a central pool that they use to fund initiatives from all partners?
      • Are you able to request finances to support key initiatives/roles prioritized by the organization?
      • How is funding aligned: technology, data, digital, etc.? Is your organization business-line funded? Pooled?
      • Are there special products or digital transformation initiatives with resources outside IT? Product ownership funding?
      • How are regulatory changes funded?
      • Do you have the flexibility to adjust your budget throughout the fiscal year?
      • Are chargebacks in place? Are certain services charged back to business units

      Determine if you can move forward with a new model or if you can adjust your existing one to suit the financial constraints.

      If you have no say over your funding, pre-work may be required to build a business case to change your funding model before you look at your organizational structure – without this, you might have to rule out centralized and focus on hybrid/centralized. If you don’t control the budget (funding comes from your partners), it will be difficult to move to a more centralized model.

      A federated business organization may require additional IT governance to help prioritize across the different areas.

      Budgets for digital transformation might come from specific areas of the business, so resources may need to be aligned to support that. You’ll have to consider how you will work with those areas. This may also impact the roles that are going to exist within your IT organization – product owners or division owners might have more say.

      Business context considerations

      Business Context Consideration

      IT Org. Design Implication

      Business Perspective of IT:

      How the business perceives IT and how IT perceives itself are sometimes not aligned. Make sure the business’ goals for IT are well understood.

      • Are your business partners satisfied if IT is an order taker? Do they agree with the need for IT to become a business partner? Is IT expected to innovate and transform the organization?
      • Is what the business needs from IT the same as what IT is providing currently?

      Business Organization Structure and Growth:

      • How is the overall organization structured: Centralized/decentralized? Functionally aligned? Divided by regions?
      • In what areas does the organization prioritize investments?
      • Is the organization located across a diverse geography?
      • How big is the organization?
      • How is the organization growing and changing – by mergers and acquisitions?

      If IT needs to become more of a business partner, you’ll want to define what that means to your organization and focus on the capabilities to enable this. Educating your partners might also be required if you’re not aligned.

      For many organizations, this will include stakeholder management, innovation, and product/project management. If IT and its business partners are satisfied with an order-taker relationship, be prepared for the consequences of that.

      A global organization will require different IT needs than a single location. Specifically, site reliability engineering (SRE) or IT support services might be deployed in each region. Organizations growing through mergers and acquisitions can be structured differently depending on what the organization needs from the transaction. A more centralized organization may be appropriate if the driver is reuse for a more holistic approach, or the organization may need a more decentralized organization if the acquisitions need to be handled uniquely.

      Business context considerations

      Business Context Consideration

      IT Org. Design Implication

      Sourcing Strategy:

      • What are the drivers for sourcing? Staff augmentation, best practices, time zone support, or another reason?
      • What is your strategy for sourcing?
      • Does IT do all of your technology work, or are parts being done by business or other units?
      • Are we willing/able to outsource, and will that place us into non-compliance (regulations)?
      • Do you have vendor management capabilities in areas that you might outsource?
      • How cloud-driven is your organization?
      • Do you have global operations?

      Change Tolerance:

      • What’s your organization’s tolerance to make changes around organizational design?
      • What's the appetite and threshold for risk?

      Your sourcing strategy affects your organizational structure, including what capabilities you group together. Since managing outsourced capabilities also includes the need for vendor management, you’ll need to ensure there aren’t too many capabilities required per leader. Look closely at what can be achieved through your operating model if IT is done through other groups. Even though these groups may not be in scope of your organization changes, you need to ensure your IT team works with them effectively.

      If your organization is going to push back if there are big structural changes, consider whether the changes are truly necessary. It may be preferred to take baby steps – use an incremental versus big-bang approach.

      A need for incremental change might mean not making a major operating model change.

      Business context considerations

      Business Context Consideration

      IT Org Design. Implication

      Stakeholder Engagement & Focus:

      Identify who your customers and stakeholders are; clarify their needs and engagement model.

      • Who is the customer for IT products and services?
      • Is your customer internal? External? Both?
      • How much of a priority is customer focus for your organization?
      • How will IT interact with customers, end users, and partners? What is the engagement model desired?

      Business Vision, Services, and Products:

      Articulate what your organization was built to do.

      • What does the organization create or provide?
      • Are these products and services changing?
      • What are the most critical capabilities to your organization?
      • What makes your organization a success? What are critical success factors of the organization and how are they measuring this to determine success?

      For a customer or user focus, ensure capabilities related to understanding needs (stakeholder, UX, etc.) are prioritized. Hybrid, decentralized, or demand-develop-service models often have more of a focus on customer needs.

      Outsourcing the service desk might be a consideration if there’s a high demand for the service. A differentiation between these users might mean there’s a different demand for services.

      Think broadly in terms of your organizational vision, not just the tactical (widget creation). You might need to choose an operating model that supports vision.

      Do you need to align your organization with your value stream? Do you need to decentralize specific capabilities to enable prioritization of the key capabilities?

      1.2 Create design principles based on the business context

      1-3 hours

      1. Discuss the business context in which the IT organizational redesign will be taking place. Consider the following standard components of the business context; include other relevant components specific to your organization:
      • Culture
      • Workforce Considerations
      • Control and Governance
      • Financial Constraints
      • Business Perspective of IT
      • Business Organization Structure and Growth
      • Sourcing Strategy
      • Change Tolerance
      • Stakeholder Engagement and Focus
      • Business Vision, Services, and Products
    • Different stakeholders can have different perspectives on these questions. Be sure to consider a holistic approach and engage these individuals.
    • Capture your findings and use them to create initial design principles.
    • Input

      Output

      • Business context
      • Design principles reflecting how the business context influences the organizational redesign for IT

      Materials

      Participants

      • Whiteboard/flip charts (physical or electronic)
      • List of Context Questions
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Communications Deck

      How your IT organization is structured needs to reflect what it must be built to do

      Structure follows strategy – the way you design will impact what your organization can produce.

      Designing your IT organization requires an assessment of what it needs to be built to do:

      • What are the most critical capabilities that you need to deliver, and what does success look like in those different areas?
      • What are the most important things that you deliver overall in your organization?

      The IT organization must reflect your business needs:

      • Understand your value stream and/or your prioritized business goals.
      • Understand the impact of your strategies – these can include your overall digital strategy and/or your IT strategy

      1.3a (Optional Exercise) Identify the capabilities from your value stream

      1 hour

      1. Identify your organization’s value stream – what your overall organization needs to do from supplier to consumer to provide value. Leverage Info-Tech’s industry reference architectures if you haven’t identified your value stream, or use the Document Your Business Architecture blueprint to create yours.
      2. For each item in your value stream, list capabilities that are critical to your organizational strategy and IT needs to further invest in to enable growth.
      3. Also, list those that need further support, e.g. those that lead to long wait times, rework time, re-tooling, down-time, unnecessary processes, unvaluable processes.*
      4. Capture the IT capabilities required to enable your business in your draft principles.
      The image contains a screenshot of the above activity: Sampling Manufacturing Business Capabilities.
      Source: Six Sigma Study Guide, 2014
      Input Output
      • Organization’s value stream
      • List of IT capabilities required to support the IT strategy
      Materials Participants
      • Whiteboard/flip charts (physical or electronic)
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Communications Deck

      Your strategy will help you decide on your structure

      Ensure that you have a clear view of the goals and initiatives that are needed in your organization. Your IT, digital, business, and/or other strategies will surface the IT capabilities your organization needs to develop. Identify the goals of your organization and the initiatives that are required to deliver on them. What capabilities are required to enable these? These capabilities will need to be reflected in your design principles.

      Sample initiatives and capabilities from an organization’s strategies

      The image contains a screenshot of sample initiatives and capabilities from an organization's strategies.

      1.3b Identify the capabilities required to deliver on your strategies

      1 hour

      1. For each IT goal, there may be one or more initiatives that your organization will need to complete in order to be successful.
      2. Document those goals and infinitives. For each initiative, consider which core IT capabilities will be required to deliver on that goal. There might be one IT capability or there might be several.
      3. Identify which capabilities are being repeated across the different initiatives. Consider whether you are currently investing in those capabilities in your current organizational structure.
      4. Highlight the capabilities that require IT investment in your design principles.
      InputOutput
      • IT goals
      • IT initiatives
      • IT, digital, and business strategies
      • List of IT capabilities required to support the IT strategy
      MaterialsParticipants
      • Whiteboard/flip charts (physical or electronic)
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Communications Deck

      Create your organizational design principles

      Your organizational design principles should define a set of loose rules that can be used to design your organizational structure to the specific needs of the work that needs to be done. These rules will guide you through the selection of the appropriate operating model that will meet your business needs. There are multiple ways you can hypothetically organize yourself to meet these needs, and the design principles will point you in the direction of which solution is the most appropriate as well as explain to your stakeholders the rationale behind organizing in a specific way. This foundational step is critical: one of the key reasons for organizational design failure is a lack of requisite time spent on the front-end understanding what is the best fit.

      The image contains an example of organizing design principles as described above.

      1.4 Finalize your list of design principles

      1-3 hours

      1. As a group, review the key outputs from your data collection exercises and their implications.
      2. Consider each of the previous exercises – where does your organization stand from a maturity perspective, what is driving the redesign, what is the business context, and what are the key IT capabilities requiring support. Identify how each will have an implication on your organizational redesign. Leverage this conversation to generate design principles.
      3. Vote on a finalized list of eight to ten design principles that will guide the selection of your operating model. Have everyone leave the meeting with these design principles so they can review them in more detail with their work units or functional areas and elicit any necessary feedback.
      4. Reconvene the group that was originally gathered to create the list of design principles and make any final amendments to the list as necessary. Use this opportunity to define exactly what each design principle means in the context of your organization so everyone has the same understanding of what this means moving forward.
      InputOutput
      • Organizational redesign drivers
      • Business context
      • IT strategy capabilities
      • Organizational design principles to help inform the selection of the right operating model sketch
      MaterialsParticipants
      • Whiteboard/flip charts (physical or electronic)
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Communications Deck

      Example design principles

      Your eight to ten design principles will be those that are most relevant to YOUR organization. Below are samples that other organizations have created, but yours will not be the same.

      Design Principle

      Description

      Decision making

      We will centralize decision making around the prioritization of projects to ensure that the initiatives driving the most value for the organization as a whole are executed.

      Fit for purpose

      We will build and maintain fit-for-purpose solutions based on business units’ unique needs.

      Reduction of duplication

      We will reduce role and application duplication through centralized management of assets and clearly differentiated roles that allow individuals to focus within key capability areas.

      Managed security

      We will manage security enterprise-wide and implement compliance and security governance policies.

      Reuse > buy > build

      We will maximize reuse of existing assets by developing a centralized application portfolio management function and approach.

      Managed data

      We will create a specialized data office to provide data initiatives with the focus they need to enable our strategy.

      Design Principle

      Description

      Controlled technical diversity

      We will control the variety of technology platforms we use to allow for increased operability and reduction of costs.

      Innovation

      R&D and innovation are critical – we will build an innovation team into our structure to help us meet our digital agenda.

      Resourcing

      We will separate our project and maintenance activities to ensure each are given the dedicated support they need for success and to reduce the firefighting mentality.

      Customer centricity

      The new structure will be directly aligned with customer needs – we will have dedicated roles around relationship management, requirements, and strategic roadmapping for business units.

      Interoperability

      We will strengthen our enterprise architecture practices to best prepare for future mergers and acquisitions.

      Cloud services

      We will move toward hosted versus on-premises infrastructure solutions, retrain our data center team in cloud best practices, and build roles around effective vendor management, cloud provisioning, and architecture.

      Phase 2

      Create the Operating Model Sketch

      This phase will walk you through the following activities:

      2.1 Augment the capability list

      2.2 Heatmap capabilities to determine gaps in service

      2.3 Identify the target state of sourcing for your IT capabilities

      2.4 Review and select a base operating model sketch

      2.5 Customize the selected overlay to reflect the desired future state

      This phase involves the following participants:

      • CIO
      • IT Leadership

      Embed change management into the organizational design process

      Gain Buy-In

      Obtain desire from stakeholders to move forward with organizational redesign initiative by involving them in the process to gain interest. This will provide the stakeholders with assurance that their concerns are being heard and will help them to understand the benefits that can be anticipated from the new organizational structure.

      “You’re more likely to get buy-in if you have good reason for the proposed changes – and the key is to emphasize the benefits of an organizational redesign.”

      Source: Lucid Chart

      Info-Tech Insight

      Just because people are aware does not mean they agree. Help different stakeholders understand how the change in the organizational structure is a benefit by specifically stating the benefit to them.

      Info-Tech uses capabilities in your organizational design

      We differentiate between capabilities and competencies.

      Capabilities

      • Capabilities are focused on the entire system that would be in place to satisfy a particular need. This includes the people who are competent to complete a specific task and also the technology, processes, and resources to deliver.
      • Capabilities work in a systematic way to deliver on specific need(s).
      • A functional area is often made up of one or more capabilities that support its ability to deliver on that function.
      • Focusing on capabilities rather then the individuals in organizational redesign enables a more objective and holistic view of what your organization is striving toward.

      Competencies

      • Competencies on the other hand are specific to an individual. It determines if the individual poses the skills or ability to perform.
      • Competencies are rooted in the term competent, which looks to understand if you are proficient enough to complete the specific task at hand.
      • Source: The People Development Magazine, 2020

      Use our IT capabilities to establish your IT organization design

      The image contains a diagram of the various services and blueprints that Info-Tech has to offer.

      2.1 Augment the capability list

      1-3 hours

      1. Using the capability list on the previous slide, go through each of the IT capabilities and remove any capabilities for which your IT organization is not responsible and/or accountable. Refer to the Operating Model and Capability Definition List for descriptions of each of the IT capabilities.
      2. Augment the language of specific capabilities that you feel are not directly reflective of what is being done within your organizational context or that you feel need to be changed to reflect more specifically how work is being done in your organization.
      • For example, some organizations may refer to their service desk capability as help desk or regional support. Use a descriptive term that most accurately reflects the terminology used inside the organization today.
    • Add any core capabilities from your organization that are missing from the provided IT capability list.
      • For example, organizations that leverage DevOps capabilities for their product development may desire to designate this in their operating model.
    • Document the rationale for decisions made for future reference.
    • Input Output
      • Baseline list of IT capabilities
      • IT capabilities required to support IT strategy
      • Customized list of IT capabilities
      Materials Participants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership

      Record the results in the Organizational Design Workbook

      Gaps in delivery

      Identify areas that require greater focus and attention.

      Assess the gaps between where you currently are and where you need to be. Evaluate how critical and how effective your capabilities are:

      • Criticality = Importance
        • Try to focus on those which are highly critical to the organization.
        • These may be capabilities that have been identified in your strategies as areas to focus on.
      • Effectiveness = Performance
        • Identify those where the process or system is broken or ineffective, preventing the team from delivering on the capability.
        • Effectiveness could take into consideration how scalable, adaptable, or sustainable each capability is.
        • Focus on the capabilities that are low or medium in effectiveness but highly critical. Addressing the delivery of these capabilities will lead to the most positive outcomes in your organization.

      Remember to identify what allows the highly effective capabilities to perform at the capacity they are. Leverage this when increasing effectiveness elsewhere.

      High Gap

      There is little to no effectiveness (high gap) and the capability is highly important to your organization.

      Medium Gap

      Current ability is medium in effectiveness (medium gap) and there might be some priority for that capability in your organization.

      Low Gap

      Current ability is highly effective (low gap) and the capability is not necessarily a priority for your organization.

      2.2 Heatmap capabilities to determine gaps in delivery

      1-3 hours

      1. At this point, you should have identified what capabilities you need to have to deliver on your organization's goals and initiatives.
      2. Convene a group of the key stakeholders involved in the IT organizational design initiative.
      3. Review your IT capabilities and color each capability border according to the effectiveness and criticality of that capability, creating a heat map.
      • Green indicates current ability is highly effective (low gap) and the capability is not necessarily a priority for your organization.
      • Yellow indicates current ability is medium in effectiveness (medium gap) and there might be some priority for that capability in your organization.
      • Red indicates that there is little to no effectiveness (high gap) and the capability is highly important to your organization.
      Input Output
      • Selected capabilities from activity 2.1
      • Gap analysis in delivery of capabilities currently
      Materials Participants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership

      Record the results in the Organizational Design Workbook

      Don’t forget the why: why are you considering outsourcing?

      There are a few different “types” of outsourcing:

      1. Competitive Advantage – Working with a third-party organization for the knowledge, insights, and best practices they can bring to your organization.
      2. Managed Service– The third party manages a capability or function for your organization.
      3. Staff Augmentation – Your organization brings in contractors and third-party organizations to fill specific skills gaps.

      Weigh which sourcing model(s) will best align with the needed capabilities to deliver effectively

      Insourcing

      Staff Augmentation

      Managed Service

      Competitive Advantage

      Description

      The organization maintains full responsibility for the management and delivery of the IT capability or service.

      Vendor provides specialized skills and enables the IT capability or service together with the organization to meet demand.

      Vendor completely manages the delivery of value for the IT capability, product or service.

      Vendor has unique skills, insights, and best practices that can be taught to staff to enable insourced capability and competency.

      Benefits

      • Retains in-house control over proprietary knowledge and assets that provide competitive or operational advantage.
      • Gains efficiency due to integration into the organization’s processes.
      • Provision of unique skills.
      • Addresses variation in demand for resources.
      • Labor cost savings.
      • Improves use of internal resources.
      • Improves effectiveness due to narrow specialization.
      • Labor cost savings.
      • Gain insights into aspects that could provide your organization with advantages over competitors.
      • Long-term labor cost savings.
      • Short-term outsourcing required.
      • Increase in-house competencies.

      Drawbacks

      • Quality of services/capabilities might not be as high due to lack of specialization.
      • No labor cost savings.
      • Potentially inefficient distribution of labor for the delivery of services/capabilities.
      • Potential conflicts in management or delivery of IT services and capabilities.
      • Negative impact on staff morale.
      • Limited control over services/capabilities.
      • Limited integration into organization’s processes.
      • Short-term labor expenses.
      • Requires a culture of continuous learning and improvement.

      Your strategy for outsourcing will vary with capability and capacity

      The image contains a diagram to show the Develop Vendor Management Capabilities, as described in the text below.

      Capability

      Capacity

      Outsourcing Model

      Low

      Low

      Your solutions may be with you for a long time, so it doesn’t matter whether it is a strategic decision to outsource development or if you are not able to attract the talent required to deliver in your market. Look for a studio, agency, or development shop that has a proven reputation for long-term partnership with its clients.

      Low

      High

      Your team has capacity but needs to develop new skills to be successful. Look for a studio, agency, or development shop that has a track record of developing its customers and delivering solutions.

      High

      Low

      Your organization knows what it is doing but is strapped for people. Look at “body shops” and recruiting agencies that will support short-term development contracts that can be converted to full-time staff or even a wholesale development shop acquisition.

      High

      High

      You have capability and capacity for delivering on your everyday demands but need to rise to the challenge of a significant, short-term rise in demand on a critical initiative. Look for a major system integrator or development shop with the specific expertise in the appropriate technology.

      Use these criteria to inform your right sourcing strategy

      Sourcing Criteria

      Description

      Determine whether you’ll outsource using these criteria

      1. Critical or commodity

      Determine whether the component to be sourced is critical to your organization or if it is a commodity. Commodity components, which are either not strategic in nature or related to planning functions, are likely candidates for outsourcing. Will you need to own the intellectual property created by the third party? Are you ok if they reuse that for their other clients?

      2. Readiness to outsource

      Identify how easy it would be to outsource a particular IT component. Consider factors such as knowledge transfer, workforce reassignment or reduction, and level of integration with other components.

      Vendor management readiness – ensuring that you have sufficient capabilities to manage vendors – should also be considered here.

      3. In-house capabilities

      Determine if you have the capability to deliver the IT solutions in-house. This will help you establish how easy it would be to insource an IT component.

      4. Ability to attract resources (internal vs. outsourced)

      Determine if the capability is one that is easily sourced with full-time, internal staff or if it is a specialty skill that is best left for a third-party to source.

      Determine your sourcing model using these criteria

      5. Cost

      Consider the total cost (investment and ongoing costs) of the delivery of the IT component for each of the potential sourcing models for a component.

      6. Quality

      Define the potential impact on the quality of the IT component being sourced by the possible sourcing models.

      7. Compliance

      Determine whether the sourcing model would fit with regulations in your industry. For example, a healthcare provider would only go for a cloud option if that provider is HIPAA compliant.

      8. Security

      Identify the extent to which each sourcing option would leave your organization open to security threats.

      9. Flexibility

      Determine the extent to which the sourcing model will allow your organization to scale up or down as demand changes.

      2.3 Identify capabilities that could be outsourced

      1-3 hours

      1. For each of the capabilities that will be in your future-state operating model, determine if it could be outsourced. Review the sourcing criteria available on the previous slide to help inform which sourcing strategy you will use for each capability.
      2. When looking to outsource or co-source capabilities, consider why that capability would be outsourced:
      • Competitive Advantage – Work with a third-party organization for the knowledge, insights, and best practices they can bring to your organization.
      • Managed Service – The third party manages a capability or function for your organization.
      • Staff Augmentation – Your organization brings in contractors and third-party organizations to fill specific skills gaps.
    • Place an asterisk (*) around the capabilities that will be leveraging one of the three previous sourcing options.
    • InputOutput
      • Customized IT capabilities
      • Sourcing strategy for each IT capability
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership

      Record the results in the Organizational Design Workbook

      What is an operating model?

      Leverage a cohesive operating model throughout the organizational design process.

      An IT operating model sketch is a visual representation of the way your IT organization needs to be designed and the capabilities it requires to deliver on the business mission, strategic objectives, and technological ambitions. It ensures consistency of all elements in the organizational structure through a clear and coherent blueprint.

      The visual should be the optimization and alignment of the IT organization’s structure to deliver the capabilities required to achieve business goals. Additionally, it should clearly show the flow of work so that key stakeholders can understand where inputs flow in and outputs flow out of the IT organization. Investing time in the front end getting the operating model right is critical. This will give you a framework to rationalize future organizational changes, allowing you to be more iterative and your model to change as the business changes.

      The image contains an example of an operating model as described in the text above.

      Info-Tech Insight

      Every structure decision you make should be based on an identified need, not on a trend.Build your IT organization to enable the priorities of the organization.

      Each IT operating model is characterized by a variety of advantages and disadvantages

      Centralized

      Hybrid

      Decentralized

      Advantages
      • Maximum flexibility to allocate IT resources across business units.
      • Low-cost delivery model and greatest economies of scale.
      • Control and consistency offers opportunity for technological rationalization and standardization and volume purchasing at the highest degree.
      • Centralizes processes and services that require consistency across the organization.
      • Decentralizes processes and services that need to be responsive to local market conditions.
      • Eliminates duplication and redundancy by allowing effective use of common resources (e.g. shared services, standardization).
      • Goals are aligned to the distinct business units or functions.
      • Greater flexibility and more timely delivery of services.
      • Development resources are highly knowledgeable about business-unit-specific applications.
      • Business unit has greatest control over IT resources and can set and change priorities as needed.

      Disadvantages

      • Less able to respond quickly to local requirements with flexibility.
      • IT can be resistant to change and unwilling to address the unique needs of end users.
      • Business units can be frustrated by perception of lack of control over resources.
      • Development of special business knowledge can be limited.
      • Requires the most disciplined governance structure and the unwavering commitment of the business; therefore, it can be the most difficult to maintain.
      • Requires new processes as pooled resources must be staffed to approved projects.
      • Redundancies, conflicts, and incompatible technologies can result from business units having differentiated services and applications – increasing cost.
      • Ability to share IT resources is low due to lack of common approaches.
      • Lack of integration limits the communication of data between businesses and reduces common reporting.

      Decentralization can take many forms – define what it means to your organization

      Decentralization can take a number of different forms depending on the products the organization supports and how the organization is geographically distributed. Use the following set of explanations to understand the different types of decentralization possible and when they may make sense for supporting your organizational objectives.

      Line of Business

      Decentralization by lines of business (LoB) aligns decision making with business operating units based on related functions or value streams. Localized priorities focus the decision making from the CIO or IT leadership team. This form of decentralization is beneficial in settings where each line of business has a unique set of products or services that require specific expertise or flexible resourcing staffing between the teams.

      Product Line

      Decentralization by product line organizes your team into operationally aligned product families to improve delivery throughput, quality, and resource flexibility within the family. By adopting this approach, you create stable product teams with the right balance between flexibility and resource sharing. This reinforces value delivery and alignment to enterprise goals within the product lines.

      Geographical

      Geographical decentralization reflects a shift from centralized to regional influences. When teams are in different locations, they can experience a number of roadblocks to effective communication (e.g. time zones, regulatory differences in different countries) that may necessitate separating those groups in the organizational structure, so they have the autonomy needed to make critical decisions.

      Functional

      Functional decentralization allows the IT organization to be separated by specialty areas. Organizations structured by functional specialization can often be organized into shared service teams or centers of excellence whereby people are grouped based on their technical, domain, or functional area within IT (Applications, Data, Infrastructure, Security, etc.). This allows people to develop specialized knowledge and skills but can also reinforce silos between teams.

      2.4 Review and select a base operating model sketch

      1 hour

      1. Review the set of base operating model sketches available on the following slides.
      2. For each operating model sketch, there are benefits and risks to be considered. Make an informed selection by understanding the risks that your organization might be taking on by adopting that particular operating model.
      3. If at any point in the selection process the group is unsure about which operating model will be the right fit, refer back to your design principles established in activity 1.4. These should guide you in the selection of the right operating model and eliminate those which will not serve the organization.
      InputOutput
      • Organizational design principles
      • Customized list of IT capabilities
      • Operating model sketch examples
      • Selected operating model sketch
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership

      Record the results in the Organizational Design Workbook

      Centralized Operating Model #1: Plan-Build-Run

      I want to…

      • Establish a formalized governance process that takes direction from the organization on which initiatives should be prioritized by IT.
      • Ensure there is a clear separation between teams that are involved in strategic planning, building solutions, and delivering operational support.
      • Be able to plan long term by understanding the initiatives that are coming down the pipeline and aligning to an infrequent budgeting plan.

      BENEFITS

      • Effective at implementing long-term plans efficiently; separates maintenance and projects to allow each to have the appropriate focus.
      • More oversight over financials; better suited for fixed budgets.
      • Works across centralized technology domains to better align with the business’ strategic objectives – allows for a top-down approach to decision making.
      • Allows for economies of scale and expertise pooling to improve IT’s efficiency.
      • Well-suited for a project-driven environment that employs waterfall or a hybrid project management methodology that is less iterative.

      RISKS

      • Creates artificial silos between the build (developers) and run (operations staff) teams, as both teams focus on their own responsibilities and often fail to see the bigger picture.
      • Miss opportunities to deliver value to the organization or innovate due to an inability to support unpredictable/shifting project demands as decision making is centralized in the plan function.
      • The portfolio of initiatives being pursued is often determined before requirements analysis takes place, meaning the initiative might be solving the wrong need or problem.
      • Depends on strong hand-off processes to be defined and strong knowledge transfer from build to run functions in order to be successful.
      The image contains an example of a Centralized Operating Model: Plan-Build-Run.

      Centralized Operating Model #2: Demand-Develop-Service

      I want to…

      • Listen to the business to understand new initiatives or service enhancements being requested.
      • Enable development and operations to work together to seamlessly deliver in a DevOps culture.
      • Govern and confirm that initiatives being requested by the business are still aligned to IT’s overarching strategy and roadmap before prioritizing those initiatives.

      BENEFITS

      • Aligns well with an end-to-end services model; constant attention to customer demand and service supply.
      • Centralizes service operations under one functional area to serve shared needs across lines of business.
      • Allows for economies of scale and expertise pooling to improve IT’s efficiency.
      • Elevates sourcing and vendor management as its own strategic function; lends well to managed service and digital initiatives.
      • Development and operations housed together; lends well to DevOps-related initiatives and reduces the silos between these two core groups.

      RISKS

      • IT prioritizes the initiatives it thinks are a priority to the business based on how well it establishes good stakeholder relations and communications.
      • Depends on good governance to prevent enhancements and demands from being prioritized without approval from those with accountability and authority.
      • This model thrives in a DevOps culture but does not mean it ensures your organization is a “DevOps” organization. Be sure you're encouraging the right behaviors and attitudes.

      The image contains an example of a Centralized Operating Model: Demand, Develop, Service.

      Hybrid Operating Model #1: LOB/Functional Aligned

      I want to…

      • Better understand the various needs of the organization to align IT priorities and ensure the right services can be delivered.
      • Keep all IT decisions centralized to ensure they align with the overarching strategy and roadmap that IT has set.
      • Organize your shared services in a strategic manner that enables delivery of those services in a way that fits the culture of the organization and the desired method of operating.

      BENEFITS

      • Best of both worlds of centralization and decentralization; attempts to channel benefits from both centralized and decentralized models.
      • Embeds key IT functions that require business knowledge within functional areas, allowing for critical feedback and the ability to understand those business needs.
      • Places IT in a position to not just be “order takers” but to be more involved with the different business units and promote the value of IT.
      • Achieves economies of scale where necessary through the delivery of shared services that can be requested by the function.
      • Shared services can be organized to deliver in the best way that suits the organization.

      RISKS

      • Different business units may bypass governance to get their specific needs met by functions – to alleviate this, IT must have strong governance and prioritize amongst demand.
      • Decentralized role can be viewed as an order taker by the business if not properly embedded and matured.
      • No guaranteed synergy and integration across functions; requires strong communication, collaboration, and steering.
      • Cannot meet every business unit’s needs – can cause tension from varying effectiveness of the IT functions.

      The image contains an example of a Hybrid Operating Model: LOB/Functional Aligned.

      Hybrid Model #2: Product-Aligned Operating Model

      I want to…

      • Align my IT organization into core products (services) that IT provides to the organization and establish a relationship with those in the organization that have alignment to that product.
      • Have roles dedicated to the lifecycle of their product and ensure the product can continuously deliver value to the organization.
      • Maintain centralized set of standards as it applies to overall IT strategy, security, and architecture to ensure consistency across products and reduce silos.

      BENEFITS

      • Focus is on the full lifecycle of a product – takes a strategic view of how technology enables the organization.
      • Promotes centralized backlog around a specific value creator, rather than a traditional project focus that is more transactional.
      • Dedicated teams around the product family ensure you have all of the resources required to deliver on your product roadmap.
      • Reduces barriers between IT and business stakeholders; focuses on technology as a key strategic enabler.
      • Delivery is largely done through frequent releases that can deliver value.

      RISKS

      • If there is little or no business involvement, it could prevent IT from truly understanding business demand and prioritizing the wrong work.
      • A lack of formal governance can create silos between the IT products, causing duplication of efforts, missed opportunities for collaboration, and redundancies in application or vendor contracts.
      • Members of each product can interpret the definition of standards (e.g. architecture, security) differently.

      The image contains an example of the Hybrid Operating Model: Product-Aligned Operating Model.

      Hybrid Operating Model #3: Service-Aligned Operating Model

      I want to…

      • Decentralize the IT organization by the various IT services it offers to the organization while remaining centralized with IT strategy, governance, security and operational services.
      • Ensure IT services are defined and people resources are aligned to deliver on those services.
      • Enable each of IT’s services to have the autonomy to understand the business needs and be able to manage the operational and new project initiatives with a dedicated service owner or business relationship manager.

      BENEFITS

      • Strong enabler of agility as each service has the autonomy to make decisions around operational work versus project work based on their understanding of the business demand.
      • Individuals in similar roles that are decentralized across services are given coaching to provide common direction.
      • Allows teams to efficiently scale with service demand.
      • This is a structurally baseline DevOps model. Each group will have services built within that have their own dedicated teams that will handle the full gambit of responsibilities, from new features to enhancements and maintenance.

      RISKS

      • Service owners require a method to collaborate to avoid duplication of efforts or projects that conflict with the efforts of other IT services.
      • May result in excessive cost through role redundancies across different services, as each will focus on components like integration, stakeholder management, project management, and user experiences.
      • Silos cause a high degree of specialization, making it more difficult for team members to imagine moving to another defined service group, limiting potential career advancement opportunities.
      • The level of complex knowledge required by shared services (e.g. help desk) is often beyond what they can provide, causing them to rely on and escalate to defined service groups more than with other operating models.

      The image contains an example of the Hybrid Operating Model: Service-Aligned Operating Model.

      Decentralized Model: Division Decentralization (LoB, Geography, Function, Product)

      I want to…

      • Decentralize the IT organization to enable greater autonomy within specific groups that have differing customer demands and levels of support.
      • Maintain a standard level of service that can be provided by IT for all divisions.
      • Ensure each division has access to critical data and reports that supports informed decision making.

      BENEFITS

      • Organization around functions allows for diversity in approach in how areas are run to best serve a specific business unit’s needs.
      • Each functional line exists largely independently, with full capacity and control to deliver service at the committed SLAs.
      • Highly responsive to shifting needs and demands with direct connection to customers and all stages of the solution development lifecycle.
      • Accelerates decision making by delegating authority lower into the function.
      • Promotes a flatter organization with less hierarchy and more direct communication with the CIO.

      RISKS

      • Requires risk and security to be centralized and have oversight of each division to prevent the decisions of one division from negatively impacting other divisions or the enterprise.
      • Less synergy and integration across what different lines of business are doing can result in redundancies and unnecessary complexity.
      • Higher overall cost to the IT group due to role and technology duplication across different divisions.
      • It will be difficult to centralize aspects of IT in the future, as divisions adopt to a culture of IT autonomy.

      The image contains an example of the Decentralized Model: Division Decentralization.

      Enterprise Model: Multi-Modal

      I want to…

      • Have an organizational structure that leverages several different operating models based on the needs and requirements of the different divisions.
      • Provide autonomy and authority to the different divisions so they can make informed and necessary changes as they see fit without seeking approval from a centralized IT group.
      • Support the different initiatives the enterprise is focused on delivering and ensure the right model is adopted based on those initiatives.

      BENEFITS

      • Allows for the organization to work in ways that best support individual areas; for example, areas that support legacy systems can be supported through traditional operating models while areas that support digital transformations may be supported through more flexible operating models.
      • Enables a specialization of knowledge related to each division.

      RISKS

      • Inconsistency across the organization can lead to confusion on how the organization should operate.
      • Parts of the organization that work in more traditional operating models may feel limited in career growth and innovation.
      • Cross-division initiatives may require greater oversight and a method to enable operations between the different focus areas.

      The image contains an example of the Enterprise Model: Multi-Modal.

      Create enabling teams that bridge your divisions

      The following bridges might be necessary to augment your divisions:

      • Specialized augmentation: There might not be a sufficient number of resources to support each division. These teams will be leveraged across the divisions; this means that the capabilities needed for each division will exist in this bridge team, rather than in the division.
      • Centers of Excellence: Capabilities that exist within divisions can benefit from shared knowledge across the enterprise. Your organization might set up centers of excellence to support best practices in capabilities organization wide. These are Forums in the unfix model, or communities of practice and support capability development rather than deliveries of each division.
      • Facilitation teams might be required to support divisions through coaching. This might include Agile or other coaches who can help teams adopt practices and embed learnings.
      • Holistic teams provide an enterprise view as they work with various divisions. This can include capabilities like user experience, which can benefit from the holistic perspective rather than a siloed one. People with these capabilities augment the divisions on an as-needed basis.
      The image contains a diagram to demonstrate the use of bridges on divisions.

      2.5 Customize the selected sketch to reflect the desired future state

      1-3 hours

      1. Using the baseline operating model sketch, walk through each of the IT capabilities. Based on the outputs from activity 2.1:
        1. Remove any capabilities for which your IT organization is not responsible and/or accountable.
        2. Augment the language of specific capabilities that you feel are not directly reflective of what is being done within your organizational context or that you feel need to be changed to reflect more specifically how work is being done in your organization.
        3. Add any core capabilities from your organization that are missing from the provided IT capability list.
      2. Move capabilities to the right places in the operating model to reflect how each of the core IT processes should interact with one another.
      3. Add bridges as needed to support the divisions in your organization. Identify which capabilities will sit in these bridges and define how they will enable the operating model sketch to deliver.
      InputOutput
      • Selected base operating model sketch
      • Customized list of IT capabilities
      • Understanding of outsourcing and gaps
      • Customized operating model sketch
      MaterialsParticipants
      • Whiteboard/flip charts
      • Operating model sketch examples
      • CIO
      • IT Leadership

      Record the results in the Organizational Design Workbook

      Document the final operating model sketch in the Communications Deck

      Phase 3

      Formalize the Organizational Structure

      This phase will walk you through the following activities:

      3.1 Create work units

      3.2 Create work unit mandates

      3.3 Define roles inside the work units

      3.4 Finalize the organizational chart

      3.5 Identify and mitigate key risks

      This phase involves the following participants:

      • CIO
      • IT Leadership
      • Business Leadership

      Embed change management into the organizational design process

      Enable adoption of the new structure.

      You don’t have to make the change in one big bang. You can adopt alternative transition plans such as increments or pilots. This allows people to see the benefits of why you are undergoing the change, allows the change message to be repeated and applied to the individuals impacted, and provides people with time to understand their role in making the new organizational structure successful.

      “Transformational change can be invigorating for some employees but also highly disruptive and stressful for others.”

      Source: OpenStax, 2019

      Info-Tech Insight

      Without considering the individual impact of the new organizational structure on each of your employees, the change will undoubtedly fail in meeting its intended goals and your organization will likely fall back into old structured habits.

      Use a top-down approach to build your target-state IT organizational sketch

      The organizational sketch is the outline of the organization that encompasses the work units and depicts the relationships among them. It’s important that you create the structure that’s right for your organization, not one that simply fits with your current staff’s skills and knowledge. This is why Info-Tech encourages you to use your operating model as a mode of guidance for structuring your future-state organizational sketch.

      The organizational sketch is made up of unique work units. Work units are the foundational building blocks on which you will define the work that IT needs to get done. The number of work units you require and their names will not match your operating model one to one. Certain functional areas will need to be broken down into smaller work units to ensure appropriate leadership and span of control.

      Use your customized operating model to build your work units

      WHAT ARE WORK UNITS?

      A work unit is a functional group or division that has a discrete set of processes or capabilities that it is responsible for, which don’t overlap with any others. Your customized list of IT capabilities will form the building blocks of your work units. Step one in the process of building your structure is grouping IT capabilities together that are similar or that need to be done in concert in the case of more complex work products. The second step is to iterate on these work units based on the organizational design principles from Phase 1 to ensure that the future-state structure is aligned with enablement of the organization’s objectives.

      Work Unit Examples

      Here is a list of example work units you can use to brainstorm what your organization’s could look like. Some of these overlap in functionality but should provide a strong starting point and hint at some potential alternatives to your current way of organizing.

      • Office of the CIO
      • Strategy and Architecture
      • Architecture and Design
      • Business Relationship Management
      • Projection and Portfolio Management
      • Solution Development
      • Solution Delivery
      • DevOps
      • Infrastructure and Operations
      • Enterprise Information Security
      • Security, Risk & Compliance
      • Data and Analytics

      Example of work units

      The image contains an example of work units.

      3.1 Create functional work units

      1-3 hours

      1. Using a whiteboard or large tabletop, list each capability from your operating model on a sticky note and recreate your operating model. Use one color for centralized activities and a second color for decentralized activities.
      2. With the group of key IT stakeholders, review the operating model and any important definitions and rationale for decisions made.
      3. Starting with your centralized capabilities, review each in turn and begin to form logical groups of compatible capabilities. Review the decentralized capabilities and repeat the process, writing additional sticky notes for capabilities that will be repeated in decentralized units.
      4. Note: Not all capabilities need to be grouped. If you believe that a capability has a high enough priority, has a lot of work, or is significantly divergent from others put this capability by itself.
      5. Define a working title for each new work unit, and discuss the pros and cons of the model. Ensure the work units still align with the operating model and make any changes to the operating model needed.
      6. Review your design principles and ensure that they are aligned with your new work units.
      InputOutput
      • Organizational business objectives
      • Customized operating model
      • Defined work units
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Workbook

      Group formation

      Understand the impact of the functional groups you create.

      A group consists of two or more individuals who are working toward a common goal. Group formation is how those individuals are organized to deliver on that common goal. It should take into consideration the levels of hierarchy in your structure, the level of focus you give to processes, and where power is dispersed within your organizational design.

      Importance: Balance highly important capabilities with lower priority capabilities

      Specialization: The scope of each role will be influenced by specialized knowledge and a dedicated leader

      Effectiveness: Group capabilities that increase their efficacy

      Span of Control: Identify the right number of employees reporting to a single leader

      Choose the degree of specialization required

      Be mindful of the number of hats you’re placing on any one role.

      • Specialization exists when individuals in an organization are dedicated to performing specific tasks associated with a common goal and requiring a particular skill set. Aligning the competencies required to carry out the specific tasks based on the degree of complexity associated with those tasks ensures the right people and number of people can be assigned.
      • When people are organized by their specialties, it reduces the likelihood of task switching, reduces the time spent training or cross-training, and increases the focus employees can provide to their dedicated area of specialty.
      • There are disadvantages associated with aligning teams by their specialization, such as becoming bored and seeing the tasks they are performing as monotonous. Specialization doesn’t come without its problems. Monitor employee motivation

      Info-Tech Insight

      Smaller organizations will require less specialization simply out of necessity. To function and deliver on critical processes, some people might be asked to wear several hats.

      Avoid overloading the cognitive capacity of employees

      Cognitive load refers to the number of responsibilities that one can successfully take on.

      • When employees are assigned an appropriate number of responsibilities this leads to:
        • Engaged employees
        • Less task switching
        • Increased effectiveness on assigned responsibilities
        • Reduced bottlenecks
      • While this cognitive load can differ from employee to employee, when assigning role responsibilities, ensure each role isn’t being overburdened and spreading their focus thin.
      • Moreover, capable does not equal successful. Just because someone has the capability to take on more responsibilities doesn’t mean they will be successful.
      • Leverage the cognitive load being placed on your team to help create boundaries between teams and demonstrate clear role expectations.
      Source: IT Revolution, 2021

      Info-Tech Insight

      When you say you are looking for a team that is a “jack of all trades,” you are likely exceeding appropriate cognitive loads for your staff and losing productivity to task switching.

      Factors to consider for span of control

      Too many and too few direct reports have negative impacts on the organization.

      Complexity: More complex work should have fewer direct reports. This often means the leader will need to provide lots of support, even engaging in the work directly at times.

      Demand: Dynamic shifts in demand require more managerial involvement and therefore should have a smaller span of control. Especially if this demand is to support a 24/7 operation.

      Competency Level: Skilled employees should require less hands-on assistance and will be in a better position to support the business as a member of a larger team than those who are new to the role.

      Purpose: Strategic leaders are less involved in the day-to-day operations of their teams, while operational leaders tend to provide hands-on support, specifically when short-staffed.

      Group formation will influence communication structure

      Pick your poison…

      It’s important to understand the impacts that team design has on your services and products. The solutions that a team is capable of producing is highly dependent on how teams are structured. For example, Conway’s Law tells us that small distributed software delivery teams are more likely to produce modular service architecture, where large collocated teams are better able to create monolithic architecture. This doesn’t just apply to software delivery but also other products and services that IT creates. Note that small distributed teams are not the only way to produce quality products as they can create their own silos.

      Sources: Forbes, 2017

      Create mandates for each of your identified work units

      WHAT ARE WORK UNIT MANDATES?

      The work unit mandate should provide a quick overview of the work unit and be clear enough that any reader can understand why the work unit exists, what it does, and what it is accountable for.

      Each work unit will have a unique mandate. Each mandate should be distinguishable enough from your other work units to make it clear why the work is grouped in this specific way, rather than an alternative option. The mandate will vary by organization based on the agreed upon work units, design archetype, and priorities.

      Don’t just adopt an example mandate from another organization or continue use of the organization’s pre-existing mandate – take the time to ensure it accurately depicts what that group is doing so that its value-added activities are clear to the larger organization.

      Examples of Work Unit Mandates

      The Office of the CIO will be a strategic enabler of the IT organization, driving IT organizational performance through improved IT management and governance. A central priority of the Office of the CIO is to ensure that IT is able to respond to evolving environments and challenges through strategic foresight and a centralized view of what is best for the organization.

      The Project Management Office will provide standardized and effective project management practices across the IT landscape, including an identified project management methodology, tools and resources, project prioritization, and all steps from project initiation through to evaluation, as well as education and development for project managers across IT.

      The Solutions Development Group will be responsible for the high-quality development and delivery of new solutions and improvements and the production of customized business reports. Through this function, IT will have improved agility to respond to new initiatives and will be able to deliver high-quality services and insights in a consistent manner.

      3.2 Create work unit mandates

      1-3 hours

      1. Break into teams of three to four people and assign an equal number of work units to each team.
      2. Have each team create a set of statements that describe the overall purpose of that working group. Each mandate statement should:
      • Be clear enough that any reader can understand.
      • Explain why the work unit exists, what it does, and what it is accountable for.
      • Be distinguishable enough from your other work units to make it clear why the work is grouped in this specific way, rather than an alternative option.
    • Have each group present their work unit mandates and make changes wherever necessary.
    • InputOutput
      • Work units
      • Work unit mandates
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Workbook

      Identify the key roles and responsibilities for the target IT organization

      Now that you have identified the main units of work in the target IT organization, it is time to identify the roles that will perform that work. At the end of this step, the key roles will be identified, the purpose statement will be built, and accountability and responsibility for roles will be clearly defined. Make sure that accountability for each task is assigned to one role only. If there are challenges with a role, change the role to address them (e.g. split roles or shift responsibilities).

      The image contains an example of two work units: Enterprise Architecture and PMO. It then lists the roles of the two work units.

      Info-Tech Insight

      Do not bias your role design by focusing on your existing staff’s competencies. If you begin to focus on your existing team members, you run the risk of artificially narrowing the scope of work or skewing the responsibilities of individuals based on the way it is, rather than the way it should be.

      3.3 Define roles inside the work units

      1-3 hours

      1. Select a work unit from the organizational sketch.
      2. Describe the most senior role in that work unit by asking, “what would the leader of this group be accountable or responsible for?” Define this role and move the capabilities they will be accountable for under that leader. Repeat this activity for the capabilities this leader would be responsible for.
      3. Continue to define each role that will be required in that work unit to deliver or provide oversight related to those capabilities.
      4. Continue until key roles are identified and the capabilities each role will be accountable or responsible for are clarified.
      5. Remember, only one role can have accountability for each capability but several can have responsibility.
      6. For each role, use the list of capabilities that the position will be accountable, responsible, or accountable and responsible for to create a job description. Leverage your own internal job descriptions or visit our Job Descriptions page.
      InputOutput
      • Work units
      • Work unit mandates
      • Responsibilities
      • Accountabilities
      • Roles with clarified responsibilities and accountabilities
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Workbook

      Delivery model for product or solution development

      Can add additional complexity or clarity

      • Certain organizational structures will require a specific type of resourcing model to meet expectations and deliver on the development or sustainment of core products and solutions.
      • There are four common methods that we see in IT organizations:
        • Functional Roles: Completed work is handed off from functional team to functional team sequentially as outlined in the organization’s SDLC.
        • Shared Service & Resource Pools (Matrix): Resources are pulled whenever the work requires specific skills or pushed to areas where product demand is high.
        • Product or System: Work is directly sent to the teams who are directly managing the product or directly supporting the requestor.
        • Skills & Competencies: Work is directly sent to the teams who have the IT and business skills and competencies to complete the work.
      • Each of these will lead to a difference in how the functional team is skilled. They could have a great understanding of their customer, the product, the solution, or their service.

      Info-Tech Insight

      Despite popular belief, there is no such thing as the Spotify model, and organizations that structured themselves based on the original Spotify drawing might be missing out on key opportunities to obtain productivity from employees.

      Sources: Indeed, 2020; Agility Scales

      There can be different patterns to structure and resource your product delivery teams

      The primary goal of any product delivery team is to improve the delivery of value for customers and the business based on your product definition and each product’s demand. Each organization will have different priorities and constraints, so your team structure may take on a combination of patterns or may take on one pattern and then transform into another.

      Delivery Team Structure Patterns

      How Are Resources and Work Allocated?

      Functional Roles

      Teams are divided by functional responsibilities (e.g. developers, testers, business analysts, operations, help desk) and arranged according to their placement in the software development lifecycle (SDLC).

      Completed work is handed off from team to team sequentially as outlined in the organization’s SDLC.

      Shared Service and Resource Pools

      Teams are created by pulling the necessary resources from pools (e.g. developers, testers, business analysts, operations, help desk).

      Resources are pulled whenever the work requires specific skills or pushed to areas where product demand is high.

      Product or System

      Teams are dedicated to the development, support, and management of specific products or systems.

      Work is directly sent to the teams who are directly managing the product or directly supporting the requester.

      Skills and Competencies

      Teams are grouped based on skills and competencies related to technology (e.g. Java, mobile, web) or familiarity with business capabilities (e.g. HR, Finance).

      Work is directly sent to the teams who have the IT and business skills and competencies to complete the work.

      Delivery teams will be structured according to resource and development needs

      Functional Roles

      Shared Service and Resource Pools

      Product or System

      Skills and Competencies

      When your people are specialists versus having cross-functional skills

      Leveraged when specialists such as Security or Operations will not have full-time work on the product

      When you have people with cross-functional skills who can self-organize around a product’s needs

      When you have a significant investment in a specific technology stack

      The image contains a diagram of functional roles.The image contains a diagram of shared service and resource pools.The image contains a diagram of product or system.The image contains a diagram of skills and competencies.

      For more information about delivering in a product operating model, refer to our Deliver Digital Products at Scale blueprint.

      3.4 Finalize the organizational chart

      1-3 hours

      1. Import each of your work units and the target-state roles that were identified for each.
      2. In the place of the name of each work unit in your organizational sketch, replace the work unit name with the prospective role name for the leader of that group.
      3. Under each of the leadership roles, import the names of team members that were part of each respective work unit.
      4. Validate the final structure as a group to ensure each of the work units includes all the necessary roles and responsibilities and that there is clear delineation of accountabilities between the work units.

      Input

      Output

      • Work units
      • Work unit mandates
      • Roles with accountabilities and responsibilities
      • Finalized organizational chart

      Materials

      Participants

      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Workbook & Executive Communications Deck

      Proactively consider and mitigate redesign risks

      Every organizational structure will include certain risks that should have been considered and accepted when choosing the base operating model sketch. Now that the final organizational structure has been created, consider if those risks were mitigated by the final organizational structure that was created. For those risks that weren’t mitigated, have a tactic to control risks that remain present.

      3.5 Identify and mitigate key risks

      1-3 hours

      1. For each of the operating model sketch options, there are specific risks that should have been considered when selecting that model.
      2. Take those risks and transfer them into the correct slide of the Organizational Design Workbook.
      3. Consider if there are additional risks that need to be considered with the new organizational structure based on the customizations made.
      4. For each risk, rank the severity of that risk on a scale of low, medium, or high.
      5. Determine one or more mitigation tactic(s) for each of the risks identified. This tactic should reduce the likelihood or impact of the risk event happening.
      InputOutput
      • Final organizational structure
      • Operating model sketch benefits and risks
      • Redesign risk mitigation plan
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Workbook

      Phase 4

      Plan for Implementation & Change

      This phase will walk you through the following activities:

      4.1 Select a transition plan

      4.2 Establish the change communication messages

      4.3 Be consistent with a standard set of FAQs

      4.4 Define org. redesign resistors

      4.5 Create a sustainment plan

      This phase involves the following participants:

      • CIO
      • IT Leadership
      • Business Leadership
      • HR Business Partners

      All changes require change management

      Change management is:

      Managing a change that requires replanning and reorganizing and that causes people to feel like they have lost control over aspects of their jobs.

      – Padar et al., 2017
      People Process Technology

      Embedding change management into organizational design

      PREPARE A

      Awareness: Establish the need for organizational redesign and ensure this is communicated well.

      This blueprint is mostly focused on the prepare and transition components.

      D

      Desire: Ensure the new structure is something people are seeking and will lead to individual benefits for all.

      TRANSITION K

      Knowledge: Provide stakeholders with the tools and resources to function in their new roles and reporting structure.

      A

      Ability: Support employees through the implementation and into new roles or teams.

      FUTURE R

      Reinforcement: Emphasize and reward positive behaviors and attitudes related to the new organizational structure.

      Implementing the new organizational structure

      Implementing the organizational structure can be the most difficult part of the process.

      • To succeed in the process, consider creating an implementation plan that adequately considers these five components.
      • Each of these are critical to supporting the final organizational structure that was established during the redesign process.

      Implementation Plan

      Transition Plan: Identify the appropriate approach to making the transition, and ensure the transition plan works within the context of the business.

      Communication Strategy: Create a method to ensure consistent, clear, and concise information can be provided to all relevant stakeholders.

      Plan to Address Resistance: Given that not everyone will be happy to move forward with the new organizational changes, ensure you have a method to hear feedback and demonstrate concerns have been heard.

      Employee Development Plan: Provide employees with tools, resources, and the ability to demonstrate these new competencies as they adjust to their new roles.

      Monitor and Sustain the Change: Establish metrics that inform if the implementation of the new organizational structure was successful and reinforce positive behaviors.

      Define the type of change the organizational structure will be

      As a result, your organization must adopt OCM practices to better support the acceptance and longevity of the changes being pursued.

      Incremental Change

      Transformational Change

      Organizational change management is highly recommended and beneficial for projects that require people to:

      • Adopt new tools and workflows.
      • Learn new skills.
      • Comply with new policies and procedures.
      • Stop using old tools and workflows.

      Organizational change management is required for projects that require people to:

      • Move into different roles, reporting structures, and career paths.
      • Embrace new responsibilities, goals, reward systems, and values.
      • Grow out of old habits, ideas, and behaviors.
      • Lose stature in the organization.

      Info-Tech Insight

      How you transition to the new organizational structure can be heavily influenced by HR. This is the time to be including them and leveraging their expertise to support the transition “how.”

      Transition Plan Options

      Description

      Pros

      Cons

      Example

      Big Bang Change

      Change that needs to happen immediately – “ripping the bandage off.”

      • It puts an immediate stop to the current way of operating.
      • Occurs quickly.
      • More risky.
      • People may not buy into the change immediately.
      • May not receive the training needed to adjust to the change.

      A tsunami in Japan stopped all imports and exports. Auto manufacturers were unable to get parts shipped and had to immediately find an alternative supplier.

      Incremental Change

      The change can be rolled out slower, in phases.

      • Can ensure that people are bought in along the way through the change process, allowing time to adjust and align with the change.
      • There is time to ensure training takes place.
      • It can be a timely process.
      • If the change is dragged on for too long (over several years) the environment may change and the rationale and desired outcome for the change may no longer be relevant.

      A change in technology, such as HRIS, might be rolled out one application at a time to ensure that people have time to learn and adjust to the new system.

      Pilot Change

      The change is rolled out for only a select group, to test and determine if it is suitable to roll out to all impacted stakeholders.

      • Able to test the success of the change initiative and the implementation process.
      • Able to make corrections before rolling it out wider, to aid a smooth change.
      • Use the pilot group as an example of successful change.
      • Able to gain buy-in and create change champions from the pilot group who have experienced it and see the benefits.
      • Able to prevent an inappropriate change from impacting the entire organization.
      • Lengthy process.
      • Takes time to ensure the change has been fully worked through.

      A retail store is implementing a new incentive plan to increase product sales. They will pilot the new incentive plan at select stores, before rolling it out broadly.

      4.1 Select a transition plan approach

      1-3 hours

      1. List each of the changes required to move from your current structure to the new structure. Consider:
        1. Changes in reporting structure
        2. Hiring new members
        3. Eliminating positions
        4. Developing key competencies for staff
      2. Once you’ve defined all the changes required, consider the three different transition plan approaches: big bang, incremental, and pilot. Each of the transition plan approaches will have drawbacks and benefits. Use the list of changes to inform the best approach.
      3. If you are proceeding with the incremental or the pilot, determine the order in which you will proceed with the changes or the groups that will pilot the new structure first.
      InputOutput
      • Customized operating model sketch
      • New org. chart
      • Current org. chart
      • List of changes to move from current to future state
      • Transition plan to support changes
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership
      • HR Business Partners

      Record the results in the Organizational Design Workbook

      Make a plan to effectively manage and communicate the change

      Success of your new organizational structure hinges on adequate preparation and effective communication.

      The top challenge facing organizations in completing the organizational redesign is their organizational culture and acceptance of change. Effective planning for the implementation and communication throughout the change is pivotal. Make sure you understand how the change will impact staff and create tailored plans for communication.

      65% of managers believe the organizational change is effective when provided with frequent and clear communication.

      Source: SHRM, 2021

      Communicate reasons for organizational structure changes and how they will be implemented

      Leaders of successful change spend considerable time developing a powerful change message, i.e. a compelling narrative that articulates the desired end state, and that makes the change concrete and meaningful to staff.

      The organizational change message should:

      • Explain why the change is needed.
      • Summarize what will stay the same.
      • Highlight what will be left behind.
      • Emphasize what is being changed.
      • Explain how change will be implemented.
      • Address how change will affect various roles in the organization.
      • Discuss the staff’s role in making the change successful.

      Five elements of communicating change

      • What is the change?
      • Why are we doing it?
      • How are we going to go about it?
      • How long will it take us to do it?
      • What will the role be for each department and individual?
      Source: Cornelius & Associates, 2010

      4.2 Establish the change communication messages

      2 hours

      1. The purpose of this activity is to establish a change communication message you can leverage when talking to stakeholders about the new organizational structure.
      2. Review the questions in the Organizational Design Workbook.
      3. Establish a clear message around the expected changes that will have to take place to help realize the new organizational structure.
      InputOutput
      • Customized operating model sketch
      • New org. chart
      • Current org. chart
      • List of changes
      • Transition plan
      • Change communication message for new organizational structure
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Workbook

      Apply the following communication principles to make your IT organization redesign changes relevant to stakeholders

      Be Clear

      • Say what you mean and mean what you say.
      • Choice of language is important: “Do you think this is a good idea? I think we could really benefit from your insights and experience here.” Or do you mean: “I think we should do this. I need you to do this to make it happen.”
      • Don’t use jargon.

      Be Consistent

      • The core message must be consistent regardless of audience, channel, or medium.
      • Test your communication with your team or colleagues to obtain feedback before delivering to a broader audience.
      • A lack of consistency can be interpreted as an attempt at deception. This can hurt credibility and trust.

      Be Concise

      • Keep communication short and to the point so key messages are not lost in the noise.
      • There is a risk of diluting your key message if you include too many other details.

      Be Relevant

      • Talk about what matters to the stakeholder.
      • Talk about what matters to the initiative.
      • Tailor the details of the message to each stakeholder’s specific concerns.
      • IT thinks in processes but stakeholders only care about results: talk in terms of results.
      • IT wants to be understood but this does not matter to stakeholders. Think: “what’s in it for them?”
      • Communicate truthfully; do not make false promises or hide bad news.

      Frequently asked questions (FAQs) provide a chance to anticipate concerns and address them

      As a starting point for building an IT organizational design implementation, look at implementing an FAQ that will address the following:

      • The what, who, when, why, and where
      • The transition process
      • What discussions should be held with clients in business units
      • HR-centric questions

      Questions to consider answering:

      • What is the objective of the IT organization?
      • What are the primary changes to the IT organization?
      • What does the new organizational structure look like?
      • What are the benefits to our IT staff and to our business partners?
      • How will the IT management team share new information with me?
      • What is my role during the transition?
      • What impact is there to my reporting relationship within my department?
      • What are the key dates I should know about?

      4.3 Be consistent with a standard set of FAQs

      1 hour

      1. Beyond the completed communications plans, brainstorm a list of answers to the key “whats” of your organizational design initiative:
      • What is the objective of the IT organization?
      • What are the primary changes to the IT organization?
      • What does the new organizational structure look like?
      • What are the benefits to our IT staff and to our business partners?
    • Think about any key questions that may rise around the transition:
      • How will the IT management team share new information with me?
      • What is my role during the transition?
      • What impact is there to my reporting relationship within my department?
      • What are the key dates I should know about?
    • Determine the best means of socializing this information. If you have an internal wiki or knowledge-sharing platform, this would be a useful place to host the information.
    • InputOutput
      • Driver(s) for the new organizational structure
      • List of changes to move from current to future state
      • Change communication message
      • FAQs to provide to staff about the organizational design changes
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Workbook

      The change reaction model

      The image contains a picture of the change reaction model. The model includes a double arrow pointing in both directions of left and right. On top of the arrow are 4 circles spread out on the arrow. They are labelled: Active Resistance, Detachment, Questioning, Acceptance.

      (Adapted from Cynthia Wittig)

      Info-Tech Insight

      People resist changes for many reasons. When it comes to organizational redesign changes, some of the most common reasons people resist change include a lack of understanding, a lack of involvement in the process, and fear.

      Include employees in the employee development planning process

      Prioritize

      Assess employee to determine competency levels and interests.

      Draft

      Employee drafts development goals; manager reviews.

      Select

      Manager helps with selection of development activities.

      Check In

      Manager provides ongoing check-ins, coaching, and feedback.

      Consider core and supplementary components that will sustain the new organizational structure

      Supplementary sustainment components:

      • Tools & Resources
      • Structure
      • Skills
      • Work Environment
      • Tasks
      • Disincentives

      Core sustainment components:

      • Empowerment
      • Measurement
      • Leadership
      • Communication
      • Incentives

      Sustainment Plan

      Sustain the change by following through with stakeholders, gathering feedback, and ensuring that the change rationale and impacts are clearly understood. Failure to so increases the potential that the change initiative will fail or be a painful experience and cost the organization in terms of loss of productivity or increase in turnover rates.

      Support sustainment with clear measurements

      • Measurement is one of the most important components of monitoring and sustaining the new organizational structure as it provides insight into where the change is succeeding and where further support should be added.
      • There should be two different types of measurements:
      1. Standard Change Management Metrics
      2. Organizational Redesign Metrics
    • When gathering data around metrics, consider other forms of measurement (qualitative) that can provide insights on opportunities to enhance the success of the organizational redesign change.
      1. Every measurement should be rooted to a goal. Many of the goals related to organizational design will be founded in the driver of this change initiative
      2. Once the goals have been defined, create one or more measurements that determines if the goal was successful.
      3. Use specific key performance indicators (KPIs) that contain a metric that is being measured and the frequency of that measurement.

      Info-Tech Insight

      Obtaining qualitative feedback from employees, customers, and business partners can provide insight into where the new organizational structure is operating optimally versus where there are further adjustments that could be made to support the change.

      4.4 Consider sustainment metrics

      1 hour

      1. Establish metrics that bring the entire process together and that will ensure the new organizational design is a success.
      2. Go back to your driver(s) for the organizational redesign. Use these drivers to help inform a particular measurement that can be used to determine if the new organizational design will be successful. Each measurement should be related to the positive benefits of the organization, an individual, or the change itself.
      3. Once you have a list of measurements, use these to determine the specific KPI that can be qualified through a metric. Often you are looking for an increase or decrease of a particular measurement by a dollar or percentage within a set time frame.
      4. Use the example metrics in the workbook and update them to reflect your organization’s drivers.
      InputOutput
      • Driver(s) for the new organizational structure
      • List of changes to move from current to future state
      • Change communication message
      • Sustainment metrics
      MaterialsParticipants
      • Whiteboard/Flip Charts
      • CIO
      • IT Leadership
      • Business Leadership

      Record the results in the Organizational Design Workbook

      Related Info-Tech Research

      Build a Strategic IT Workforce Plan

      • Continue into the second phase of the organizational redesign process by defining the required workforce to deliver.
      • Leveraging trends, data, and feedback from your employees, define the competencies needed to deliver on the defined roles.

      Implement a New IT Organizational Structure

      • Organizational design implementations can be highly disruptive for IT staff and business partners.
      • Without a structured approach, IT leaders may experience high turnover, decreased productivity, and resistance to the change.

      Define the Role of Project Management in Agile and Product-Centric Delivery

      • There are many voices with different opinions on the role of project management. This causes confusion and unnecessary churn.
      • Project management and product management naturally align to different time horizons. Harmonizing their viewpoints can take significant work.

      Research Contributors and Experts

      The image contains a picture of Jardena London.

      Jardena London

      Transformation Catalyst, Rosetta Technology Group

      The image contains a picture of Jodie Goulden.

      Jodie Goulden

      Consultant | Founder, OrgDesign Works

      The image contains a picture of Shan Pretheshan.

      Shan Pretheshan

      Director, SUPA-IT Consulting

      The image contains a picture of Chris Briley.

      Chris Briley

      CIO, Manning & Napier

      The image contains a picture of Dean Meyer.

      Dean Meyer

      President N. Dean Meyer and Associates Inc.

      The image contains a picture of Jimmy Williams.

      Jimmy Williams

      CIO, Chocktaw Nation of Oklahoma

      Info-Tech Research Group

      Cole Cioran, Managing Partner

      Dana Daher, Research Director

      Hans Eckman, Principal Research Director

      Ugbad Farah, Research Director

      Ari Glaizel, Practice Lead

      Valence Howden, Principal Research Director

      Youssef Kamar, Senior Manager, Consulting

      Carlene McCubbin, Practice Lead

      Baird Miller, Executive Counsellor

      Josh Mori, Research Director

      Rajesh Parab, Research Director

      Gary Rietz, Executive Counsellor

      Bibliography

      “A Cheat Sheet for HR Professionals: The Organizational Development Process.” AIHR, 2021. Web.

      Acharya, Ashwin, Roni Lieber, Lissa Seem, and Tom Welchman. “How to identify the right ‘spans of control’ for your organization.” McKinsey, 21 December 2017. Web.

      Anand. N., and Jean-Louis Barsoux. “What everyone gets wrong about change management. Harvard Business Review, December 2017. Web.

      Atiken, Chris. “Operating model design-first principles.” From Here On, 24 August 2018. Web.

      “Avoid common digital transformation challenges: Address your IT Operating Model Now.” Sofigate, 5 May 2020. Web.

      Baumann, Oliver, and Brian Wu. “The many dimensions of research on designing flat firms.” Journal of Organizational Design, no. 3, vol. 4. 09 May 2022.Web.

      Bertha, Michael. “Cross the project to product chasm.” CIO, 1 May 2020. Web.

      Blenko, Marcia, and James Root. “Design Principles for a Robust Operating Model.” Bain & Company, 8 April 2015. Web.

      Blenko, Marcia, Leslie Mackrell, and Kevin Rosenberg. “Operating models: How non-profits get from strategy to results.” The Bridge Span Group, 15 August 2019. Web.

      Boulton, Clint. “PVH finds perfect fit in hybrid IT operating model amid pandemic.” CIO, 19 July 2021. Web.

      Boulton, Clint. “Why digital disruption leaves no room for bimodal IT.” CIO, 11 May 2017. Web.

      Bright, David, et al. “Chapter 10: Organizational Structure & Change.” Principles of Management, OpenStax, Rice University, 20 March 2019. Book.

      Campbell, Andrew. “Design Principles: How to manage them.” Ashridge Operating Models. 1 January 2022. Web.

      D., Maria. “3 Types of IT Outsourcing Models and How to Choose Between Them.” Cleveroad, 29 April 2022. Web.

      Devaney, Eric. “9 Types of Organizational Structure Every Company Should Consider.” HubSpot, 11 February 2022. Web.

      Devaney, Erik. “The six building blocks of organizational structure.” Hubspot, 3 June 2020. Web.

      Eisenman, M., S. Paruchuri, and P. Puranam. “The design of emergence in organizations.” Journal of Organization Design, vol. 9, 2020. Web.

      Forbes Business Development Council. “15 Clear Signs It’s Time to Restructure the Business.” Forbes, 10 February 2020. Web.

      Freed, Joseph. “Why Cognitive Load Could Be The Most Important Employee Experience Metric In The Next 10 Years.” Forbes, 30 June 2020. Web.

      Galibraith, Jay. “The Star Model.” JayGalbraith.com, n.d. Web.

      Girod, Stéphane, and Samina Karim. “Restructure or reconfigure?” Harvard Business Review, April 2017. Web.

      Goldman, Sharon. “The need for a new IT Operating Model: Why now?” CIO, 27 August 2019. Web.

      Halapeth, Milind. “New age IT Operating Model: Creating harmony between the old and the new.” Wirpo, n.d. Web.

      Harvey, Michelle. “Why a common operating model is efficient for business productivity.” CMC, 10 May 2020. Web.

      Helfand, Heidi. “Dynamic Reteaming.” O’Reilly Media, 7 July 2020. Book.

      JHeller, Martha. “How Microsoft CIO Jim DuBois changed the IT Operating Model.” CIO, 2 February 2016. Web.

      Heller, Martha. “How Stryker IT Shifted to a global operating model.” CIO, 19 May 2021. Web.

      Heller, Michelle. “Inside blue Shields of California’s IT operating model overhaul.” CIO, 24 February 2021. Web.

      Hessing, Ted. “Value Stream Mapping.” Six Sigma Study Guide, 11 April 2014. Web.

      Huber, George, P. “What is Organization Design.” Organizational Design Community, n.d. Web.

      Indeed Editorial Team. “5 Advantages and Disadvantages of the Matrix Organizational Structure.” Indeed, 23 November 2020. Web.

      Indeed Editorial Team. “How to plan an effective organization restructure.” Indeed, 10 June 2021. Web.

      “Insourcing vs Outsourcing vs Co-Sourcing.” YML Group, n.d. Web.

      “Investing in more strategic roles.” CAPS Research, 3 February 2022. Web.

      Jain, Gagan. “Product IT Operating Model: The next-gen model for a digital work.” DevOps, 22 July 2019. Web.

      Kane, Gerald, D. Plamer, and Anh Phillips. “Accelerating Digital Innovation Inside and Out.” Deloitte Insights, 4 June 2019. Web.

      Krush, Alesia. “IT companies with ‘flat’ structures: utopia or innovative approach?” Object Style, 18 October 2018. Web.

      Law, Michael. “Adaptive Design: Increasing Customer Value in Your Organisation.” Business Agility Institute, 5 October 2020. Web.

      LucidContent Team. “How to get buy-in for changes to your organizational structure.” Lucid Chart, n.d. Web.

      Matthews, Paul. “Do you know the difference between competence and capability?” The People Development Magazine, 25 September 2020. Web.

      Meyer, Dean N. “Analysis: Common symptoms of organizational structure problems.” NDMA, n.d. Web.

      Meyer, N. Dean. “Principle-based Organizational Structure.” NDMA Publishing, 2020. Web.

      Morales Pedraza, Jorge. Answer to posting, “What is the relationship between structure and strategy?” ResearchGate.net, 5 March 2014. Web.

      Nanjad, Len. “Five non-negotiables for effective organization design change.” MNP, 01 October 2021. Web.

      Neilson, Gary, Jaime Estupiñán, and Bhushan Sethi. “10 Principles of Organizational Design.” Strategy & Business, 23 March 2015. Web.

      Nicastro, Dom. “Understanding the Foundational Concepts of Organizational Design.” Reworked, 24 September 2020. Web.

      Obwegeser, Nikolaus, Tomoko Yokoi, Michael Wade, and Tom Voskes. “7 Key Principles to Govern Digital Initiatives.” MIT Sloan, 1 April 2020. Web.

      “Operating Models and Tools.” Business Technology Standard, 23 February 2021. Web.

      “Organizational Design Agility: Journey to a combined community.” ODF-BAI How Space, Organizational Design Forum, 2022. Web.

      “Organizational Design: Understanding and getting started.” Ingentis, 20 January 2021. Web.

      Padar, Katalin, et al. “Bringing project and change management roles into sync.” Journal of Change Management, 2017. Web.

      Partridge, Chris. “Evolve your Operating Model- It will drive everything.” CIO, 30 July 2021. Web.

      Pijnacker, Lieke. “HR Analytics: role clarity impacts performance.” Effectory, 25 September 2019. Web.

      Pressgrove, Jed. “Centralized vs. Federated: Breaking down IT Structures.” Government Technology, March 2020. Web.

      Sherman, Fraser. “Differences between Organizational Structure and Design.” Bizfluent, 20 September 2019. Web.

      Skelton, Matthew, and Manual Pais. “Team Cognitive Load.” IT Revolution, 19 January 2021. Web.

      Skelton, Matthew, and Manual Pais. Team Topologies. IT Revolution Press, 19 September 2019. Book

      Spencer, Janet, and Michael Watkins. “Why organizational change fails.” TLNT, 26 November 2019. Web.

      Storbakken, Mandy. “The Cloud Operating Model.” VMware, 27 January 2020. Web.

      "The Qualities of Leadership: Leading Change.” Cornelius & Associates, 2010. Web.

      “Understanding Organizational Structures.” SHRM, 31 August 2021. Web.

      "unfix Pattern: Base.” AgilityScales, n.d. Web.

      Walker, Alex. “Half-Life: Alyx helped change Valve’s Approach to Development.” Kotaku, 10 July 2020. Web.

      "Why Change Management.” Prosci, n.d. Web.

      Wittig, Cynthia. “Employees' Reactions to Organizational Change.” OD Practioner, vol. 44, no. 2, 2012. Web.

      Woods, Dan. “How Platforms are neutralizing Conway’s Law.” Forbes, 15 August 2017. Web.

      Worren, Nicolay, Jeroen van Bree, and William Zybach. “Organization Design Challenges. Results from a practitioner survey.” Journal of Organizational Design, vol. 8, 25 July 2019. Web.

      Appendix

      IT Culture Framework

      This framework leverages McLean & Company’s adaptation of Quinn and Rohrbaugh’s Competing Values Approach.

      The image contains a diagram of the IT Culture Framework. The framework is divided into four sections: Competitive, Innovative, Traditional, and Cooperative, each with their own list of descriptors.

      Lead Strategic Decision Making With Service Portfolio Management

      • Buy Link or Shortcode: {j2store}397|cart{/j2store}
      • member rating overall impact: 9.0/10 Overall Impact
      • member rating average dollars saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
      • member rating average days saved: Read what our members are saying
      • Parent Category Name: Service Management
      • Parent Category Link: /service-management
      • There are no standardized processes for the intake of new ideas and no consistent view of the drivers needed to assess the value of these ideas.
      • IT is spending money on low-value services and doesn’t have the ability to understand and track value in order to prioritize IT investment.
      • CIOs are not trusted to drive innovation.

      Our Advice

      Critical Insight

      • The service portfolio empowers IT to be a catalyst in business strategy, change, and growth.
      • IT must drive value-based investment by understanding value of all services in the portfolio.
      • Organizations must assess the value of their services throughout their lifecycle to optimize business outcomes and IT spend.

      Impact and Result

      • Optimize IT investments by prioritizing services that provide more value to the business, ensuring that you do not waste money on low-value or out-of-date IT services.
      • Ensure that services are directly linked to business objectives, goals, and needs, keeping IT embedded in the strategic vision of the organization.
      • Enable the business to understand the impact of IT capabilities on business strategy.
      • Ensure that IT maintains a strategic and tactical view of the services and their value.
      • Drive agility and innovation by having a streamlined view of your business value context and a consistent intake of ideas.
      • Provide strategic leadership and create new revenue by understanding the relative value of new ideas vs. existing services.

      Lead Strategic Decision Making With Service Portfolio Management Research & Tools

      Start here – read the Executive Brief

      Service portfolio management enables organizations to become strategic value creators by establishing a dynamic view of service value. Understand the driving forces behind the need to manage services through their lifecycles.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish the service portfolio

      Establish and understand the service portfolio process by setting up the Service Portfolio Worksheet.

      • Lead Strategic Decision Making With Service Portfolio Management – Phase 1: Establish the Service Portfolio
      • Service Portfolio Worksheet

      2. Develop a value assessment framework

      Use the value assessment tool to assess services based on the organization’s context of value.

      • Lead Strategic Decision Making With Service Portfolio Management – Phase 2: Develop a Value Assessment Framework
      • Value Assessment Tool
      • Value Assessment Example Tool

      3. Manage intake and assessment of initiatives

      Create a centralized intake process to manage all new service ideas.

      • Lead Strategic Decision Making With Service Portfolio Management – Phase 3: Manage Intake and Assessment of Initiatives
      • Service Intake Form

      4. Assess active services

      Continuously validate the value of the existing service and determine the future of service based on the value and usage of the service.

      • Lead Strategic Decision Making With Service Portfolio Management – Phase 4: Assess Active Services

      5. Manage and communicate the service portfolio

      Communicate and implement the service portfolio within the organization, and create a mechanism to seek out continuous improvement opportunities.

      • Lead Strategic Decision Making With Service Portfolio Management – Phase 5: Manage and Communicate the Service Portfolio
      [infographic]

      Workshop: Lead Strategic Decision Making With Service Portfolio Management

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish the Service Portfolio

      The Purpose

      Establish and understand the service portfolio process by setting up the Service Portfolio Worksheet.

      Understand at a high level the steps involved in managing the service portfolio.

      Key Benefits Achieved

      Adapt the Service Portfolio Worksheet to organizational needs and create a plan to begin documenting services in the worksheet.

      Activities

      1.1 Review the Service Portfolio Worksheet.

      1.2 Adapt the Service Portfolio Worksheet.

      Outputs

      Knowledge about the use of the Service Portfolio Worksheet.

      Adapt the worksheet to reflect organizational needs and structure.

      2 Develop a Value Assessment Framework

      The Purpose

      Understand the need for a value assessment framework.

      Key Benefits Achieved

      Identify the organizational context of value through a holistic look at business objectives.

      Leverage Info-Tech’s Value Assessment Tool to validate and determine service value.

      Activities

      2.1 Understand value from business context.

      2.2 Determine the governing body.

      2.3 Assess culture and organizational structure.

      2.4 Complete the value assessment.

      2.5 Discuss value assessment score.

      Outputs

      Alignment on value context.

      Clear roles and responsibilities established.

      Ensure there is a supportive organizational structure and culture in place.

      Understand how to complete the value assessment and obtain a value score for selected services.

      Understand how to interpret the service value score.

      3 Manage Intake and Assessment of Initiatives

      The Purpose

      Create a centralized intake process to manage all new service ideas.

      Key Benefits Achieved

      Encourage collaboration and innovation through a transparent, formal, and centralized service intake process.

      Activities

      3.1 Review or design the service intake process.

      3.2 Review the Service Intake Form.

      3.3 Design a process to assess and transfer service ideas.

      3.4 Design a process to transfer completed services to the service catalog.

      Outputs

      Create a centralized process for service intake.

      Complete the Service Intake Form for a specific initiative.

      Have a process designed to transfer approved projects to the PMO.

      Have a process designed for transferring of completed services to the service catalog.

      4 Assess Active Services

      The Purpose

      Continuously validate the value of existing services.

      Key Benefits Achieved

      Ensure services are still providing the expected outcome.

      Clear next steps for services based on value.

      Activities

      4.1 Discuss/review management of active services.

      4.2 Complete value assessment for an active service.

      4.3 Determine service value and usage.

      4.4 Determine the next step for the service.

      4.5 Document the decision regarding the service outcome.

      Outputs

      Understand how active services must be assessed throughout their lifecycles.

      Understand how to assess an existing service.

      Place the service on the 2x2 matrix based on value and usage.

      Understand the appropriate next steps for services based on value.

      Formally document the steps for each of the IRMR options.

      5 Manage and Communicate Your Service Portfolio

      The Purpose

      Communicate and implement the service portfolio within the organization.

      Key Benefits Achieved

      Obtain buy-ins for the process.

      Create a mechanism to identify changes within the organization and to seek out continuous improvement opportunities for the service portfolio management process and procedures.

      Activities

      5.1 Create a communication plan for service portfolio and value assessment.

      5.2 Create a communication plan for service intake.

      5.3 Create a procedure to continuously validate the process.

      Outputs

      Document the target audience, the message, and how the message should be communicated.

      Document techniques to encourage participation and promote participation from the organization.

      Document the formal review process, including cycle, roles, and responsibilities.

      Endpoint Management Selection Guide

      • Buy Link or Shortcode: {j2store}65|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: End-User Computing Applications
      • Parent Category Link: /end-user-computing-applications

      Endpoint management solutions are becoming an essential solution: Deploying the right devices and applications to the right user and the need for zero-touch provisioning are indispensable parts of a holistic strategy for improving customer experience. However, selecting the right-sized platform that aligns with your requirements is a big challenge.

      Following improvements in end-user computation strategies, selection of the right endpoint management solution is a crucial next step in delivering a concrete business value.

      Our Advice

      Critical Insight

      Investigate vendors’ roadmaps to figure out which of the candidate platforms can fulfill your long-term requirements, without any unnecessary investment in features that are not currently useful for you. Make sure you don’t purchase capabilities that you will never use.

      Impact and Result

      • Determine what you require from an endpoint management solution.
      • Review the market space and product offerings, and compare capabilities of key players.
      • Create a use case and use top-level requirements to determine use cases and shortlist vendors.
      • Conduct a formal process for interviewing vendors using Info-Tech’s templates to select the best platform for your requirements.

      Endpoint Management Selection Guide Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Endpoint Management Selection Guide Storyboard – A structured guide to walk you through the endpoint management market.

      This storyboard will help you understand endpoint management solution core capabilities and prepare you to select an appropriate tool.

      • Endpoint Management Selection Guide Storyboard

      2. UEM Requirements Workbook – A template to help you build your first draft of requirements for UEM selection.

      Use this spreadsheet to brainstorm use cases and features to satisfy your requirements. This document will be help you score solutions and narrow down the field to a list of candidates who can meet your requirements.

      • UEM Requirements Workbook
      [infographic]

      Further reading

      Endpoint Management Selection Guide

      Streamline your organizational approach to selecting a right-sized endpoint management platform.

      Endpoint Management Selection Guide

      Streamline your organizational approach toward the selection of a right-sized endpoint management platform.

      EXECUTIVE BRIEF

      Analyst Perspective

      Revolutionize your endpoint management with a proper tool selection approach

      The endpoint management market has an ever-expanding and highly competitive landscape. The market has undergone tremendous evolution in past years, from device management to application deployments and security management. The COVID-19 pandemic forced organizations to service employees and end users remotely while making sure corporate data is safe and user satisfaction doesn't get negatively affected. In the meantime, vendors were forced to leverage technology enhancements to satisfy such requirements.

      That being said, endpoint management solutions have become more complex, with many options to manage operating systems and run applications for relevant user groups. With the work-from-anywhere model, customer support is even more important than before, as a remote workforce may face more issues than before, or enterprises may want to ensure more compliance with policies.

      Moreover, the market has become more complex, with lots of added capabilities. Some features may not be beneficial to corporations, and with a poor market validation, businesses may end up paying for some capabilities that are not useful.

      In this blueprint, we help you quickly define your requirements for endpoint management and narrow down a list to find the solutions that fulfill your use cases.

      An image of Mahmoud Ramin, PhD

      Mahmoud Ramin, PhD
      Senior Research Analyst, Infrastructure and Operations
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Endpoint management solutions are becoming increasingly essential – deploying the right devices and applications to the right users and zero-touch provisioning are indispensable parts of a holistic strategy for improving customers' experience. However, selecting the right-sized platform that aligns with your requirements is a big challenge.

      Following improvements in end-user computation strategies, selection of the right endpoint management solution is a crucial next step in delivering concrete business value.

      Common Obstacles

      Despite the importance of selecting the right endpoint management platform, many organizations struggle to define an approach to picking the most appropriate vendor and rolling out the solution in an effective and cost-efficient manner. There are many options available, which can cause business and IT leaders to feel lost.

      The endpoint management market is evolving quickly, making the selection process tedious. On top of that, IT has a hard time defining their needs and aligning solution features with their requirements.

      Info-Tech's Approach

      Determine what you require from an endpoint management solution.

      Review the market space and product offerings, and compare the capabilities of key players.

      Create a use case – use top-level requirements to determine use cases and short-list vendors.

      Conduct a formal process for interviewing vendors, using Info-Tech's templates to select the best platform for your requirements.

      Info-Tech Insight

      Investigate vendors' roadmaps to figure out which of the candidate platforms can fulfill your long-term requirements without any unnecessary investment in features that are not currently useful for you. Make sure you don't purchase capabilities that you will never use.

      What are endpoint management platforms?

      Our definition: Endpoint management solutions are platforms that enable IT with appropriate provisioning, security, monitoring, and updating endpoints to ensure that they are in good health. Typical examples of endpoints are laptops, computers, wearable devices, tablets, smart phones, servers, and the Internet of Things (IoT).

      First, understand differences between mobile management solutions

      • Endpoint management solutions monitor and control the status of endpoints. They help IT manage and control their environment and provide top-notch customer service.
      • These solutions ensure a seamless and efficient problem management, software updates and remediations in a secure environment.
      • Endpoint management solutions have evolved very quickly to satisfy IT and user needs:
      • Mobile Device Management (MDM) helps with controlling features of a device.
      • Enterprise Mobile Management (EMM) controls everything in a device.
      • Unified Endpoint Management (UEM) manages all endpoints.

      Endpoint management includes:

      • Device management
      • Device configuration
      • Device monitoring
      • Device security

      Info-Tech Insight

      As endpoint management encompasses a broad range of solution categories including MDM, EMM, and UEM, look for your real requirements. Don't pay for something that you won't end up using.

      As UEM covers all of MDM and EMM capabilities, we overview market trends of UEM in this blueprint to give you an overall view of market in this space.

      Your challenge: Endpoint management has evolved significantly over the past few years, which makes software selection overwhelming

      An mage showing endpoint management visualzed as positions on an iceberg. at the top is UEM, at the midpoint above the waterline is Enterprise Mobile Management, and below the water is Mobile Device Management.

      Additional challenges occur in securing endpoints

      A rise in the number of attacks on cloud services creates a need to leverage endpoint management solutions

      MarketsandMarkets predicted that global cloud infrastructure services would increase from US$73 billion in 2019 to US$166.6 billion in 2024 (2019).

      A study by the Ponemon Institute showed that 68% of respondents believe that security attacks increased over the past 12 months (2020).

      The study reveals that over half of IT security professionals who participated in the survey believe that organizations are not very efficient in securing their endpoints, mainly because they're not efficient in detecting attacks.

      IT professionals would like to link endpoint management and security platforms to unify visibility and control, to determine potential risks to endpoints, and to manage them in a single solution.

      Businesses will continue to be compromised by the vulnerabilities of cloud services, which pose a challenge to organizations trying to maintain control of their data.

      Trends in endpoint management have been undergoing a tremendous change

      In 2020, about 5.2 million users subscribed to mobile services, and smartphones accounted for 65% of connections. This will increase to 80% by 2025.
      Source: Fortune Business Insights, 2021

      Info-Tech's methodology for selecting a right-sized endpoint management platform

      1. Understand Core Features and Build Your Use Case

      2. Discover the Endpoint Management Market Space and Select the Right Vendor

      Phase Steps

      1. Define endpoint management platforms
      2. Explore endpoint management trends
      3. Classify table stakes & differentiating capabilities
      4. Streamline the requirements elicitation process for a new endpoint management platform
      1. Discover key players across the vendor landscape
      2. Engage the shortlist and select finalists
      3. Prepare for implementation

      Phase Outcomes

      1. Consensus on scope of endpoint management and key endpoint management platform capabilities
      2. Top-level use cases and requirements
      1. Overview of shortlisted vendors
      2. Prioritized list of UEM features

      Guided Implementation

      What does a typical GI on this topic look like?

      Phase 1 Phase 2

      Call #1: Understand what an endpoint management platform is and learn how it evolved. Discuss core capabilities and key trends.
      Call #2: Build a use case and define features to fulfill the use case.

      Call #3: Define your core endpoint management platform requirements.
      Call #4: Evaluate the endpoint management platform vendor landscape and shortlist viable options.
      Review implementation considerations.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      The endpoint management purchase process should be broken into segments:

      1. Endpoint management vendor shortlisting with this buyer's guide
      2. Structured approach to selection
      3. Contract review

      Info-Tech's approach

      The Info-Tech difference:
      Analyze needs

      Evaluate solutions

      Determine where you need to improve the tools and processes used to support the company.

      Determine the best fit for your needs by scoring against features.

      Assess existing solution

      Features

      Determine if your solution can be upgraded or easily updated to meet your needs.

      Determine which features will be key to your success

      Create a business case for change

      Use Cases

      A two-part business case will focus on a need to change and use cases and requirements to bring stakeholders onboard.

      Create use cases to ensure your needs are met as you evaluate features

      Improve existing

      High-Level Requirements

      Work with Info-Tech's analysts to determine next steps to improve your process and make better use of the features you have available.

      Use the high-level requirements to determine use cases and shortlist vendors

      Complementary research:

      Create a quick business case and requirements document to align stakeholders to your vision with Info-Tech's Rapid Application Selection Framework.
      See what your peers are saying about these vendors at SoftwareReviews.com.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Phase 1

      Understand core features and build your business case

      Phase 1

      Phase 2

      Define endpoint management platforms

      Explore endpoint management trends

      Classify table stakes & differentiating capabilities

      Streamline the requirements elicitation process for a new endpoint management platform

      Discover key players across the vendor landscape

      Engage the shortlist and select finalist

      Prepare for implementation

      This phase will walk you through the following activity:

      Define use cases and core features for meeting business and technical goals

      This phase involves the following participants:

      • CIO
      • IT manager
      • Infrastructure & Applications directors
      Mobile Device Management

      Enterprise Mobile Management

      MDM applies security over corporate-owned devices.

      What is MDM and what can you do with it?

      1. MDM helps manage and control corporate owned devices.
      2. You can enforce company policies, track, monitor, and lock device remotely by an MDM.
      3. MDM helps with remote wiping of the device when it is lost or stolen.
      4. You can avoid unsecure Wi-Fi connections via MDM.

      EMM solutions solve the restrictions arose with BYOD (Bring Your Own Device) and COPE (Corporate Owned, Personally Enabled) provisioning models.

      • IT needs to secure corporate-owned data without compromising personal and private data. MDM cannot fulfill this requirement. This led to the development of EMM solutions.
      • EMM tools allow you to manage multiple device platforms through MDM protocols. These tools enforce security settings, allow you to push apps to managed devices, and monitor patch compliance through reporting.

      MDM solutions function at the level of corporate devices. Something else was needed to enable personal device management.

      Major components of EMM solutions

      Mobile Application Management (MAM)

      Allows organizations to control individual applications and their associated data. It restricts malicious apps and enables in-depth application management, configuration, and removal.

      Containerization

      Enables separation of work-related data from private data. It provides encrypted containers on personal devices to separate the data, providing security on personal devices while maintaining users' personal data.

      Mobile Content Management (MCM)

      Helps remote distribution, control, management, and access to corporate data.

      Mobile Security Management (MSM)

      Provides application and data security on devices. It enables application analysis and auditing. IT can use MSM to provide strong passwords to applications, restrict unwanted applications, and protect devices from unsecure websites by blacklisting them.

      Mobile Expense Management (MEM)

      Enables mobile data communication expenses auditing. It can also set data limits and restrict network connections on devices.

      Identity Management

      Sets role-based access to corporate data. It also controls how different roles can use data, improving application and data security. Multifactor authentication can be enforced through the identity management featured of an EMM solution.

      Unified endpoint management: Control all endpoints in a single pane of glass

      IT admins used to provide customer service such as installation, upgrades, patches, and account administration via desktop support. IT support is not on physical assistance over end users' desktops anymore.

      The rise of BYOD enhanced the need to be able to control sensitive data outside corporate network connection on all endpoints, which was beyond the capability of MDM and EMM solutions.

      • It's now almost impossible for IT to be everywhere to support customers.
      • This created a need to conduct tasks simultaneously from one single place.
      • UEM enables IT to run, manage, and control endpoints from one place, while ensuring that device health and security remain uncompromised.
      • UEM combines features of MDM and EMM while extending EMM's capabilities to all endpoints, including computers, laptops, tablets, phones, printers, wearables, and IoT.

      Info-Tech Insight

      Organizations once needed to worry about company connectivity assets such as computers and laptops. To manage them, traditional client management tools like Microsoft Configuration Manager would be enough.

      With the increase in the work-from-anywhere model, it is very hard to control, manage, and monitor devices that are not connected to a VPN. UEM solutions enable IT to tackle this challenge and have full visibility into and management of any device.

      UEM platforms help with saving costs and increasing efficiency

      UEM helps corporates save on their investments as it consolidates use-case management in a single console. Businesses don't need to invest in different device and application management solutions.

      From the employee perspective, UEM enables them to work on their own devices while enforcing security on their personal data.

      • Security and privacy are very important criteria for organizations. With the rapid growth of the work-from-anywhere model, corporate security is a huge concern for companies.
      • Working from home has forced companies to invest a lot in data security, which has led to high UEM demand. UEM solutions streamline security management by consolidating device management in a single platform.
      • With the fourth-generation industrial revolution, we're experiencing a significant rise in the use of IoT devices. UEM solutions are very critical for managing, configuring, and securing these devices.
      • There will be a huge increase in cyber threats due to automation, IoT, and cloud services. The pandemic has sped up the adoption of such services, forcing businesses to rethink their enterprise mobility strategies. They are now more cautious about security risks and remediations. Businesses need UEM to simplify device management on multiple endpoints.
      • With UEM, IT environment management gets more granular, while giving IT better visibility on devices and applications.

      UEM streamlines mundane admin tasks and simplifies user issues.

      Even with a COPE or COBO provisioning model, without any IT intervention, users can decide on when to install relevant updates. It also may lead to shadow IT.

      Endpoint management, and UEM more specifically, enables IT to enforce administration over user devices, whether they are corporate or personally owned. This is enabled without interfering with private/personal data.

      Where it's going: The future state of UEM

      Despite the fast evolution of the UEM market, many organizations do not move as fast as technological capabilities. Although over half of all organizations have at least one UEM solution, they may not have a good strategy or policies to maximize the value of technology (Tech Orchard, 2022). As opposed to such organizations, there are others that use UEM to transform their endpoint management strategy and move service management to the next level. That integration between endpoint management and service management is a developing trend (Ivanti, 2021).

      • SaaS tools like Office 365 are built to be used on multiple devices, including multiple computers. Further, the pandemic saw 47% of organizations significantly increase their use of BYOD (Cybersecurity Insiders, 2021).
      • Over 2022, 78% of people worked remotely for at least some amount of time during the week (Tech Orchard, 2022).
      • 84% of organizations believe that cybersecurity threat alarms are becoming very overwhelming, and almost half of companies believe that the best way to tackle this is through consolidating platforms so that everything will be visible and manageable through a single pane of glass (Cybersecurity Insiders, 2022).
      • The UEM market was worth $3.39 billion in 2020. It is expected to reach $53.65 billion by 2030, with an annual growth rate of 31.7% (Datamation, 2022). This demonstrates how dependent IT is becoming on endpoint management solutions.

      An image of a donut chart showing the current state of UEM Strategy.

      Only 27% of organizations have "fully deployed" UEM "with easy management across all endpoints"
      Source: IT Pro Today, 2018.

      Endpoint Management Key Trends

      • Commoditization of endpoint management features. Although their focus is the same, some UEM solutions have unique features.
      • New endpoint management paradigms have emerged. Endpoint management has evolved from client management tools (CMT) and MDM into UEM, also known as "modern management" (Ivanti, 2022).
      • One pane of glass for the entire end-user experience. Endpoint management vendors are integrating their solution into their ITSM, ITOM, digital workspace, and security products.
      • AI-powered insights. UEM tools collect data on endpoints and user behavior. Vendors are using their data to differentiate themselves: Products offer threat reports, automated compliance workflows, and user experience insights. The UEM market is ultimately working toward autonomous endpoint management (Microsoft, 2022).
      • Web apps and cloud storage are the new normal. Less data is stored locally. Fewer apps need to be patched on the device. Apps can be accessed on different devices more easily. However, data can more easily be accessed on BYOD and on new operating systems like Chrome OS.
      • Lighter device provisioning tools. Instead of managing thick images, UEM tools use lighter provisioning packages. Once set up, Autopilot and UEM device enrollment should take less time to manage than thick images.
      • UEM controls built around SaaS. Web apps and the cloud allow access from any device, even unmanaged BYOD. UEM tools allow IT to apply the right level of control for the situation – mobile application management, mobile content management, or mobile device management.
      • Work-from-anywhere and 5G result in more devices outside of your firewalls. Cloud-based management tools are not limited by your VPN connection and can scale up more easily than traditional, on-prem tools.

      Understand endpoint management table stakes features

      Determine high-level use cases to help you narrow down to specific features

      Support the organization's operating systems:
      Many UEM vendors support the most dominant operating systems, Windows and Mac; however, they are usually stronger in one particular OS than the other. For instance, Intune supports both Windows and Mac, although there are some drawbacks with MacOS management by Intune. Conversely, Jamf is mainly for MacOS and iOS management. Enterprises look to satisfy their end users' needs. The more UEM vendors support different systems, the more likely enterprises will pick them. Although, as mentioned, in some instances, enterprises may need to select more than one option, depending on their requirements.

      Support BYOD and remote environments:
      With the impact of the pandemic on work model, 60-70% of workforce would like to have more flexibility for working remotely (Ivanti, 2022). BYOD is becoming the default, and SaaS tools like Office 365 are built to be used on multiple devices, including multiple computers. As BYOD can boost productivity (Samsung Insights, 2016), you may be interested in how your prospective UEM solution will enable this capability with remote wipe (corporate wipe capability vs. wiping the whole device), data and device tracking, and user activity auditing.

      Understand endpoint management table stakes features

      Determine high-level use cases to help you narrow down to specific features

      Integration with the enterprise's IT products:
      To get everything in a single platform and to generate better metrics and dashboards, vendors provide integrations with ticketing and monitoring solutions. Many large vendors have strong integrations with multiple ITSM and ITAM platforms to streamline incident management, request management, asset management, and patch management.

      Support security and compliance policies:
      With the significant boost in work-from-anywhere, companies would like to enable endpoint security more than ever. This includes device threat detection, malware detection, anti-phishing, and more. All UEMs provide these, although the big difference between them is how well they enable security and compliance, and how flexible they are when it comes to giving conditional access to certain data.

      Provide a fully automated vs manual deployment:
      Employees want to get their devices faster, IT wants to deploy devices faster, and businesses want to enable employees faster to get them onboard sooner. UEMs have the capability to provide automated and manual deployment. However, the choice of solution depends on enterprise's infrastructure and policies. Full automation of deployment is very applicable for corporate devices, while it may not be a good option for personally owned devices. Define your user groups and provisioning models, and make sure your candidate vendors satisfy requirements.

      Plan a proper UEM selection according to your requirements

      1. Identify IT governance, policy, and process maturity
        Tools cannot compensate for your bad processes. You should improve deploying and provisioning processes before rolling out a UEM. Automation of a bad process only wraps the process in a nicer package – it does not fix the problem.
        Refer to InfoTech's Modernize and Transform Your End-User Computing Strategy for more information on improving endpoint management procedures.
      2. Consider supported operating systems, cloud services, and network infrastructure in your organization
        Most UEMs support all dominant operating systems, but some solutions have stronger capability for managing a certain OS over the other.
      3. Define enterprise security requirements
        Investigate security levels, policies, and requirements to align with the security features you're expecting in a UEM.
      4. Selection and implementation of a UEM depends on use case. Select a vendor that supports your use cases
        Identify use cases specific to your industry.
        For example, UEM use cases in Healthcare:
        • Secure EMR
        • Enforce HIPAA compliance
        • Secure communications
        • Enable shared device deployment

      Activity: Define use cases and core features for meeting business and technical goals

      1-2 hours

      1. Brainstorm with your colleagues to discuss your challenges with endpoint management.
      2. Identify how these challenges are impacting your ability to meet your goals for managing and controlling endpoints.
      3. Define high-level goals you wish to achieve in the first year and in the longer term.
      4. Identify the use cases that will support your overall goals.
      5. Document use cases in the UEM Requirements Workbook.

      Input

      • List of challenges and goals

      Output

      • Use cases to be used for determining requirements

      Materials

      • Whiteboard/flip charts
      • Laptop to record output

      Participants

      • CIO
      • IT manager
      • Infrastructure & Applications directors

      Download the UEM Requirements Workbook

      Phase 2

      Discover the endpoint management market space and select the right vendor

      Phase 1

      Phase 2

      Define endpoint management platforms

      Explore endpoint management trends

      Classify table stakes & differentiating capabilities

      Streamline the requirements elicitation process for a new endpoint management platform

      Discover key players across the vendor landscape

      Engage the shortlist and select finalist

      Prepare for implementation

      This phase will walk you through the following activity:
      Define top-level features for meeting business and technical goals
      This phase involves the following participants:

      • CIO
      • IT manager
      • Infrastructure & Applications directors
      • Project managers

      Elicit and prioritize granular requirements for your endpoint management platform

      Understanding business needs through requirements gathering is the key to defining everything about what is
      being purchased. However, it is an area where people often make critical mistakes.

      Risks of poorly scoped requirements

      • Fail to be comprehensive and miss certain areas of scope.
      • Focus on how the solution should work instead of what it must accomplish.
      • Have multiple levels of confusing and inconsistent detail in the requirements.
      • Drill down all the way to system-level detail.
      • Add unnecessary constraints based on what is done today rather than focusing on what is needed for tomorrow.
      • Omit constraints or preferences that buyers think are "obvious."

      Best practices

      • Get a clear understanding of what the system needs to do and what it is expected to produce.
      • Test against the principle of MECE – requirements should be "mutually exclusive and collectively exhaustive."
      • Explicitly state the obvious and assume nothing.
      • Investigate what is sold on the market and how it is sold. Use language that is consistent with that of the market and focus on key differentiators – not table stakes.
      • Contain the appropriate level of detail – the level should be suitable for procurement and sufficient for differentiating vendors.

      Review Info-Tech's blueprint Improve Requirements Gathering to improve your requirements gathering process.

      Consider the perspective of each stakeholder to ensure functionality needs are met

      Best of breed vs. "good enough" is an important discussion and will feed your success

      Costs can be high when customizing an ill-fitting module or creating workarounds to solve business problems, including loss of functionality, productivity, and credibility.

      • Start with use cases to drive the initial discussion, then determine which features are mandatory and which are nice-to-haves. Mandatory features will help determine high success for critical functionality and identify where "good enough" is an acceptable state.
      • Consider the implications of implementation and all use cases of:
        • Buying an all-in-one solution.
        • Integration of multiple best-of-breed solutions.
        • Customizing features that were not built into a solution.
      • Be prepared to shelve a use case for this solution and look to alternatives for integration where mandatory features cannot meet highly specialized needs that are outside of traditional endpoint management solutions.

      Pros and Cons

      An image showing the pros and cons of building vs buying

      Evaluate software category leaders through vendor rankings and awards

      SoftwareReviews
      A screenshot of softwareReviews Data Quadrant analyis.. A screenshot of softwareReviews Emotonal Fotprint analyis
      • evaluation and ranking of all software in an individual category to compare platforms across multiple dimensions.
      • Vendors are ranked by their Composite Score, based on individual feature evaluations, user satisfaction rankings, vendor capability comparisons, and likeliness to recommend the platform.
      • The Emotional Footprint is a powerful indicator of overall user sentiment toward the relationship with the vendor, capturing data across five dimensions.
      • Vendors are ranked by their Customer Experience (CX) Score, which combines the overall Emotional Footprint rating with a measure of the value delivered by the solution.

      Speak with category experts to dive deeper into the vendor landscape

      SoftwareReviews

      • Fact-based reviews of business software from IT professionals.
      • Product and category reports with state-of-the-art data visualization.
      • Top-tier data quality backed by a rigorous quality assurance process.
      • User-experience insight that reveals the intangibles of working with a vendor.

      CLICK HERE to ACCESS

      Comprehensive software reviews
      to make better IT decisions

      We collect and analyze the most detailed reviews on enterprise software from real users to give you an unprecedented view into the product and vendor before you buy.

      SoftwareReviews is powered by Info-Tech

      Technology coverage is a priority for Info-Tech, and SoftwareReviews provides the most comprehensive unbiased data on today's technology.
      With the insight of our expert analysts, our members receive unparalleled support in their buying journey.

      Get to Know the Key Players in the Endpoint Management Landscape

      The following slides provide a top-level overview of the popular players you will encounter in the endpoint management shortlisting process in alphabetical order.

      A screenshot showing a series of logos for the companies addressed later in this blueprint. It includes: Ciso; Meraki; Citrix; IBM MaaS360; Ivanti; Jamf|Pro; ManageEngine Endpoint Central; Microsoft Endpoint Manager, and VMWARE.

      Vendor scores are driven by real-world practitioner reviews via SoftwareReviews. Composite, CX, EF, and NPS scores are pulled from live data as of January 2023.

      Secure business units and enhance connection by simplifying the digital workplace

      A good option for enterprises that want a single-pane-of-glass UEM that is easy to use, with a modern-looking dashboard, high threat-management capability, and high-quality customer support.

      CISCO Meraki

      Est. 1984 | CA, USA | NASDAQ: CSCO

      8.8

      9.1

      +92

      91%

      COMPOSITE SCORE

      CX SCORE

      EMOTIONAL FOOTPRINT

      LIKELINESS TO RECOMMEND

      DOWNLOAD REPORT

      This is a Screenshot of CISCO Meraki's dashboard.

      Screenshot of CISCO Meraki's dashboard. Source: Cisco

      Strengths:

      Areas to improve:

      • Cisco Meraki offers granular control over what users can and cannot use.
      • The system is user friendly and intuitive, with a variety of features.
      • The anti-malware capability enhances security.
      • Users are very satisfied with being able to control everything in a single platform.
      • System configuration is easy.
      • Vendor relationship is very high with a rate of 96%.
      • System setup is easy, and users don't need much experience for initial configuration of devices.
      • Users are also mostly satisfied with the platform design.
      • Monitoring within the tool is easy.
      • According to SoftwareReviews' survey report, the primary reason for leaving Cisco Meraki and switching over to another vendor is functionality.
      • Regardless of the top-notch offerings and high-quality features, the product is relatively expensive. The quality and price factors make the solution a better fit for large enterprises. However, SoftwareReviews' scorecard for Cisco Meraki shows that small organizations are the most satisfied compared to the medium and large enterprises, with a net promoter score of 81%.

      Transform work experience and support every endpoint with a unified view to ensure users are productive

      A tool that enables you to access corporate resources on personal devices. It is adaptable to your budget. SoftwareReviews reports that 75% of organizations have received a discount at initial purchase or renewal, which makes it a good candidate if looking for a negotiable option.

      Citrix Endpoint Management

      Est. 1989 | TX, USA | Private

      7.9

      8.0

      8.0

      83%

      COMPOSITE SCORE

      CX SCORE

      EMOTIONAL FOOTPRINT

      LIKELINESS TO RECOMMEND

      DOWNLOAD REPORT

      Screenshot of Citrix Endpoint Management's dashboard.

      Screenshot of Citrix Endpoint Management's dashboard. Source: Citrix

      Strengths:

      Areas to improve:

      • Citrix Endpoint Management is a cloud-centric, easy-to-use UEM with an upgradable interface.
      • The solution simplifies endpoint management and provides real-time visibility and notifications.
      • Citrix allows deployments on different operating systems to meet organizations' infrastructure requirements.
      • The vendor offers different licenses and pricing models, allowing businesses of different sizes to use the tool based on their budgets and requirements.
      • Some users believe that integration with external applications should be improved.
      • Deployment is not very intuitive, making implementation process challenging.
      • User may experience some lagging while opening applications on Citrix. Application is even a bit slower when using a mobile device.

      Scale remote users, enable BYOD, and drive a zero-trust strategy with IBM's modern UEM solution

      A perfect option to boost cybersecurity. Remote administration and installation are made very easy and intuitive on the platform. It is very user friendly, making implementation straightforward. It comes with four licensing options: Essential, Deluxe, Premier, and Enterprise. Check IBM's website for information on pricing and offerings.

      IBM MaaS360

      Est. 1911 | NY, USA | NYSE: IBM

      7.7

      8.4

      +86

      76%

      COMPOSITE SCORE

      CX SCORE

      EMOTIONAL FOOTPRINT

      LIKELINESS TO RECOMMEND

      DOWNLOAD REPORT

      Screenshot of IBM MaaS360's dashboard.

      Screenshot of IBM MaaS360's dashboard. Source: IBM

      Strengths:

      Areas to improve:

      • IBM MaaS360 is easy to install and implement.
      • It has different pricing models to fit enterprises' needs.
      • MaaS360 is compatible with different operating systems.
      • Security management is one of the strongest features, making the tool perfect for organizations that want to improve cybersecurity.
      • Vendor support is very effective, and users find knowledge articles very helpful.
      • It has a very intuitive dashboard.
      • The tool can control organizational data, allowing you to apply BYOD policy.
      • AI Advisor with Watson provides AI-driven reporting and insights.
      • Working with iOS may not be as intuitive as other operating systems.
      • Adding or removing users in a user group is not very straightforward.
      • Some capabilities are limited to particular Android or iOS devices.
      • Deploying application packages may be a bit difficult.
      • Hardware deployment may need some manual work and is not fully automated.

      Get complete device visibility from asset discovery to lifecycle management and remediation

      A powerful tool for patch management with a great user interface. You can automate patching and improve cybersecurity, while having complete visibility into devices. According to SoftwareReviews, 100% of survey participants plan to renew their contract with Ivanti.

      Ivanti Neurons

      Est. 1985 | CA, USA | Private

      8.0

      8.0

      +81

      83%

      COMPOSITE SCORE

      CX SCORE

      EMOTIONAL FOOTPRINT

      LIKELINESS TO RECOMMEND

      DOWNLOAD REPORT

      Screenshot of Ivanti Neurons UEM's dashboard.

      Screenshot of Ivanti Neurons UEM's dashboard. Source: Ivanti

      Strengths:

      Areas to improve:

      • The tool is intuitive and user friendly.
      • It's a powerful security management platform, supporting multiple operating systems.
      • Ivanti Neurons is very strong in patch management and inventory management. It helps a seamless application deployment.
      • Users can install their applications via Ivanti's portal.
      • The user interface is very powerful and easy to use.
      • AI-augmented process management automates protocols, streamlining device management and application updates.
      • Vendor is very efficient in training and provides free webinars.
      • Data integration is very easy. According to SoftwareReviews, it had a satisfaction score for ease of data integration of 86%, which makes Ivanti the top solution for this capability.
      • Data analytics is powerful but complicated.
      • Setup is easy for some teams but not as easy for others, which may cause delays for implementation.
      • Software monitoring is not as good as other competitors.

      Improve your end-user productivity and transform enterprise Apple devices

      An Apple-focused UEM with a great interface. Jamf can manage and control macOS and iOS, and it is one of the best options for Apple products, according to users' sentiments. However, it may not be a one-stop solution if you want to manage non-Apple products as well. In this case, you can use Jamf in addition to another UEM. Jamf has some integrations with Microsoft, but it may not be sufficient if you want to fully manage Windows endpoints.

      Jamf PRO

      Est. 2002 | MN, USA | NASDAQ: JAMF

      8.8

      8.7

      +87

      95%

      COMPOSITE SCORE

      CX SCORE

      EMOTIONAL FOOTPRINT

      LIKELINESS TO RECOMMEND

      DOWNLOAD REPORT

      Screenshot of Jamf PRO's dashboard.

      Screenshot of Jamf PRO's dashboard. Source: Jamf

      Strengths:

      Areas to improve:

      • Jamf Pro is a unique product with an easy implementation that enables IT with minimum admin intervention.
      • It can create smart groups (based on MDM profile and user group) to automatically assign users to their pertinent apps and updates.
      • It's a very user-friendly tool, conducting device management in fewer steps than other competitors.
      • Reports are totally customizable and dynamic.
      • Notifications are easy to navigate and monitor.
      • Self-service feature enables end users to download their predefined categories of applications in the App Store.
      • It can apply single sign-on integrations to streamline user access to applications.
      • Businesses can personalize the tool with corporate logos.
      • Vendor does great for customer service when problems arise.
      • It is a costly tool relative to other competitors, pushing prospects to consider other products.
      • The learning process may be long and not easy, especially if admins do not script, or it's their first time using a UEM.

      Apply automation of traditional desktop management, software deployment, endpoint security, and patch management

      A strong choice for patch management, software deployment, asset management, and security management. There is a free version of the tool available to try get an understanding of the platform before purchasing a higher tier of the product.

      ManageEngine Endpoint Central

      Est. 1996 | India | Private

      8.3

      8.3

      +81

      88%

      COMPOSITE SCORE

      CX SCORE

      EMOTIONAL FOOTPRINT

      LIKELINESS TO RECOMMEND

      DOWNLOAD REPORT

      Screenshot of ME Endpoint Central's dashboard.

      Screenshot of ME Endpoint Central's dashboard. Source: ManageEngine

      Strengths:

      Areas to improve:

      • It supports several operating systems including Windows, Mac, Linux, Android, and iOS.
      • Endpoint Central provides end-to-end monitoring, asset management, and security in a single platform.
      • Setup is simple and intuitive, and it's easy to learn and configure.
      • The reporting feature is very useful and gives you clear visibility into dashboard.
      • Combined with ME Service Desk Plus, we can call Endpoint Central an all-in-one solution.
      • The tool provides a real-time report on devices and tracks their health status.
      • It has multiple integrations with third-party solutions.
      • Tool does not automate updates, making application updates time-consuming.
      • Sometimes, patches and software deployments fail, and the tool doesn't provide any information on the reason for the failure.
      • There is no single point of contact/account manager for the clients when they have trouble with the tool.
      • Remote connection to Android devices can sometimes get a little tedious.

      Get device management and security in a single platform with a combination of Microsoft Intune and Configuration Manager

      A solution that combines Intune and ConfigMgr's capabilities into a single endpoint management suite for enrolling, managing, monitoring, and securing endpoints. It's a very cost-effective solution for enterprises in the Microsoft ecosystem, but it also supports other operating systems.

      Microsoft Endpoint Manager

      Est. 1975 | NM, USA | NASDAQ: MSFT

      8.0

      8.5

      +83

      85%

      COMPOSITE SCORE

      CX SCORE

      EMOTIONAL FOOTPRINT

      LIKELINESS TO RECOMMEND

      DOWNLOAD REPORT

      Screenshot of MS Endpoint Manager's dashboard.

      Screenshot of MS Endpoint Manager's dashboard. Source: Microsoft

      Strengths:

      Areas to improve:

      • Licensing for the enterprises that use Windows as their primary operating system is more efficient and cost effective.
      • Endpoint Manager is very customizable, with the ability to assign personas to device groups.
      • Besides Windows, it manages other operating systems, such as Linux, Android, and iOS.
      • It creates endpoint security and compliance policies for BitLocker that streamlines data protection and security. It also provides SSO.
      • It provides very strong documentation and knowledgebase.
      • User interface is not as good as competitors. It's a bit clunky and complex to use.
      • The process of changing configurations on devices can be time consuming.
      • Sometimes there are service outages such as Autopilot failure, which push IT to deploy manually.
      • Location tracking is not very accurate.

      Simplify and consolidate endpoint management into a single solution and secure all devices with real-time, "over-the-air" modern management across all use cases

      A strong tool for managing and controlling mobile devices. It can access all profiles through Google and Apple, and it integrates with various IT management solutions.

      VMware Workspace ONE

      Est. 1998 | CA, USA | NYSE: VMW

      7.5

      7.4

      +71

      75%

      COMPOSITE SCORE

      CX SCORE

      EMOTIONAL FOOTPRINT

      LIKELINESS TO RECOMMEND

      DOWNLOAD REPORT

      Screenshot of Workspace ONE's dashboard.

      Screenshot of Workspace ONE's dashboard. Source: VMware

      Strengths:

      Areas to improve:

      • Workspace ONE provides lots of information about devices.
      • It provides a large list of integrations.
      • The solution supports various operating systems.
      • The platform has many out-of-the-box features and helps with security management, asset management, and application management.
      • The vendor has a community forum which users find helpful for resolving issues or asking questions about the solution.
      • It is very simple to use and provides SSO capability.
      • Implementation is relatively easy and straightforward.
      • Customization may be tricky and require expertise.
      • The solution can be more user friendly with a better UI.
      • Because of intensive processing, updates to applications take a long time.
      • The tool may sometimes be very sensitive and lock devices.
      • Analytics and reporting may need improvement.

      Review your use cases to start your shortlist

      Your Info-Tech analysts can help you narrow down the list of vendors that will meet your requirements.

      Next steps will include:

      1. Reviewing your requirements
      2. Checking out SoftwareReviews
      3. Shortlisting your vendors
      4. Conducting demos and detailed proposal reviews
      5. Selecting and contracting with a finalist!

      Activity: Define high-level features for meeting business and technical goals

      Input

      • List of endpoint management use cases
      • List of prioritized features

      Output

      • Vendor evaluation
      • Final list of candidate vendors

      Materials

      • Whiteboard/flip charts
      • Laptop
      • UEM Requirements Workbook

      Participants

      • CIO
      • IT manager
      • Infrastructure & Applications directors
      • Project managers

      Activity: Define top-level features for meeting business and technical goals

      As there are many solutions in the market that share capabilities, it is imperative to closely evaluate how well they fulfill your endpoint management requirements.
      Use the UEM Requirements Workbook to identify your desired endpoint solution features and compare vendor solution functionality based on your desired features.

      1. Refer to the output of the previous activity, the identified use cases in the spreadsheet.
      2. List the features you want in an endpoint solution for your devices that will fulfill these use cases. Record those features in the second column ("Detailed Feature").
      3. Prioritize each feature (must have, should have, nice to have, not required).
      4. Send this list to candidate vendors.
      5. When you finish your investigation, review the spreadsheet to compare the various offerings and pros and cons of each solution.

      Info-Tech Insight

      The output of this activity can be used for a detailed evaluation of UEM vendors. The next steps will be vendor briefing and having further discussion on technical capabilities and conducting demos of solutions. Info-Tech's blueprint, The Rapid Application Selection Framework, takes you to these next steps.

      This is a screenshot showing the high value use cases table from The Rapid Application Selection Framework.

      Download the UEM Requirements Workbook

      Leverage Info-Tech's research to plan and execute your endpoint management selection and implementation

      Use Info-Tech Research Group's blueprints for selection and implementation processes to guide your own planning.

      • Assess
      • Prepare
      • Govern & Course Correct

      This is a screenshot of the title pages from INfo-tech's Governance and management of enterprise Software Implementaton; and The Rapid Applicaton Selection Framework.

      Ensure your implementation team has a high degree of trust and communication

      If external partners are needed, dedicate an internal resource to managing the vendor and partner relationships.

      Communication

      Teams must have some type of communication strategy. This can be broken into:

      • Regularity: Having a set time each day to communicate progress and a set day to conduct retrospectives.
      • Ceremonies: Injecting awards and continually emphasizing delivery of value can encourage relationship building and constructive motivation.
      • Escalation: Voicing any concerns and having someone responsible for addressing those concerns.

      Proximity

      Distributed teams create complexity because communication can break down more easily. This can be mitigated by:

      • Location: Placing teams in proximity can close the barrier of geographical distance and time zone differences.
      • Inclusion: Making a deliberate attempt to pull remote team members into discussions and ceremonies.
      • Communication Tools: Having the right technology (e.g. video conference) can help bring teams closer together virtually.

      Trust

      Members should trust other members are contributing to the project and completing their required tasks on time. Trust can be developed and maintained by:

      Accountability: Having frequent quality reviews and feedback sessions. As work becomes more transparent, people become more accountable.

      • Role Clarity: Having a clear definition of what everyone's role is.

      Implementation with a partner typically results in higher satisfaction

      Align your implementation plans with both the complexity of the solution and internal skill levels

      Be clear and realistic in your requirements to the vendor about the level of involvement you need to be successful.

      Primary reasons to use a vendor:

      • Lack of skilled resources: For solutions with little configuration change happening after the initial installation, the ramp-up time for an individual to build skills for a single event is not practical.
      • Complexity of solution: Multiple integrations, configurations, modules, and even acquisitions that haven't been fully integrated in the solution you choose can make it difficult to complete the installation and rollout on time and on budget. Troubleshooting becomes even more complex if multiple vendors are involved.
      • Data migration: Decide what information will be valuable to transfer to the new solution and which will not benefit your organization. Data structure and residency can both be factors in the complexity of this exercise.

      This is an image of a bar graph showing the Satisfaction Net Promotor Score by Implementation type and Organization Size.

      Source: SoftwareReviews, January 2020 to January 2023, N= 20,024 unique reviews

      To ensure your SOW is mutually beneficial, download the blueprint Improve Your Statements of Work to Hold Your Vendors Accountable.

      Consider running a proof of concept if concerns are expressed about the feasibility of the chosen solution

      Proofs of concept (PoCs) can be time consuming, so make good choices on where to spend the effort

      Create a PoC charter that will enable a quick evaluation of the defined use cases and functions. These key dimensions should form the PoC.

      1. Objective – Giving an overview of the planned PoC will help to focus and clarify the rest of this section. What must the PoC achieve? Objectives should be specific, measurable, attainable, relevant, and time bound. Outline and track key performance indicators.
      2. Key Success Factors – These are conditions that will positively impact the PoC's success.
      3. Scope – High-level statement of scope. More specifically, state what is in scope and what is out of scope.
      4. Project Team – Identify the team's structure, e.g. sponsors, subject matter experts.
      5. Resource Estimation – Identify what resources (time, materials, space, tools, expertise, etc.) will be needed to build and socialize your prototype. How will they be secured?

      An image of two screenshots from Info-Tech Research Group showing documentaton used to generate effective proof of concepts.

      To create a full proof of concept plan, download the Proof of Concept Template and see the instructions in Phase 3 of the blueprint Exploit Disruptive Infrastructure Technology.

      Selecting a right-sized endpoint management platform

      This selection guide allows organizations to execute a structured methodology for picking a UEM platform that aligns with their needs. This includes:

      • Identifying and prioritizing key business and technology drivers for an endpoint management selection business case.
      • Defining key use cases and requirements for a right-sized UEM platform.
      • Reviewing a comprehensive market scan of key players in the UEM marketspace.

      This formal UEM selection initiative will map out requirements and identify technology capabilities to fill the gap for better endpoint management. It also allows a formal roll-out of a UEM platform that is highly likely to satisfy all stakeholder needs.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

      Contact your account representative for more information

      workshops@infotech.com
      1-888-670-8889

      Summary of Accomplishment

      Knowledge Gained

      • What endpoint management is
      • Historical origins and evolution of endpoint management platforms
      • Current trends and future state of endpoint management platforms

      Processes Optimized

      • Identifying use cases
      • Gathering requirements
      • Reviewing market key players and their capabilities
      • Selecting a UEM tool that fulfills your requirements

      UEM Solutions Analyzed

      • CISCO Meraki
      • Citrix Endpoint Management
      • IBM MaaS360
      • Ivanti Neurons UEM
      • Jamf Pro
      • ManageEngine Endpoint Central
      • Microsoft Endpoint Manager
      • VMware Workspace ONE

      Related Info-Tech Research

      Modernize and Transform Your End-User Computing Strategy

      This project helps support the workforce of the future by answering the following questions: What types of computing devices, provisioning models, and operating systems should be offered to end users? How will IT support devices? What are the policies and governance surrounding how devices are used? What actions are we taking and when? How do end-user devices support larger corporate priorities and strategies?

      Best Unified Endpoint Management (UEM) Software | SoftwareReviews

      Compare and evaluate Unified Endpoint Management vendors using the most in-depth and unbiased buyer reports available. Download free comprehensive 40+ page reports to select the best Unified Endpoint Management software for your organization.

      The Rapid Application Selection Framework

      This blueprint walks you through a process for a fast and efficient selection of your prospective application. You will be enabled to use a data-driven approach to select the right application vendor for your needs, shatter stakeholder expectations with truly rapid application selections, boost collaboration and crush the broken telephone with concise and effective stakeholder meetings, and lock in hard savings.

      Bibliography

      "BYOD Security Report." Cybersecurity Insiders, 2021. Accessed January 2023.
      "Cloud Infrastructure Services Market." MarketsAnd Markets, 2019. Accessed December 2022.
      Evans, Alma. "Mastering Mobility Management: MDM Vs. EMM Vs. UEM." Hexnode, 2019. Accessed November 2022.
      "Evercore-ISI Quarterly Enterprise Technology Spending Survey." Evercore-ISI, 2022. Accessed January 2023.
      "5G Service Revenue to Reach $315 Billion Globally in 2023." Jupiter Research, 2022. Accessed January 2023.
      Hein, Daniel. "5 Common Unified Endpoint Management Use Cases You Need to Know." Solutions Review, 2020. Accessed January 2023.
      "Mobile Device Management Market Size, Share & COVID-19 Impact Analysis." Fortune Business Insights, 2021. Accessed December 2022.
      Ot, Anina. "The Unified Endpoint Management (UEM) Market." Datamation, 14 Apr. 2022. Accessed Jan. 2023.
      Poje, Phil. "CEO Corner: 4 Trends in Unified Endpoint Management for 2023." Tech Orchard, 2022. Accessed January 2023.
      "The Future of UEM November 2021 Webinar." Ivanti, 2021. Accessed January 2023.
      "The Third Annual Study on the State of Endpoint Security Risk." Ponemon Institute, 2020. Accessed December 2022.
      "The Ultimate Guide to Unified Endpoint Management (UEM)." MobileIron. Accessed January 2023.
      "Trends in Unified Endpoint Management." It Pro Today, 2018. Accessed January 2023.
      Turek, Melanie. "Employees Say Smartphones Boost Productivity by 34 Percent: Frost & Sullivan Research." Samsung Insights, 3 Aug. 2016.
      "2023 State of Security Report." Cybersecurity Insiders, 2022. Accessed January 2023.
      Violino, Bob. "Enterprise Mobility 2022: UEM Adds User Experience, AI, Automation." Computerworld, 2022. Accessed January 2023.
      Violino, Bob. "How to Choose the Right UEM Platform." Computerworld, 2021. Accessed January 2023.
      Violino, Bob. "UEM Vendor Comparison Chart 2022." Computerworld, 2022. Accessed January 2023.
      Wallent, Michael. "5 Endpoint Management Predictions for 2023." Microsoft, 2022. Accessed January 2023.
      "What Is the Difference Between MDM, EMM, and UEM?" 42Gears, 2017. Accessed November 2022.

      Develop a Business Continuity Plan

      • Buy Link or Shortcode: {j2store}411|cart{/j2store}
      • member rating overall impact: 9.1/10 Overall Impact
      • member rating average dollars saved: $37,093 Average $ Saved
      • member rating average days saved: 30 Average Days Saved
      • Parent Category Name: DR and Business Continuity
      • Parent Category Link: /business-continuity
      • Recent crises have increased executive awareness and internal pressure to create a business continuity plan (BCP).
      • Industry and government-driven regulations require evidence of sound business continuity practices.
      • Customers demand their vendors provide evidence of a workable BCP prior to signing a contract.
      • IT leaders, because of their cross-functional view and experience with incident management and DR, are often asked to lead BCP efforts.

      Our Advice

      Critical Insight

      • BCP requires input from multiple departments with different and sometimes conflicting objectives. There are typically few, if any, dedicated resources for BCP, so it can't be a full-time, resource-intensive project.
      • As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but ultimately business leaders need to own the BCP – they know their processes, and therefore, their requirements to resume business operations better than anyone else.
      • The traditional approach to BCP is a massive project that most organizations can’t execute without hiring a consultant. To execute BCP in-house, carve up the task into manageable pieces as outlined in this blueprint.

      Impact and Result

      • Implement a structured and repeatable process that you apply to one business unit at a time to keep BCP planning efforts manageable.
      • Use the results of the pilot to identify gaps in your recovery plans and reduce overall continuity risk while continuing to assess specific risks as you repeat the process with additional business units.
      • Enable business leaders to own the BCP going forward. Develop a template that the rest of the organization can use.
      • Leverage BCP outcomes to refine IT DRP recovery objectives and achieve DRP-BCP alignment.

      Develop a Business Continuity Plan Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should develop a business continuity plan, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Identify BCP maturity and document process dependencies

      Assess current maturity, establish a team, and choose a pilot business unit. Identify business processes, dependencies, and alternatives.

      • BCP Maturity Scorecard
      • BCP Pilot Project Charter Template
      • BCP Business Process Workflows Example (Visio)
      • BCP Business Process Workflows Example (PDF)

      2. Conduct a BIA to determine acceptable RTOs and RPOs

      Define an objective impact scoring scale, estimate the impact of downtime, and set recovery targets.

      • BCP Business Impact Analysis Tool

      3. Document the recovery workflow and projects to close gaps

      Build a workflow of the current steps for business recovery. Identify gaps and risks to recovery. Brainstorm and prioritize solutions to address gaps and mitigate risks.

      • BCP Tabletop Planning Template (Visio)
      • BCP Tabletop Planning Template (PDF)
      • BCP Project Roadmap Tool
      • BCP Relocation Checklists

      4. Extend the results of the pilot BCP and implement governance

      Present pilot project results and next steps. Create BCMS teams. Update and maintain BCMS documentation.

      • BCP Pilot Results Presentation
      • BCP Summary
      • Business Continuity Teams and Roles Tool

      5. Appendix: Additional BCP tools and templates

      Use these tools and templates to assist in the creation of your BCP.

      • BCP Recovery Workflow Example (Visio)
      • BCP Recovery Workflow Example (PDF)
      • BCP Notification, Assessment, and Disaster Declaration Plan
      • BCP Business Process Workarounds and Recovery Checklists
      • Business Continuity Management Policy
      • Business Unit BCP Prioritization Tool
      • Industry-Specific BIA Guidelines
      • BCP-DRP Maintenance Checklist
      • Develop a COVID-19 Pandemic Response Plan Storyboard
      [infographic]

      Workshop: Develop a Business Continuity Plan

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Define BCP Scope, Objectives, and Stakeholders

      The Purpose

      Define BCP scope, objectives, and stakeholders.

      Key Benefits Achieved

      Prioritize BCP efforts and level-set scope with key stakeholders.

      Activities

      1.1 Assess current BCP maturity.

      1.2 Identify key business processes to include in scope.

      1.3 Flowchart key business processes to identify business processes, dependencies, and alternatives.

      Outputs

      BCP Maturity Scorecard: measure progress and identify gaps.

      Business process flowcharts: review, optimize, and allow for knowledge transfer of processes.

      Identify workarounds for common disruptions to day-to-day continuity.

      2 Define RTOs and RPOs Based on Your BIA

      The Purpose

      Define RTOs and RPOs based on your BIA.

      Key Benefits Achieved

      Set recovery targets based business impact, and illustrate the importance of BCP efforts via the impact of downtime.

      Activities

      2.1 Define an objective scoring scale to indicate different levels of impact.

      2.2 Estimate the impact of downtime.

      2.3 Determine acceptable RTO/RPO targets for business processes based on business impact.

      Outputs

      BCP Business Impact Analysis: objective scoring scale to assess cost, goodwill, compliance, and safety impacts.

      Apply the scoring scale to estimate the impact of downtime on business processes.

      Acceptable RTOs/RPOs to dictate recovery strategy.

      3 Create a Recovery Workflow

      The Purpose

      Create a recovery workflow.

      Key Benefits Achieved

      Build an actionable, high-level, recovery workflow that can be adapted to a variety of different scenarios.

      Activities

      3.1 Conduct a tabletop exercise to determine current recovery procedures.

      3.2 Identify and prioritize projects to close gaps and mitigate recovery risks.

      3.3 Evaluate options for command centers and alternate business locations (i.e. BC site).

      Outputs

      Recovery flow diagram – current and future state

      Identify gaps and recovery risks.

      Create a project roadmap to close gaps.

      Evaluate requirements for alternate business sites.

      4 Extend the Results of the Pilot BCP and Implement Governance

      The Purpose

      Extend the results of the pilot BCP and implement governance.

      Key Benefits Achieved

      Outline the actions required for the rest of your BCMS, and the required effort to complete those actions, based on the results of the pilot.

      Activities

      4.1 Summarize the accomplishments and required next steps to create an overall BCP.

      4.2 Identify required BCM roles.

      4.3 Create a plan to update and maintain your overall BCP.

      Outputs

      Pilot BCP Executive Presentation

      Business Continuity Team Roles & Responsibilities

      3. Maintenance plan and BCP templates to complete the relevant documentation (BC Policy, BCP Action Items, Recovery Workflow, etc.)

      Further reading

      Develop a Business Continuity Plan

      Streamline the traditional approach to make BCP development manageable and repeatable.

      Analyst Perspective

      A BCP touches every aspect of your organization, making it potentially the most complex project you’ll take on. Streamline this effort or you won’t get far.

      None of us needs to look very far to find a reason to have an effective business continuity plan.

      From pandemics to natural disasters to supply chain disruptions to IT outages, there’s no shortage of events that can disrupt your complex and interconnected business processes. How in the world can anyone build a plan to address all these threats?

      Don’t try to boil the ocean. Use these tactics to streamline your BCP project and stay on track:

      • Focus on one business unit at a time. Keep the effort manageable, establish a repeatable process, and produce deliverables that provide a starting point for the rest of the organization.
      • Don’t start with an extensive risk analysis. It takes too long and at the end you’ll still need a plan to resume business operations following a disruption. Rather than trying to predict what could cause a disruption, focus on how to recover.
      • Keep your BCP documentation concise. Use flowcharts, checklists, and diagrams instead of traditional manuals.

      No one can predict every possible disruption, but by following the guidance in this blueprint, you can build a flexible continuity plan that allows you to withstand the threats your organization may face.

      Frank Trovato

      Research Director,
      IT Infrastructure & Operations Practice
      Info-Tech Research Group

      Andrew Sharp

      Senior Research Analyst,
      IT Infrastructure & Operations Practice
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      • Recent crises have increased executive awareness and internal pressure to create a BCP.
      • Industry- and government-driven regulations require evidence of sound business continuity practices.
      • Customers demand their vendors provide evidence of a workable BCP prior to signing a contract.

      IT leaders, because of their cross-functional view and experience with incident management and DR, are often asked to lead BCP efforts.

      Common Obstacles

      • IT managers asked to lead BCP efforts are dealing with processes and requirements beyond IT and outside of their control.
      • BCP requires input from multiple departments with different and sometimes conflicting objectives.
      • Typically there are few, if any, dedicated resources for BCP, so it can't be a full-time, resource-intensive project.

      Info-Tech’s Approach

      • Focus on implementing a structured and repeatable process that can be applied to one business unit at a time to avoid BCP from becoming an overwhelming project.
      • Enable business leaders to own the BCP going forward by establishing a template that the rest of the organization can follow.
      • Leverage BCP outcomes to refine IT DRP recovery objectives and achieve DRP-BCP alignment.

      Info-Tech Insight

      As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but you must enable business leaders to own their department’s BCP practices and outputs. They know their processes and, therefore, their requirements to resume business operations better than anyone else.

      Use this research to create business unit BCPs and structure your overall BCP

      A business continuity plan (BCP) consists of separate but related sub-plans, as illustrated below. This blueprint enables you to:

      • Develop a BCP for a selected business unit (as a pilot project), and thereby establish a methodology that can be repeated for remaining business units.
      • Through the BCP process, clarify requirements for an IT disaster recovery plan (DRP). Refer to Info-Tech’s Disaster Recovery Planning workshop for instructions on how to create an IT DRP.
      • Implement ongoing business continuity management to govern BCP, DRP, and crisis management.

      Overall Business Continuity Plan

      IT Disaster Recovery Plan

      A plan to restore IT application and infrastructure services following a disruption.

      Info-Tech’s disaster recovery planning blueprint provides a methodology for creating the IT DRP. Leverage this blueprint to validate and provide inputs for your IT DRP.

      BCP for Each Business Unit

      A set of plans to resume business processes for each business unit. This includes:

      • Identifying business processes and dependencies.
      • Defining an acceptable recovery timeline based on a business impact analysis.
      • Creating a step-by-step recovery workflow.

      Crisis Management Plan

      A plan to manage a wide range of crises, from health and safety incidents to business disruptions to reputational damage.

      Info-Tech’s Implement Crisis Management Best Practices blueprint provides a framework for planning a response to any crisis, from health and safety incidents to reputational damage.

      IT leaders asked to develop a BCP should start with an IT Disaster Recovery Plan

      It’s a business continuity plan. Why should you start continuity planning with IT?

      1. IT services are a critical dependency for most business processes. Creating an IT DRP helps you mitigate a key risk to continuity quicker than it takes to complete your overall BCP, and you can then focus on other dependencies such as people, facilities, and suppliers.
      2. A BCP requires workarounds for IT failures. But it’s difficult to plan workarounds without a clear understanding of the potential IT downtime and data loss. Your DRP will answer those questions, and without a DRP, BCP discussions can get bogged down in IT discussions. Think of payroll as an example: if downtime might be 24 hours, the business might simply wait for recovery; if downtime might be a week, waiting it out is not an option.
      3. As an IT manager, you can develop an IT DRP primarily with resources within your control. That makes it an easier starting point and puts IT in a better position to shift responsibility for BCP to business leaders (where it should reside) since essentially the IT portion is done.

      Create a Right-Sized Disaster Recovery Plan today.

      Modernize the BCP

      If your BCP relies heavily on paper-based processes as workarounds, it’s time to update your plan.

      Back when transactions were recorded on paper and then keyed into the mainframe system later, it was easier to revert to deskside processes. There is very little in the way of paper-based processes anymore, and as a result, it is increasingly difficult to resume business processes without IT.

      Think about your own organization. What IT system(s) are absolutely critical to business operations? While you might be able to continue doing business without IT, this requires regular preparation and training. It’s likely a completely offline process and won’t be a viable workaround for long even if staff know how to do the work. If your data center and core systems are down, technology-enabled workarounds (such as collaboration via mobile technologies or cloud-based solutions) could help you weather the outage, and may be more flexible and adaptable for day-to-day work.

      The bottom line:

      Technology is a critical dependency for business processes. Consider the role IT systems play as process dependencies and as workarounds as part of continuity planning.

      Info-Tech’s approach

      The traditional approach to BCP takes too long and produces a plan that is difficult to use and maintain.

      The Problem: You need to create a BCP, but don’t know where to start.

      • BCP is being demanded more and more to comply with regulations, mitigate business risk, meet customer demands, and obtain insurance.
      • IT leaders are often asked to lead BCP.

      The Complication: A traditional BCP process takes longer to show value.

      • Traditional consultants don’t usually have an incentive to accelerate the process.
      • At the same time, self-directed projects with no defined process go months without producing useful deliverables.
      • The result is a dense manual that checks boxes but isn’t maintainable or usable in a crisis.

      A pie chart is separated into three segments, Internal Mandates 43%, Customer Demands 23%, and Regulatory Requirements 34%. The bottom of the image reads Source: Info-Tech Research Group.

      The Info-Tech difference:

      Use Info-Tech’s methodology to right-size and streamline the process.

      • Reduce required effort. Keep the work manageable and maintain momentum by focusing on one business unit at a time; allow that unit to own their BCP.
      • Prioritize your effort. Evaluate the current state of your BCP to identify the steps that are most in need of attention.
      • Get valuable results faster. Functional deliverables and insights from the first business unit’s BCP can be leveraged by the entire organization (e.g. communication, assessment, and BC site strategies).

      Expedite BCP development

      Info-Tech’s Approach to BCP:

      • Start with one critical business unit to manage scope, establish a repeatable process, and generate deliverables that become a template for remaining business units.
      • Resolve critical gaps as you identify them, generating early value and risk mitigation.
      • Create concise, practical documentation to support recovery.

      Embed training and awareness throughout the planning process.

      BCP for Business Unit A:

      Scope → Pilot BIA → Response Plan → Gap Analysis

      → Lessons Learned:

      • Leverage early results to establish a BCM framework.
      • Take action to resolve critical gaps as they are identified.
      • BCP for Business Units B through N.
      • Scope→BIA→Response Plan→Gap Analysis

      = Ongoing governance, testing, maintenance, improvement, awareness, and training.

      By comparison, a traditional BCP approach takes much longer to mitigate risk:

      • An extensive, upfront commitment of time and resources before defining incident response plans and mitigating risk.
      • A “big bang” approach that makes it difficult to predict the required resourcing and timelines for the project.

      Organizational Risk Assessment and Business Impact Analysis → Solution Design to Achieve Recovery Objectives → Create and Validate Response Plans

      Case Study

      Continuity Planning Supports COVID-19 Response

      Industry: Non-Profit
      Source: Info-Tech Advisory Services

      A charitable foundation for a major state university engaged Info-Tech to support the creation of their business continuity plan.

      With support from Info-Tech analysts and the tools in this blueprint, they worked with their business unit stakeholders to identify recovery objectives, confirm recovery capabilities and business process workarounds, and address gaps in their continuity plans.

      Results

      The outcome wasn’t a pandemic plan – it was a continuity plan that was applicable to pandemics. And it worked. Business processes were prioritized, gaps in work-from-home and business process workarounds had been identified and addressed, business leaders owned their plan and understood their role in it, and IT had clear requirements that they were able and ready to support.

      “The work you did here with us was beyond valuable! I wish I could actually explain how ready we really were for this…while not necessarily for a pandemic, we were ready to spring into action, set things up, the priorities were established, and most importantly some of the changes we’ve made over the past few years helped beyond words! The fact that the groups had talked about this previously almost made what we had to do easy.“ -- VP IT Infrastructure

      Download the BCP Case Study

      Project Overview: BCP

      Phases Phase 1: Identify BCP Maturity and Document Process Dependencies Phase 2: Conduct a BIA to Determine Acceptable RTOs and RPOs Phase 3: Document the Recovery Workflow and Projects to Close Gaps Phase 4: Extend the Results of the Pilot BCP and Implement Governance
      Steps 1.1 Assess current BCP maturity 2.1 Define an objective impact scoring scale 3.1 Determine current recovery procedures 4.1 Consolidate BCP pilot insights to support an overall BCP project plan
      1.2 Establish the pilot BCP team 2.2 Estimate the impact of downtime 3.2 Identify and prioritize projects to close gaps 4.2 Outline a business continuity management (BCM) program
      1.3 Identify business processes, dependencies, and alternatives 2.3 Determine acceptable RTO/RPO targets 3.3 Evaluate BC site and command center options 4.3 Test and maintain your BCP
      Tools and Templates

      BCP Business Impact Analysis Tool

      Results Presentation

      BCP Maturity Scorecard

      Tabletop Planning Template

      BCP Summary

      Pilot Project Charter

      Recovery Workflow Examples

      Business Continuity Teams and Roles

      Business Process Workflows Examples

      BCP Project Roadmap

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      BCP Business Impact Analysis Tool: Conduct and document a business impact analysis using this document.

      BCP Recovery Workflows Example: Model your own recovery workflows on this example.

      BCP Project Roadmap: Use this tool to prioritize projects that can improve BCP capabilities and mitigate gaps and risks.

      BCP Relocation Checklists: Plan for and manage a site relocation – whether to an alternate site or work from home.

      Key deliverable:

      BCP Summary Document

      Summarize your organization's continuity capabilities and objectives in a 15-page, easy-to-consume template.

      This document consolidates data from the supporting documentation and tools to the right.

      Download Info-Tech’s BCP Summary Document

      Insight summary

      Focus less on risk, and more on recovery

      Avoid focusing on risk and probability analysis to drive your continuity strategy. You never know what might disrupt your business, so develop a flexible plan to enable business resumption regardless of the event.

      Small teams = good pilots

      Choose a small team for your BCP pilot. Small teams are better at trialing new techniques and finding new ways to think about problems.

      Calculate downtime impact

      Develop and apply a scoring scale to develop a more-objective assessment of downtime impact for the organization. This will help you prioritize recovery.

      It’s not no, but rather not now…

      You can’t address all the organization’s continuity challenges at once. Prioritize high value, low effort initiatives and create a long-term roadmap for the rest.

      Show Value Now

      Get to value quickly. Start with one business unit with continuity challenges, and a small, focused project team who can rapidly learn the methodology, identify continuity gaps, and define solutions that can also be leveraged by other departments right away.

      Lightweight Testing Exercises

      Outline recovery capabilities using lightweight, low risk tabletop planning exercises. Our research shows tabletop exercises increase confidence in recovery capabilities almost as much as live exercises, which carry much higher costs and risks.

      Blueprint benefits

      Demonstrate compliance with demands from regulators and customers

      • Develop a plan that satisfies auditors, customers, and insurance providers who demand proof of a continuity plan.
      • Demonstrate commitment to resilience by identifying gaps in current capabilities and projects to overcome those gaps.
      • Empower business users to develop their plans and perform regular maintenance to ensure plans don’t go stale.
      • Establish a culture of business readiness and resilience.

      Leverage your BCP to drive value (Business Benefits)

      • Enable flexible, mobile, and adaptable business operations that can overcome disruptions large and small. This includes making it easier to work remotely in response to pandemics or facility disruptions.
      • Clarify the risk of the status quo to business leaders so they can make informed decisions on where to invest in business continuity.
      • Demonstrate to customers your ability to overcome disruptions and continue to deliver your services.

      Info-Tech Advisory Services lead to Measurable Value

      Info-Tech members told us they save an average of $44,522 and 23 days by working with an Info-Tech analyst on BCP (source: client response data from Info-Tech's Measured Value Survey).

      Why do members report value from analyst engagement?

      1. Expert advice on your specific situation to overcome obstacles and speed bumps.
      2. Structure the project and stay on track.
      3. Review project deliverables and ensure the process is applied properly.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostic and consistent frameworks are used throughout all four options.

      Guided Implementation

      Your Trusted Advisor is a call away.

      A Guided Implementation (GI) is series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between eight to twelve calls over the course of four to six months.

      Scoping

      Call 1: Scope requirements, objectives, and stakeholders. Identify a pilot BCP project.

      Business Processes and Dependencies

      Calls 2 - 4: Assess current BCP maturity. Create business process workflows, dependencies, alternates, and workarounds.

      Conduct a BIA

      Calls 5 – 7: Create an impact scoring scale and conduct a BIA. Identify acceptable RTO and RPO.

      Recovery Workflow

      Calls 8 – 9: Create a recovery workflow based on tabletop planning.

      Documentation & BCP Framework

      Call 10: Summarize the pilot results and plan next steps. Define roles and responsibilities. Make the case for a wider BCP program.

      Workshop Overview

      Contact your account representative for more information.

      workshops@infotech.com | 1-888-670-8889

      Day 1 Day 2 Day 3 Day 4 Day 5
      Identify BCP Maturity, Key Processes, and Dependencies Conduct a BIA to Determine Acceptable RTOs and RPOs Document the Current Recovery Workflow and Projects to Close Gaps Identify Remaining BCP Documentation and Next Steps Next Steps and Wrap-Up (offsite)
      Activities

      1.1 Assess current BCP maturity.

      1.2 Identify key business processes to include in scope.

      1.3 Create a flowchart for key business processes to identify business processes, dependencies, and alternatives.

      2.1 Define an objective scoring scale to indicate different levels of impact.

      2.2 Estimate the impact of a business disruption on cost, goodwill, compliance, and health & safety.

      2.3 Determine acceptable RTOs/RPOs for selected business processes based on business impact.

      3.1 Review tabletop planning – what is it, how is it done?

      3.2 Walk through a business disruption scenario to determine your current recovery timeline, RTO/RPO gaps, and risks to your ability to resume business operations.

      3.3 Identify and prioritize projects to close RTO/RPO gaps and mitigate recovery risks.

      4.1 Assign business continuity management (BCM) roles to govern BCP development and maintenance, as well as roles required to execute recovery.

      4.2 Identify remaining documentation required for the pilot business unit and how to leverage the results to repeat the methodology for remaining business units.

      4.3 Workshop review and wrap-up.

      5.1 Finalize deliverables for the workshop.

      5.2 Set up review time for workshop outputs and to discuss next steps.

      Deliverables
      1. Baseline BCP maturity status
      2. Business process flowcharts
      3. Business process dependencies and alternatives recorded in the BIA tool
      1. Potential impact of a business disruption quantified for selected business processes.
      2. Business processes criticality and recovery priority defined
      3. Acceptable RTOs/RPOs defined based on business impact
      1. Current-state recovery workflow and timeline.
      2. RTO/RPO gaps identified.
      3. BCP project roadmap to close gaps
      1. BCM roles and responsibilities defined
      2. Workshop results deck; use this to communicate pilot results and next steps
      1. Finalized deliverables

      Phase 1

      Identify BCP Maturity and Document Process Dependencies

      Phase 1

      1.1 Assess Current BCP Maturity

      1.2 Establish the pilot BCP team

      1.3 Identify business processes, dependencies, and alternatives

      Insights & Outcomes

      Define the scope for the BCP project: assess the current state of the plan, create a pilot project team and pilot project charter, and map the business processes that will be the focus of the pilot.

      Participants

      • BCP Coordinator
      • BCP Executive Sponsor
      • Pilot Business Unit Manager & Process SMEs

      Step 1.1

      Assess current BCP Maturity

      This step will walk you through the following activities:

      • Complete Info-Tech’s BCP Maturity Scorecard

      This step involves the following participants:

      • Executive Sponsor
      • BCP Coordinator

      You'll use the following tools & templates:

      Outcomes & Insights

      Establish current BCP maturity using Info-Tech’s ISO 22301-aligned BCP Maturity Scorecard.

      Evaluate the current state of your continuity plan

      Use Info-Tech’s Maturity Scorecard to structure and accelerate a BCP maturity assessment.

      Conduct a maturity assessment to:

      • Create a baseline metric so you can measure progress over time. This metric can also drive buy-in from senior management to invest time and effort into your BCP.
      • Understand the scope of work to create a complete business continuity plan.
      • Measure your progress and remaining gaps by updating your assessment once you’ve completed the activities in this blueprint.

      This blueprint primarily addresses the first four sections in the scorecard, which align with the creation of the core components of your business continuity plan.

      Info-Tech’s BCP Maturity Scorecard

      Info-Tech’s maturity scorecard is aligned with ISO 22301, the international standard that describes the key elements of a functioning business continuity management system or program – the overarching set of documents, practices, and controls that support the ongoing creation and maintenance of your BCP. A fully functional BCMS goes beyond business continuity planning to include crisis management, BCP testing, and documentation management.

      Audit tools tend to treat every bullet point in ISO 22301 as a separate requirement – which means there’s almost 400 lines to assess. Info-Tech’s BCP Maturity Scorecard has synthesized key requirements, minimizing repetition to create a high-level self-assessment aligned with the standard.

      A high score is a good indicator of likely success with an audit.

      Download Info-Tech's BCP Maturity Scorecard

      Tool: BCP Maturity Scorecard

      Assess your organization’s BCP capabilities.

      Use Info-Tech’s BCP Maturity Scorecard to:

      • Assess the overall completeness of your existing BCP.
      • Track and demonstrate progress towards completion as you work through successive planning iterations with additional business units.
      1. Download a copy of the BCP Maturity Scorecard. On tab 1, indicate the percent completeness for each item using a 0-10 scale (0 = 0% complete, 10 = 100% complete).
      2. If you anticipate improvements in a certain area, make note of it in the “Comments” column.
      3. Review a visual representation of your overall scores on tab 2.

      Download Info-Tech's BCP Maturity Scorecard

      "The fact that this aligns with ISO is huge." - Dr. Bernard Jones MBCI, CBCP

      Step 1.2

      Establish the pilot BCP team

      This step will walk you through the following activities:

      • Assign accountability, responsibility, and roles.
      • Develop a project charter.
      • Identify dependencies and alternates for those dependencies.

      This step involves the following participants:

      • Executive Sponsor
      • BCP Coordinator

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Assign roles and responsibilities for the BCP pilot project. Set milestones and timelines for the pilot.

      Take a pilot approach for BCP

      Limit the scope of an initial BCP project to get to value faster.

      Pilot Project Goals

      • Establish a repeatable methodology that fits your organization and will accelerate BCP development, with tangible deliverables that provide a template for the rest of the business.
      • Identify high-priority business continuity gaps for the pilot business unit, many of which will also apply to the overall organization.
      • Identify initiatives to start addressing gaps now.
      • Enable business users to learn the BCP methodology and toolset so they can own and maintain their business unit BCPs.

      Accomplishments expected:

      • Define key business processes and process dependencies, and alternatives if dependencies are not available.
      • Classify key business processes by criticality for one business unit, using an objective impact scoring scale.
      • Set recovery objectives for these key processes.
      • Document workarounds and recovery plans.
      • Identify gaps in recovery plans and list action items to mitigate risks.
      • Develop a project plan to structure a larger continuity project.

      What not to expect from a pilot project:

      • A complete organizational BCP (the pilot is a strong starting point).
      • Implemented solutions to all BCP gaps (proposed solutions will need to be evaluated first).

      Structure IT’s role in continuity planning

      Clearly define IT’s role in the pilot BCP project to deliver a successful result that enables business units to own BCP in the future.

      Though IT is a critical dependency for most processes, IT shouldn’t own the business continuity plan. IT should be an internal BCP process consultant, and each business unit must own their plan.

      IT should be an internal BCP consultant.

      • IT departments interact with all business units, which gives IT leaders at least a high-level understanding of business operations across the organization.
      • IT leaders typically also have at least some knowledge of disaster recovery, which provides a foundation for tackling BCP.
      • By contrast, business leaders often have little or no experience with disaster recovery, and don’t have the same level of experience as IT when it comes to working with other business units.

      Why shouldn’t IT own the plan?

      • Business unit managers have the authority to direct resources in their department to participate in the BCP process.
      • Business users are the experts in their processes, and are in the best position to identify dependencies, downtime impacts, recovery objectives, and viable solutions (e.g., acceptable alternate sites or process workarounds).
      • Ultimately, business unit managers and executives must decide whether to mitigate, accept, or transfer risks.

      Info-Tech Insight

      A goal of the pilot is to seed success for further planning exercises. This is as much about demonstrating the value of continuity planning to the business unit, and enabling them to own it, as it is about implementing the methodology successfully.

      Create a RACI matrix for the pilot

      Assemble a small, focused team for the pilot project empowered to discover, report, and present possible solutions to continuity planning challenges in your organization.

      Outline roles and responsibilities on the pilot team using a “RACI” exercise. Remember, only one party can be ultimately accountable for the work being completed.

      Example Pilot BCP Project RACI

      Board Executive Team BCP Executive Sponsor BCP Team Leader BCP Coordinator Pilot Bus. Unit Manager Expert Bus. Unit Staff IT Manager
      Communicate BCP project status I I I A R C C I
      Assign resources to pilot BCP project A R C R C R
      Conduct continuity planning activities I A/R R R R R
      Create pilot BCP deliverables I A R R C C C
      Manage BCP documentation I A C R I C C
      Integrate results into BCMS I I A R R I C C
      Create overall BCP project plan I I A R C C

      R: Responsible for doing the work.

      A: Accountable to ensure the activity/work happens.

      C: Consulted prior to decision or action.

      I: Informed of the decision/action once it’s made.

      "Large teams excel at solving problems, but it is small teams that are more likely to come up with new problems for their more sizable counterparts to solve." – Wang & Evans, 2019

      Info-Tech Insight

      Small teams tend to be better at trialing new techniques and finding new ways to think about problems, both of which are needed for a BCP pilot project.

      Choose one business unit for the pilot

      Many organizations begin their BCP project with a target business unit in mind. It’s still worth establishing whether this business unit meets the criteria below.

      Good candidates for a pilot project:

      • Business processes are standardized and documented.
      • Management and staff are motivated to improve business continuity.
      • The business unit is sufficiently well resourced to spare time (e.g. a few hours a week) to dedicate to the BCP process.
      • If the business unit doesn’t meet these criteria, consider addressing shortfalls before the pilot (e.g. via stakeholder management or business process analysis) or selecting another unit.
      • Many of the decisions will ultimately require input and support from the business unit’s manager(s). It is critical that they are bought into and engaged with the project.
      • The leader of the first business unit will be a champion for BCP within the executive team.
      • Sometimes, there’s no clear place to start. If this is the case for you, consider using Info-Tech’s Business Unit BCP Prioritization Tool to determine the order in which business units should undergo BCP development.

      Create role descriptions for the pilot project

      Use these role descriptions and your RACI chart to define roles for the pilot.

      These short descriptions establish the functions, expectations, and responsibilities of each role at a more granular level.

      The Board and executives have an outsized influence on the speed at which the project can be completed. Ensure that communication with these stakeholders is clear and concise. Avoid involving them directly in activities and deliverable creation, unless it’s required by their role (e.g. as a business unit manager).

      Project Role Description
      Board & Executive Team
      • Will receive project status updates but are not directly involved in deliverable creation.
      Executive Sponsor
      • Liaison with the executive team.
      • Accountable to ensure the pilot BCP is completed.
      • Set project goals and approve resource allocation and funding.
      Pilot Business Unit Manager
      • Drive the project and assign required resources.
      • Delegate day-to-day project management tasks to the BCP Coordinator.
      BCP Coordinator
      • Function as the project manager. This includes scheduling activities, coordinating resources, reporting progress, and managing deliverables.
      • Learn and apply the BCP methodology to achieve project goals.
      Expert Business Unit Staff
      • Pilot business unit process experts to assist with BCP development for that business unit.
      IT Manager
      • Provide guidance on IT capabilities and recovery options.
      Other Business Unit Managers
      • Consulted to validate or provide input to the business impact analysis and RTOs/RPOs.

      Identify a suitable BCP Coordinator

      A skilled and committed coordinator is critical to building an effective and durable BCP.

      • Coordinating the BC planning effort requires a perspective that’s informed by IT, but goes beyond IT.
      • For example, many IT professionals only see business processes where they intersect with IT. The BCP Coordinator needs to be able to ask the right questions to help the business units think through dependencies for critical processes.
      • Business analysts can thrive in this role, which requires someone effective at dissecting business processes, working with business users, identifying requirements, and managing large projects.

      Structure the role of the BCP Coordinator

      The BCP Coordinator works with the pilot business unit as well as remaining business units to provide continuity and resolve discrepancies as they come up between business units.

      Specifically, this role includes:

      • Project management tasks (e.g. scheduling, assigning tasks, coordinating resources, and reporting progress).
      • Learning the BCP methodology (through the pilot) so that this person can lead remaining business units through their BCP process. This enables the IT leader who had been assigned to guide BCP development to step back into a more appropriate consulting role.
      • Managing the BCP workflow.

      "We found it necessary to have the same person work with each business unit to pass along lessons learned and resolve contingency planning conflicts for common dependencies." – Michelle Swessel, PM and IT Bus. Analyst, Wisconsin Compensation Rating Bureau (WCRB)

      Template: Pilot Project Charter

      Formalize participants, roles, milestones, risks for the pilot project.

      Your charter should:

      1. Define project parameters, including drivers, objectives, deliverables, and scope.
      2. Identify the pilot business unit.
      3. Assign a BCP pilot team, including a BCP Coordinator, to execute the methodology.
      4. Define before-and-after metrics to enable the team to measure pilot success.
      5. Set achievable, realistic target dates for specific project milestones.
      6. Document risks, assumptions, and constraints.

      Download Info-Tech’s BCP Pilot Project Charter Template

      Step 1.3

      Identify business processes, dependencies, and alternatives

      This step will walk you through the following activities:

      • Identify key business processes.
      • Document the process workflow.
      • Identify dependencies and alternates for those dependencies.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      You'll use the following tools & templates:

      Outcomes & Insights

      Documented workflows, process dependencies, and workarounds when dependencies are unavailable.

      Flowchart business processes

      Workflows help you visually identify process dependencies and optimization opportunities.

      • Business continuity planning is business process focused. You need to document business processes, dependencies, and downtime workarounds.
      • Process documentation is a basic BCP audit requirement, but it will also:
        • Keep discussions about business processes well-scoped and focused – by documenting the process, you also clarify for everyone what you’re actually talking about.
        • Remind participants of process dependencies and workarounds.
        • Make it easier to spot possible process breakdowns or improvements.
        • Capture your work, which can be used to create or update SOP documentation.
      • Use flowcharts to capture process workflows. Flowcharts are often quicker to create, take less time to update, and are ultimately more usable than a dense manual.

      Info-Tech Insight

      Process review often results in discovering informal processes, previously unknown workarounds or breakdowns, shadow IT, or process improvement opportunities.

      1.3.1 Prioritize pilot business unit processes

      Input

      • List of key business unit processes.

      Output

      • List of key business unit processes, now prioritized (at a high-level)

      Materials

      • Whiteboard/flip charts
      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (leads the discussion)
      • Pilot Business Unit Manager

      30 minutes

      1. Create a list of all formal and informal business processes executed by the pilot business unit.
      2. Discuss the impact of process downtime, and do a quick assessment whether impact of downtime for each process would be high, medium, or low across each of these criteria:
        • Revenue or costs (e.g. supports sales, billing, or productivity)
        • Goodwill (e.g. affects internal or external reputation)
        • Compliance (e.g. affects legal or industry requirements)
        • Health or safety (e.g. affects employee/public health & safety)

      Note: A more in-depth analysis will be conducted later to refine priorities. The goal here is a high-level order of priority for the next steps in the planning methodology (identify business processes and dependencies).

      1. In the BCP Business Impact Analysis Tool, Processes and Dependencies tab, record the following:
        • The business processes in rough order of criticality.
        • For each process, provide a brief description that focuses on purpose and impact.
        • For each process, name a process owner (i.e. accountable for process completion – could be a manager or senior staff, not necessarily those executing the process).

      1.3.2 Review process flows & identify dependencies

      Input

      • List of key business unit processes (prioritized at a high level in Activity 1.3.1).
      • Business process flowcharts.

      Output

      • Business process flowcharts

      Materials

      • Whiteboard/flip charts
      • Microsoft Visio, or other flowcharting software
      • BCP Business Impact Analysis Tool

      Download Info-Tech’s Business Process Workflows Example

      1.5 hours

      1. Use a whiteboard to flowchart process steps. Collaborate to clarify process steps and dependencies. If processes are not documented, use this as an opportunity to create standard operating procedures (SOPs) to drive consistency and process optimization, as described in the Info-Tech blueprint, Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind.
      2. Record the dependencies in tab 1 of the BCP Business Impact Analysis Tool in the appropriate columns:
        • People – Anyone involved in the process, from providing guidance to executing the steps.
        • IT Applications – Core IT services (e.g. ERP, CRM) required for this process.
        • End-user devices & equipment – End-user devices, locally-installed apps, IoT, etc.
        • Facility – Any special requirements beyond general office space.
        • Suppliers & Service Providers – Third-parties who support this process.

      Info-Tech Insight

      Policies and procedures manuals, if they exist, are often out of date or incomplete. Use these as a starting point, but don’t stop there. Identify the go-to staff members who are well versed in how a process works.

      1.3.3 Document workarounds

      Input

      • Business process flowcharts.
      • List of process dependencies.

      Output

      • Workarounds and alternatives in the event dependencies aren’t available.

      Materials

      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (facilitates the activity)
      • Pilot Business Unit Manager
      • Business Process Subject Matter Experts (SMEs)

      1.5 hours

      Identify alternatives to critical dependencies to help you create contingency plans.

      1. For each business process, identify known alternatives for each primary dependency. Ignore for the moment how long the workaround or alternate would be feasible.
      2. Record alternatives in the Business Continuity Business Impact Analysis Tool, Processes and Dependencies tab, Alternatives columns (a separate column for each category of dependency):
        • People – Can other staff execute the process steps? (Example: managers can step in if needed.)
        • IT Applications – Is there a manual workaround or other alternative while enterprise technology services are unavailable? (Example: database is down, but data is stored on physical forms.)
        • End-User Devices and Equipment – What alternatives exist to the usual end-user technologies, such as workstations and desk phones? (Example: some staff have cell phones.)
        • Facility Location and Requirements – Is there an alternate location where this work can be conducted? (Example: work from home, or from another building on the campus.)
        • Suppliers and External Services – Is there an alternative source for key suppliers or other external inputs? (Example: find alternate suppliers for key inputs.)
        • Additional Inputs or Requirements – What workarounds exist for additional artifacts that enable process steps (e.g. physical inventory records, control lists)? (Example: if hourly pay information is missing, run the same payroll as the previous run and reconcile once that information is available.)

      Phase 2

      Conduct a BIA to Determine Acceptable RTOs and RPOs

      Phase 2

      2.1 Define an objective impact scoring scale

      2.2 Estimate the impact of downtime

      2.3 Determine acceptable RTO/RPO targets

      Insights & Outcomes

      Assess the impact of business process downtime using objective, customized impact scoring scales. Sort business processes by criticality and by assigning criticality tiers, recovery time, and recovery point objectives.

      Participants

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Business Process SMEs

      Step 2.1

      Define an objective scoring scale

      This step will walk you through the following activities:

      • Identify impact criteria that are relevant to your business.
      • Create a scale that defines a range of impact for relevant criteria.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Define an impact scoring scale relevant to your business, which allows you to more-objectively assess the impact of business process downtime.

      Set appropriate recovery objectives

      Recovery time and recovery point objectives should align with business impact.

      The activities in Phase 2 will help you set appropriate, acceptable recovery objectives based on the business impact of process downtime.

      • The recovery time objective (RTO) and recovery point objective (RPO) are the recovery goals set for individual processes and dependencies to ensure your business unit meets its overall acceptable recovery timeline.

      For example:

      • An RTO of four hours means staff and other required resources must be available to support the business processes within four hours of an incident (e.g. relocate to an alternate worksite if necessary, access needed equipment, log-in to needed systems, get support for completing the process from alternate staff, etc.)
      • An RPO of four hours for a customer database means the most recent secondary copy of the data must never be more than four hours old – e.g. running a backup every four hours or less.

      Conduct a Business Impact Analysis (BIA)

      Create Impact Scoring Scales→Assess the impact of process downtime→Review overall impact of process downtime→Set Criticality Tiers→Set Recovery Time and Recovery Point Objectives

      Create financial impact scales

      Identify maximum cost and revenue impacts to build financial impact scales to measure the financial impact of process downtime.

      Work with the Business Unit Manager and Executive Sponsor to identify the maximum impact in each category to the entire business. Use a worst-case scenario to estimate the maximum for each scale. In the future, you can use this scoring scale to estimate the impact of downtime for other business units.

      • Loss of Revenue: Estimate the upper bound for this figure from the previous year, and divide that by the number of business days in the year. Note: Some organizations may choose to exclude revenue as a category where it won’t be lost (e.g. public-sector organizations).
      • Loss of Productivity: Proxy for lost workforce productivity using payroll numbers. Use the fully loaded payroll for the company, divided by the number of working days in the year as the maximum.
      • Increased Operating Costs: Isolate this to known additional costs resulting from a disruption. Does the interruption itself increase operating costs (e.g. if using timesheets for hourly/contract employees and that information is lost or unavailable, do you assume a full work week)?
      • Financial Penalties: If there are known financial penalties (e.g. due to failure to meet SLAs or other contractual obligations), include those values in your cost estimates.

      Info-Tech Insight

      Cost estimates are like hand grenades and horseshoes: you don’t need to be exact. It’s much easier to get input and validation from other stakeholders when you have estimates. Even weak estimates are far better than a blank sheet.

      Create goodwill, compliance, and safety impact scales

      Create a quantitative, more-objective scoring scale for goodwill, compliance and safety by following the guidance below.

      • Impact on Customers: By default, the customer impact scale is based on the percent of your total customer base impacted. You can also modify this scale to include severity of impact or alter it to identify the maximum number of customers that would be impacted.
      • Impact on Staff: Consider staff that are directly employed by the organization or its subsidiaries.
      • Impact on Business Partners: Which business partners would be affected by a business disruption?
      • Impact on Health & Safety: Consider the extent to which process downtime could increase the risk of the health & safety of staff, customers, and the general public. In addition, degradation of health & safety services should be noted.
      • Impact on Compliance: Set up the scale so that you can capture the impact of any critical regulatory requirements that might not be met if a particular process was down for 24 hours. Consider whether you expect to receive leeway or a grace period from the governance body that requires evidence of compliance.

      Info-Tech Best Practice

      Use just the impact scales that are relevant to your organization.

      Tool: Impact Scoring Scales

      • Define 4-point scoring scales in the BCP business impact analysis tool for a more objective assessment than gut-feel rankings.
      • You don’t need to include every category, if they aren’t relevant to your organization.
      • Refine the scoring scale as needed through the pilot project.
      • Use the same scoring scale for impact analyses with additional business units in the future.

      An image depicting the Business Impact Analysis Tool. A note pointing to the Level of Impact and Direct Cost Impact Scales columns states: Add the maximum cost impacts across each of the four impact scales to the tool. The rest of the scale will auto-populate based on the criteria outlined in the “Level of Impact” column. A note pointing to the column headers states: Change the names of the column headers in this tab. The changes to column headers will populate across the rest of the tool. Indicate exclusions from the scale here. A note pointing to the Goodwill Impact Scales columns reads: Update the Goodwill impact scales. For example, perhaps a critical impact on customers could be defined as “a significant impact on all customers using the organization’s services in a 24-hour period.” A note pointing to the Compliance, Heath and Safety Impact Scales columns reads: Review the compliance and safety impact scales, and update as required.

      Step 2.2

      Estimate the impact of downtime

      This step will walk you through the following activities:

      • Apply the scoring scale developed in step 2.1 to assess the impact of downtime for specific business processes.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Develop an objective view of the impact of downtime for key business processes.

      2.2.1 Estimate the impact of downtime

      1.5 hours

      Input

      • List of business processes, dependencies, and workarounds, all documented in the BIA tool.

      Output

      • Impact of downtime scores for key business unit processes.

      Materials

      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (facilitates the discussion)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager
      1. Print a copy of the Scoring Criteria tab to use as a reference, or have it open on another screen. In tab 3 of the BCP Business Impact Analysis Tool use the drop-down menu to assign a score of 0 to 4 based on levels of impact defined in the Scoring Criteria tab.
      2. Work horizontally across all categories for a single process. This will set a benchmark, familiarize you with the scoring system, and allow you to modify any scoring scales if needed. In general, begin with the process that you know to be most critical.
        • For example, if call center sales operations are down:
          • Loss of Revenue would be the portion of sales revenue generated through the call center. This might score a 2 or 3 depending on the proportion of sales generated through the call center.
          • The Impact on Customers might be a 1 or 2 depending on the extent that existing customers might be using the call center to purchase new products or services.
          • The Legal/Regulatory Compliance and Health or Safety Risk might be a 0.
      3. Next, work vertically across all processes within a single category. This will allow you to compare scores within the category as you create them.

      Tool: Impact Analysis

      • The goal of the exercise is to arrive at a defensible ranking of process criticality, based on the impact of downtime.
      • Make sure participants can see the scores you’re assigning during the exercise (e.g. by writing out the scores on a whiteboard, or displaying the tool on a projector or screen) and can reference the scoring scales tab to understand what the scores mean.
      • Take notes to record the rationale behind the impact scores. Consider assigning note-taking duties to one of the participants.

      An image of the Impact Analysis Tool. A note pointing to the column headings states: Any customized column headings from tab 2, Scoring Criteria are automatically ported to this tab. A note pointing to the Impact on Goodwill columns reads: Score each application across each scoring scale from 0 to 4. Be sure to refer back to the scoring scale defined in tab 2. Have the scoring scale printed out, written on a whiteboard, or displayed on a separate screen. A note pointing to the tool's dropdown boxes states: Score categories using the drop-down boxes. A note pointing to the centre columns reads: Ignore scoring for categories you choose to exclude. You can hide these columns to clean up the tool if needed.

      2.2.2 Sort processes into Criticality Tiers

      30 minutes

      Input

      • Processes, with assigned impact scores (financial impact, goodwill impact, compliance and safety impact).

      Output

      • Business processes sorted into criticality tiers, based on the impact of downtime.

      Materials

      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (facilitates the discussion)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager
      1. In general, consider the Total Impact on Goodwill, Compliance, and Safety first.
        • An effective tactic to start the process is to assign a tier 1 rating to all processes with a Goodwill, Compliance, and Safety score that’s 50% or more of the highest total score, tier 2 where scores are between 25% and 50%, and tier 3 where scores are below 25% (see table below for an example).
        • In step 2.3, you’ll align recovery time objectives with the criticality tiers. So, Tier 1 processes will target recovery before Tier 2 processes, and Tier 2 processes will target recovery before Tier 3 processes.
      2. Next, consider the Total Cost of Downtime.
      • The Total Cost is calculated by the tool based on the Scoring Criteria in tab 2 and the estimates in the BIA.
      • Consider whether the total cost impact justifies changing the criticality rating. “Smoke test” categorization with participants. Are there any surprises (processes more or less critical than expected)?
    • If the categorization doesn’t seem right, check that the scoring scale was applied consistently.
    • Example: Highest total Goodwill, Compliance, and Safety impact score is 18.

      Tier Score Range % of high score
      Tier 1 - Gold 9-18 50-100%
      Tier 2 - Silver 5 to 9 25-50%
      Tier 3 - Bronze 0 to 5 0-25%

      Step 2.3

      Determine acceptable RTO and RPO targets

      This step will walk you through the following activities:

      • Identify acceptable Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for business processes.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes and Insights

      Right-size recovery objectives based on business impact.

      Right-size recovery objectives

      Acceptable RTOs and RPOs must be right-sized to the impact of downtime.

      Rapid recovery typically requires more investment.

      The impact of downtime for most business processes tends to look something like the increasing impact curve in the image to the right.

      In the moments after a disruption, impact tends to be minimal. Imagine, for example, that your organization was suddenly unable to pay its suppliers (don’t worry about the reason for the disruption, for the moment). Chances are, this disruption wouldn’t affect many payees if it lasted just a few minutes, or even a few hours. But if the disruption were to continue for days, or weeks, the impact of downtime would start to spiral out of control.

      In general, we want to target recovery somewhere between the point where impact begins, and the point where impact is intolerable. We want to balance the impact of downtime with the investment required to make processes more resilient.

      Info-Tech Insight

      Account for hard copy files as well as electronic data. If that information is lost, is there a backup? BCP can be the driver to remove the last resistance to paperless processes, allowing IT to apply appropriate data protection.

      Set recovery time objectives and recovery point objectives in the “Debate Space”

      A graph with the X axis labelled as: Increasing downtime/data loss and the Y-axis labelled Increasing Impact. The graph shows a line rising as impact and downtime/data loss increase, with the lowest end of the line (on the left) labelled as minimal impact, and the highest point of the line (on the right) labelled maximum tolerance. The middle section of the line is labelled as the Debate Space, and a note reads: Acceptable RTO/RPO must be between Low Impact and Maximum Tolerance

      2.3.1 Define process-level recovery objectives

      1 hour

      Input

      • Processes, ranked by criticality.

      Output

      • Initial business-defined recovery objectives for each process.

      Materials

      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (facilitates the discussion)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager
      1. Review the “Debate Space” diagram (shown in previous section) with all participants.
      2. Ask business participants for each process: how much downtime is tolerable, acceptable, or appropriate? How much data loss is tolerable?
        • If participants aren’t yet comfortable setting recovery objectives, identify the point at which downtime and data loss first becomes noticeable and the point at which downtime and data loss becomes intolerable.
        • Choose an RTO and RPO for each process that falls within the range set by these two extremes.

      RTOs and RPOs are business-defined, impact-aligned objectives that you may not be able to achieve today. It may require significant investments of time and capital to enable the organization to meet RTO and RPO.

      2.3.2 Align RTOs within and across criticality tiers

      1 hour

      Input

      • Results from pilot BCP impact analysis.

      Output

      • Initial business-defined recovery objectives for each process.

      Materials

      • BCP Business Impact Analysis Tool
      • Whiteboard/ flipchart

      Participants

      • BCP Coordinator
      • BCP Project Sponsor
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager (optional)

      Set a range for RTO for each Tier.

      1. Start with your least critical/Tier 3 processes. Use the filter in the “Criticality Rating” column in the Impact Analysis tab of the BIA tool to show only Tier 3 processes.
        • What range of RTOs did the group assign for processes in this Tier? Does the group agree that these targets are appropriate for these processes?
        • Record the range of RTOs on the whiteboard or flipchart.
      2. Next, look at Tier 2 processes. Use the same filter to show just Tier 2 processes.
        • Record the range of RTOs, confirm the range with the group, and ensure there’s no overlap with the Tier 3 range.
        • If the RTOs in one Tier overlap with RTOs in another, you’ll need to adjust RTOs or move processes between Tiers (if the impact analysis justifies it).
      Tier RTO
      Tier 1 4 hrs- 24 hrs
      Tier 2 24 hrs - 72 hrs
      Tier 3 72 hrs - 120 hrs

      Phase 3

      Document the Recovery Workflow and Projects to Close Gaps

      3.1 Determine current recovery procedures

      3.2 Identify and prioritize projects to close gaps

      3.3 Evaluate business continuity site and command center options

      Insights & Outcomes

      Outline business recovery processes. Highlight gaps and risks that could hinder business recovery. Brainstorm ideas to address gaps and risks. Review alternate site and business relocation options.

      Participants

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Business Process SMEs

      Step 3.1

      Determine current recovery procedures

      This step will walk you through the following activities:

      • Create a step-by-step, high-level recovery workflow.
      • Highlight gaps and risks in the recovery workflow.
      • Test the workflow against multiple scenarios.

      This step involves the following participants:

      • BCP Coordinator
      • Crisis Management Team
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Establish steps required for business recovery and current recovery timelines.

      Identify risks & gaps that could delay or obstruct an effective recovery.

      Conduct a tabletop planning exercise to draft business recovery plans

      Tabletop exercises are the most effective way to test and increase business confidence in business recovery capabilities.

      Why is tabletop planning so effective?

      • It enables you play out a wider range of scenarios than technology-based testing (e.g. full-scale, parallel) due to cost and complexity factors.
      • It is non-intrusive, so it can be executed more frequently than other testing methodologies.
      • It provides a thorough test of your recovery workflow since the exercise is, essentially, paper-based.
      • After you have a BCP in place, this exercise can continue to be a valuable testing exercise for BCP to capture changes in your recovery process.

      A graph titled: Tabletop planning had the greatest impact on respondent confidence in meeting recovery objectives. The graph shows that the relative importance of Tabletop Planning is 57%, compared to 33% for Unit Testing, 3% for Simulation Testing, 6% for Parallel Testing, and 2% for Full-Scale Testing. The source for the graph is Info-Tech Research Group.

      Step 2 - 2 hours
      Establish command center.

      Step 2: Risks

      • Command center is just 15 miles away from primary site.

      Step 2: Gaps

      • Confirm what’s required to set up the command center.
      • Who has access to the EOC?
      • Does the center have sufficient bandwidth, workstations, phones, telephone lines?

      3.1.1 Choose a scenario for your first tabletop exercise

      30 minutes

      Input

      • List of past incidents.
      • Risks to business continuity that are of high concern.

      Output

      • Scenario for the tabletop exercise.

      Materials

      • N/A

      Participant

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot business unit manager

      At the business unit level, the goal is to define a plan to resume business processes after an incident.

      A good scenario is one that helps the group focus on the goal of tabletop planning – to discuss and document the steps required to recover business processes. We suggest choosing a scenario for your first exercise that:

      • Disrupts many process dependencies (i.e. facilities, staff, IT services, suppliers).
      • Does not result in major property damage, harm, or loss of life. Business resumption is the focus of this exercise, not emergency response.
      • Has happened in the past, or is of concern to the business.

      An example: a gas leak at company HQ that requires the area to be cordoned off and power to be shut down. The business must resume processes from another location without access to materials, equipment, or IT services at the primary location.

      A plan that satisfies the gas leak scenario should meet the needs of other scenarios that affect your normal workspace. Then use BCP testing to validate that the plan meets a wider range of incidents.

      3.1.2 Define the BCP activation process

      1 hour

      Input

      • Any existing crisis management, incident response or emergency response plans.
      • BC Scenario.

      Output

      • High level incident notification, assessment, and declaration workflow.

      Materials

      • Cue cards, sticky notes, whiteboard and markers, or Visio template.

      Participants

      • BCP Coordinator
      • Crisis Management Team (if one exists)
      • Business Process SMEs
      • Pilot Business Unit Manager

      Answer the questions below to structure your notification, assessment, and BCP activation procedures.

      Notification

      How will you be notified of a disaster event? How will this be escalated to leadership? How will the team responsible for making decisions coordinate (if they can’t meet on-site)? What emergency response plans are in place to protect health and safety? What additional steps are involved if there’s a risk to health and safety?

      Assessment

      Who’s in charge of the initial assessment? Who may need to be involved in the assessment? Who will coordinate if multiple teams are required to investigate and assess the situation? Who needs to review the results of the assessment, and how will the results of the assessment be communicated (e.g. phone bridge, written memo)? What happens if your primary mode of communication is unavailable (e.g. phone service is down)?

      Declaration

      Who is responsible today for declaring a disaster and activating business continuity plans? What are the organization’s criteria for activating continuity plans, and how will BCP activation be communicated? Establish a crisis management team to guide the organization through a wide range of crises by Implementing Crisis Management Best Practices.

      3.1.3 Document the business recovery workflow

      1 hour

      Input

      • Pilot BIA.
      • Any existing crisis management, incident response, or emergency response plans.
      • BC Scenario

      Output

      • Outline of your BCP declaration and business recovery plan.

      Materials

      • Cue cards, sticky notes, whiteboard and markers, or Visio template.

      Participants

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager

      Do the following:

      1. Create separate flows for facility, IT, and staff disruptions. Include additional workflows as needed.
        • We suggest you outline the recovery process at least to the point where business processes are restored to a minimum viable functional level.
      2. On white cue cards:
        1. Record the step.
        2. Indicate the task owner.
        3. Estimate how long the step will take.
      3. On yellow cue cards, document gaps in people, process, and technology requirements to complete the step.
      4. On red cue cards, indicate risks (e.g. no backup person for a key staff member).

      Info-Tech Best Practice

      Tabletop planning is most effective when you keep it simple.

      • Be focused; stay on task and on time.
      • Revisit each step and record risks and mitigation strategies.
      • Discuss each step from start to finish.
      • Revise the plan with key task owners.
      • Don’t get weighed down by tools.
      • Simple tools, like cue cards or whiteboards, can be very effective.

      Tool: BCP Recovery Workflow

      Document the steps you identified in the tabletop to create your draft recovery workflow.

      Why use a flowchart?

      • Flowcharts provide an at-a-glance view, are ideal for crisis scenarios where pressure is high and effective, and where timely communication is necessary.
      • For experienced managers and staff, a high-level reminder of process flows or key steps is sufficient.
      • Where more detail is required, include links to supporting documentation (which could include checklists, vendor documentation/contracts, other flowcharts, etc.)

      Create one recovery workflow for all scenarios.

      Traditional planning calls for separate plans for different “what-if” scenarios. This is challenging not just because it’s a lot more documentation – and maintenance – but because it’s impossible to predict every possible incident. Use the template, aligned to recovery of process dependencies, to create one recovery workflow for each business unit that can be used in and tested against different scenarios.

      Download Info-Tech’s BCP Recovery Workflow Example

      "We use flowcharts for our declaration procedures. Flowcharts are more effective when you have to explain status and next steps to upper management." – Assistant Director-IT Operations, Healthcare Industry

      "Very few business interruptions are actually major disasters. It’s usually a power outage or hardware failure, so I ensure my plans address ‘minor’ incidents as well as major disasters."- BCP Consultant

      3.1.4 Document achievable recovery metrics (RTA/RPA)

      30 minutes

      Input

      • Pilot BCP BIA.
      • Draft recovery workflow.

      Output

      • RTA and RPA for each business process.

      Materials

      • Pilot BCP BIA.

      Participants

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager

      Add the following data to your copy of the BCP Business Impact Analysis Tool.

      1. Estimate the recovery time achievable (RTA) for each process based on the required time for the process to be restored to a minimum acceptable functional level. Review your recovery workflow to identify this timeline. For example, if the full process from notification, assessment, and declaration to recovery and relocation would take a full day, set the RTA to 24 hours.
      2. Estimate the recovery point achievable (RPA) for each process based on the maximum amount of data that could be lost. For example, if data on a particular system is backed up offsite once per day, and the onsite system was destroyed just before that backup began, the entire day’s data could be lost and the achievable RPO is 24 hours. Note: Enter a value of 9999 to indicate that data is unrecoverable.

      Info-Tech Insight

      Operating at a minimum acceptable functional level may not be feasible for more than a few days or weeks. Develop plans for immediate continuity first, then develop further plans for long-term continuity processes as required. Recognize that for longer term outages, you will evolve your plans in the crisis to meet the needs of the situation.

      3.1.5 Test the workflow of other scenarios

      1 hour

      Input

      • Draft recovery workflow.

      Output

      • Updated draft recovery workflow.

      Materials

      • Draft recovery workflow.
      • Projector or screen.

      Participants

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager

      Work from and update the soft copy of your recovery workflow.

      1. Would any steps change if the scenario changes? If yes, capture the different flow with a decision diamond. See the example Recovery Workflow for a workflow that uses decision diamonds. Identify any new gaps or risks you encounter with red and yellow cards.
      2. Make sure the decision diamonds are as generalized as possible. For example, instead of creating a separate response plan for each scenario that would require you to relocate from your existing building, create one response plan for relocation and one response plan for remaining in place.
      3. See the next section for some examples of different types of scenarios that you may include in your recovery workflow.

      Info-Tech Insight

      Remember that health and safety risks must be dealt with first in a crisis. The business unit recovery workflow will focus on restoring business operations after employees are no longer at risk (e.g. the risk has been resolved or employees have been safely relocated). See Implement Crisis Management Best Practices for ideas on how to respond to and assess a wide range of crises.

      Not all scenarios will have full continuity plans

      Risk management is a business decision. Business continuity planning can help decision makers understand and decide on whether to accept or mitigate high impact, low probability risks.

      For some organizations, it’s not practical or possible to invest in the redundancy that would be necessary to recover in a timely manner from certain major events.

      Leverage existing risk management practices to identify key high impact events that could present major business continuity challenges that could cause catastrophic disruptions to facility, IT, staffing, suppliers, or equipment. If you don’t have a risk register, review the scenarios on the next slide and brainstorm risks with the working group.

      Work through tabletop planning to identify how you might work through an event like this, at a high level. In step 3.2, you can estimate the effort, cost, and benefit for different ideas that can help mitigate the damage to the business to help decision makers choose between investment in mitigation or accepting the risk.

      Document any scenarios that you identify as outside the scope of your continuity plans in the “Scope” section of your BCP Summary document.

      For example:

      A single location manufacturing company is creating a BCP.

      The factory is large and contains expensive equipment; it’s not possible to build a second factory for redundancy. If the factory is destroyed, operations can’t be resumed until the factory is rebuilt. In this case, the BCP outlines how to conduct an orderly business shutdown while the factory is rebuilt.

      Contingency planning to resume factory operations after less destructive events, as well as a BCP for corporate services, is still practical and necessary.

      Considerations for other BCP scenarios

      Scenario Type Considerations
      Local hazard (gas leak, chemical leak, criminal incident, etc.)
      • Systems might be accessible remotely, but hands-on maintenance will be required eventually. “Work from home” won’t be a long-term solution.
      • An alternate site is required for service continuity. Can be within normal commuting distance.
      Equipment/building damage (fire, roof collapse, etc.)
      • Equipment will need repair or replacement (vendor involvement).
      • An alternate site is required for service continuity. Can be nearby.
      Regional natural disasters
      • Utilities may be affected (power, running water, etc.).
      • Expect staff to take care of their families first before work.
      • A geographically distant alternate site is required for service continuity.
      Supplier failure (IT provider outage, disaster at supplier, etc.)
      • Service-level agreements are important to establish recovery timelines. Review contracts and master services agreements.
      Staff (lottery win, work stoppage, pandemic/quarantine)
      • Staff are suddenly unavailable. Expect that no warm handoff to alternates is possible and that time to ramp up on the process is accounted for.
      • In a pandemic scenario, work from home, remote toolsets, and digital/contactless workflows become critical.

      Step 3.2

      Identify and prioritize projects to close gaps

      This step will walk you through the following activities:

      • Brainstorm solutions to identified gaps and risks.
      • Prioritize projects and action items to close gaps and risks.
      • Assess the impact of proposed projects on the recovery workflow.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Identify and prioritize projects and action items that can improve business continuity capabilities.

      3.2.1 Brainstorm solutions to address risks and gaps

      1 hour

      Input

      • Draft recovery workflow.
      • Known continuity risks and gaps.

      Output

      • Ideas for action items and projects to improve business continuity.

      Materials

      • Flipchart

      Participants

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager
      1. Review each of the risk and gap cards from the tabletop exercise.
      2. As a group, brainstorm ideas to address gaps, mitigate risks, and improve resiliency. Write the list of ideas on a whiteboard or flip chart paper. The solutions can range from quick-wins and action items to major capital investments. The following slides can help you seed ideas to support brainstorming and idea generation.

      Info-Tech Best Practice

      Try to avoid debates about feasibility at this point. The goal is to get ideas on the board.

      When you’re brainstorming solutions to problems, don’t stop with the first idea, even if the solution seems obvious. The first idea isn’t always the best or only solution – other ideas can expand on it and improve it.

      Step 4: No formal process to declare a disaster and invoke business continuity.

      Step 7: Alternate site could be affected by the same regional event as the main office.

      Step 12: Need to confirm supplier service-level agreements (SLAs).

      1. Continue to create BCP documentation.
      2. Identify a third location for regional disasters.
      3. Contact suppliers to confirm SLAs and validate alignment with RTOs/RPOs.
      4. Add BCP requirements collection to service procurement process?

      Discuss your remote work capabilities

      With COVID-19, most organizations have experience with mass work-from-home.

      Review the following case studies. Do they reflect your experience during the COVID-19 pandemic?

      Unacceptable risk

      • A small insurance company provided laptops to staff so they could work remotely.
      • Complication: Cheque and print stock is a dependency and no plan was made to store check stock offsite in a secure fashion.

      Key dependencies missing

      • A local government provided laptops to key staff so they could work remotely.
      • Complication: The organization didn’t currently own enough Citrix licenses for every user to be online concurrently.

      Unable to serve customers

      • The attestation and land services department of a local government agency provided staff with remote access to key apps.
      • Complication: Their most critical business processes were designed to be in-person – they had no plan to execute these processes from home.

      Consider where your own work-from-home plans fell short.

      • Were your collaboration and communication solutions too difficult for users to use effectively?
      • Did legacy infrastructure affect performance or limit capabilities? Were security concerns appropriately addressed?
      • What challenges did IT face supporting business users on break-fix and new requests?
      • Were there logistical needs (shipping/receiving, etc.) that weren’t met?
      • Develop an updated plan to support work-from-home using Info-Tech’s BCP Relocation Checklists and Home Office Survey template, and integrate these into your overall BCP documentation. Stakeholders can easily appreciate the value of this plan since it’s relevant to recent experience.

      Identify opportunities to improve continuity plans

      What gaps in your continuity response could be addressed with better planning?

      People

      • Alternates are not identified
      • Roles in a disaster are not formalized
      • No internal/external crisis comm. strategy

      Site & Facilities

      • No alternate place of business or command center identified
      • No formal planning or exercises to test alternate site viability

      • Identify a viable secondary site and/or work-from-home plan, and develop a schedule for testing activities. Review in Step 3.3 of the Develop a Business Continuity Plan blueprint.

      External Services & Suppliers

      • Contingency plans for a disruption not planned or formalized
      • No formal review of service-level agreements (SLAs)

      • Contact key suppliers and vendors to establish SLAs, and ensure they meet requirements.
      • Review supplier continuity plans.

      Technology & Physical Assets

      • No secondary site or redundancy for critical IT systems
      • No documented end-to-end IT DR plan

      Tool: BCP Project Roadmap

      Prioritize and visualize BCP projects to present options to decision makers.

      Not all BCP projects can be tackled at once. Enable decision makers to defer, rather than outright reject, projects that aren’t feasible at this time.

      1. Configure the tool in Tab 1. Setup. Adjust criteria and definitions for criteria. Note that shaded columns are required for reporting purposes and can’t be modified.
      2. Add projects and action items in Tab 2. Data Entry. Fields highlighted in red are all required for the dashboard to populate. All other fields are optional but will provide opportunities to track more detailed data on project ideas.
      3. To generate the dashboard in Tab 3. Roadmap, open the Data ribbon and under Queries and Connections click Refresh All. You can now use the slicers on the right of the sheet.

      Download Info-Tech’s BCP Project Roadmap Tool

      Demonstrate BCP project impacts

      Illustrate the benefits of proposed projects.

      1. Review your recovery workflow.
      2. Make updates to a second copy of the high-level outline to illustrate how the business response to a disaster scenario will change once proposed projects are complete.
      • Remove steps that have been made unnecessary.
      • Remove any risks or gaps that have been mitigated or addressed.
      • Verify that proposed projects close gaps between acceptable and achievable recovery capabilities in the BIA tool.
    • The visual impact of a shorter, less-risky recovery workflow can help communicate the benefits of proposed projects to decision makers.
    • Step 3.3

      Evaluate business continuity site and command center options

      This step will walk you through the following activities:

      • Take a deep dive on the requirements for working from an alternate location.
      • Assess different options for an alternate location.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Identify requirements for an alternate business site.

      Tool: Relocation Checklists

      An alternate site could be another company building, a dedicated emergency operations center, or work-from-home. Use this tool to guide and prepare for any relocation exercise.

      • Coordinate your response with the pre-populated checklists in Tabs 1 & 2, identify who’s responsible for items on the checklists, and update your recovery workflows to reflect new steps. When reviewing the checklist, consider what can be done to prepare ahead of a crisis.
        • For example, you may wish to create crisis communication templates to streamline crisis communications during a disaster.
      • Calculate the effort required to provision equipment for relocated users in Tabs 3 & 4.
      • Evaluate your options for alternate sites with the requirements matrix in Tab 5. Use your evaluation to identify how the organization could address shortcomings of viable options either ahead of time or at the time of an incident.

      Download Info-Tech’s BCP Relocation Checklists

      Create a checklist of requirements for an alternate site

      Leverage the roll-up view, in tab 3, of dependencies required to create a list of requirements for an alternate site in tab 4.

      1. The table on Tab 5 of the relocation checklists is pre-populated with some common requirements. Modify or replace requirements to suit your needs for an alternate business/office site. Be sure to consider distance, transportation, needed services, accessibility, IT infrastructure, security, and seating capacity at a minimum.
      2. Don’t assume. Verify. Confirm anything that requires permissions from the site owner. What network providers have a presence in the building? Can you access the site 24/7 and conduct training exercises? What facilities and services are available? Are you guaranteed the space if needed?

      "There are horror stories about organizations that assumed things about their alternate site that they later found out they weren’t true in practice." – Dr. Bernard Jones, MBCI CBCP

      Info-Tech Insight

      If you choose a shared location as a BCP site, a regional disaster may put you in competition with other tenants for space.

      Identify a command center

      For command center and alternate worksite selection, remember that most incidents are local and short term. Identify an onsite and an offsite command center.

      1. For events where the building is not compromised, identify an onsite location, ideally with remote conferencing capabilities and planning and collaboration tools (projectors, whiteboards, flipcharts). The onsite location can also be used for BCM and crisis management meetings. Remember, most business continuity events are not regional or massively destructive.
      2. For the offsite command center, select a location that is sufficiently far away from your normal business location to maintain separation from local incidents while minimizing commute time. However, consider a geographically distant option (e.g. more than 50 miles away) identified for those scenarios where it is a regional disaster, or plan to leverage online tools to create a virtual command center (see the Insight box below).
      3. The first members of the Emergency Response Team to be notified of the incident will determine which location to use or whether a third alternative is required.

      Info-Tech Insight

      For many organizations, a dedicated command center (TVs on the wall, maps and charts in filing cabinets) isn’t necessary. A conference bridge and collaboration tools allowing everyone to work remotely can be an acceptable offsite command center as long as digital options can meet your command center requirements.

      Create a plan for a return to normal

      Operating in continuity mode for an extended period of time tends to result in higher costs and reduced business capabilities. It’s important to restore normal operations as soon as possible.

      Advance planning can minimize risks and delays in returning to normal operations.

      Leverage the methodology and tools in this blueprint to define your return to normal (repatriation) procedures:

      1. Repeat the tabletop planning exercise to determine the repatriation steps and potential gaps. How will you return to the primary site from your alternate site? Does data need to be re-entered into core systems if IT services are down? Do you need to transfer job duties back to primary staff?
      2. What needs to be done to address the gaps in the return to normal workflow? Are there projects or action items that could make return to normal easier?

      For more on supporting a business move back to the office from the IT perspective, see Responsibly Resume IT Operations in the Office

      Potential business impacts of ongoing operations at a failover site

      • The cost of leasing alternate business worksites.
      • Inability to deliver on strategic initiatives while in emergency/interim operations mode, resulting in lost business opportunities.
      • A growing backlog of work that falls outside of emergency operations mode.
      • Travel and accommodation costs if the alternate site is geographically remote.
      • Additional vendor licensing and contract costs.

      Phase 4

      Extend the Results of the Pilot BCP and Implement Governance

      Phase 4

      4.1 Consolidate BCP pilot insights to support an overall BCP project plan

      4.2 Outline a business continuity management (BCM) program

      4.3 Test and maintain your BCP

      Insights & Outcomes

      Summarize and consolidate your initial insights and documentation. Create a project plan for overall BCP. Identify teams, responsibilities, and accountabilities, and assign documentation ownership. Integrate BCP findings in DR and crisis management practices. Set guidelines for testing, plan maintenance, training, and awareness.

      Participants

      • BCP Coordinator
      • Pilot Business Unit Manager
      • BCP Executive Sponsor

      Step 4.1

      Consolidate BCP pilot insights to support an overall BCP project plan

      This step will walk you through the following activities:

      • Summarize and consolidate outputs and key insights from the BCP pilot.
      • Identify outputs from the pilot that can be re-used for the overall BCP.
      • Create a project charter for an overall BCP.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • BCP Executive Sponsor

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Present results from the pilot BCP, and outline how you’ll use the pilot process with other business units to create an overall continuity program.

      Structure the overall BCP program.

      Template: BCP Pilot Results Presentation

      Highlight key findings from the BCP pilot to make the case for next steps.

      • Highlight critical gaps or risks identified, any potential process improvements, and progress made toward improving overall BCP maturity through the pilot project. Summarize the benefits of the pilot project for an executive audience.
      • Review process recovery objectives (RTO/RPO). Provide an overview of recovery capabilities (RTA/RPA). Highlight any significant gaps between objectives and capabilities.
      • Propose next steps, including an overall BCP project and program, and projects and action items to remediate gaps and risks.
      • Develop a project plan to estimate resource requirements for an overall BCP project prior to delivering this presentation. Quantifying required time and resources is a key outcome as it enables the remaining business units to properly scope and resource their BCP development activities and can help managers overcome the fear of the unknown.

      Download Info-Tech’s BCP Pilot Results Presentation

      Tool: BCP Summary

      Sum up information from completed BCP documents to create a high-level BCP overview for auditors and executives.

      The BCP Summary document is the capstone to business unit continuity planning exercises. It consolidates your findings in a short overview of your business continuity requirements, capabilities, and maintenance procedures.

      Info-Tech recommends embedding hyperlinks within the Summary to the rest of your BCP documentation to allow the reader to drill down further as needed. Leverage the following documents:

      • Business Impact Analysis
      • BCP Recovery Workflows
      • Business Process Workflows
      • BCP Project Roadmap
      • BCP Relocation Checklists
      • Business Continuity Policy

      Download Info-Tech’s BCP Summary Document

      Reuse templates for additional exercises

      The same methodology described in this blueprint can be repeated for each business unit. Also, many of the artifacts from the BCP pilot can be reused or built upon to give the remaining business units a head start. For example:

      • BCP Pilot Project Charter Template. Make a copy to use as a base for the next business unit’s BCP project charter, and update the stakeholders/roles and milestone dates. The rest of the content can remain the same in most cases.
      • BCP Reference Workbook. This tool contains information common to all business units and can be updated as needed.
      • BCP Business Impact Analysis Tool. You may need to start a separate copy for each business unit to allow enough space to capture all business processes. However, use the same scoring scale to drive consistent assessments. In addition, the scoring completed by the pilot business unit provides an example and benchmark for assessing other business processes.
      • BCP Recovery Workflow. The notification, assessment, and declaration steps can be standardized so remaining business units can focus primarily on recovery after a disaster is declared. Similarly, many of the steps related to alternate sites and IT workarounds will also apply to other business units.
      • BCP Project Roadmap Tool. Many of the projects identified by the pilot business unit will also apply to other business units – update the list as needed.
      • The Business Unit BCP Prioritization Tool, BCP Executive Presentation, and Business Continuity Policy Template do not need to be updated for each business unit.

      Info-Tech Best Practice

      You may need to create some artifacts that are site specific. For example, relocation plans or emergency plans may not be reusable from one site to another. Use your judgement to reuse as much of the templates as you can – similar templates simplify audit, oversight, and plan management.

      Create an Overall BCP Project Charter

      Modify the pilot project charter to encompass the larger BCP project.

      Adjust the pilot charter to answer the following questions:

      • How much time and effort should the rest of the project take, based on findings from the pilot? When do you expect to meet certain milestones? What outputs and outcomes are expected?
      • In what order should additional business units complete their BCP? Who needs to be involved?
      • What projects to address continuity gaps were identified during the pilot? What investments will likely be required?
      • What additional documentation is required? This section and the appendix include templates to document your BCM Policy, Teams & Contacts, your notification procedures, and more.
      • How does this integrate with the other areas of business resilience and continuity (IT disaster recovery planning and crisis management planning)?
      • What additional activities, such as testing, are required?

      Prioritize business units for further BCP activities.

      As with the pilot, choose a business unit, or business units, where BCP will have the greatest impact and where further BCP activities will have the greatest likelihood of success. Prioritize business units that are critical to many areas of the business to get key results sooner.

      Work with one business unit at a time if:

      • Required resources from the business unit are available to focus on BCP full-time over a short period (one to two weeks).
      • More hands-on guidance (less delegation) is needed.
      • The business unit is large or has complex processes.

      Work with several business units at the same time if:

      • Required resources are only available sporadically over a longer period of time.
      • Less guidance (more delegation) is possible.
      • All business units are small and have well-documented processes.

      Download Info-Tech’s Business Unit BCP Prioritization Tool

      Step 4.2

      Outline a Business Continuity Management (BCM) Program

      This step will walk you through the following activities:

      • Identify teams and roles for BCP and business continuity management.
      • Identify individuals to fill key roles.

      This step involves the following participants:

      • BCP Coordinator
      • Executive Sponsor

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Document BCP teams, roles, and responsibilities.

      Document contact information, alternates, and succession rules.

      Outline a Business Continuity Management Program

      A BCM program, also known as a BCM system, helps structure business continuity activities and practices to deliver long-term benefits to your business.

      A BCM program should:

      • Establish who is responsible and accountable for BCP practices, activities, and documentation, and set documentation management practices.
      • Define a process to improve plans. Review and update continuity requirements, suggest enhancements to recovery capabilities, and measure progress and improvements to the plan over time.
      • Coordinate disaster recovery, business continuity, and crisis management planning outputs and practices.
      • Communicate the value of the continuity program to the organization.

      Develop a Business Continuity Management Program

      Phase 4 of this blueprint will focus on the following elements of a business continuity management program:

      • BCM Roles, Responsibilities, and Accountabilities
      • BCM Document Management Practices
      • Integrate BC, IT DR, Crisis Management, and Emergency Management
      • Business Continuity Plan maintenance and testing
      • Training and awareness

      Schedule a call with an Info-Tech Analyst for help building out these core elements, and for advice on developing the rest of your BCM program.

      Create BCM teams

      Include a mix of strong leaders and strong planners on your BC management teams.

      BC management teams (including the secondary teams such as the emergency response team) have two primary roles:

      1. Preparation, Planning, and Governance: Conduct and consolidate business impact analyses. Review, and support the development of recovery workflows, including emergency response plans and business unit recovery workflows. Organize testing and training. Report on the state of the continuity plan.
      2. Leadership During a Crisis: Coordinate and support the execution of business recovery processes. To meet these goals, each team needs a mix of skill sets.

      Crisis leaders require strong crisis management skills:

      • Ability to make quick decisions under pressure with incomplete information.
      • Excellent verbal communication skills.
      • Strong leadership skills. Calm in stressful situations.
      • Team leaders are ideally, but not necessarily, those with the most senior title on each team. It’s more important that the team leader has the appropriate skill set.

      Collectively, the team must include a broad range of expertise as well as strong planning skills:

      • Diverse expertise to be able to plan for and respond to a wide range of potential incidents, from health and safety to reputational damage.
      • Excellent organizational skills and attention to detail.
      • Excellent written communication skills.

      Note: For specific BC team roles and responsibilities, including key resources such as Legal, HR, and IT SMEs required to prepare for and execute crisis management plans, see Implement Crisis Management Best Practices.

      Structure the BCM Team

      Create a hierarchy of teams to govern and coordinate business continuity planning and crisis management.

      BCM Team: Govern business continuity, DR, and crisis management planning. Support the organization’s response to a crisis, including the decision to declare a disaster or emergency.

      Emergency Response Teams: Assist staff and BC teams during a crisis, with a focus first on health and safety. There’s usually one team per location. Develop and maintain emergency response plans.

      Emergency Response Teams: Assist staff and BC teams during a crisis, with a focus first on health and safety. There’s usually one team per location. Develop and maintain emergency response plans.

      IT Disaster Recovery Team: Manage the recovery of IT services and data following an incident. Develop and maintain the IT DRP.

      Business Unit BCP Teams: Coordinate business process recovery at the business unit level. Develop and maintain business unit BCPs.

      “Planning Mode”

      Executive Team → BC Management Team ↓

      • Emergency Response Teams (ERT)
      • Crisis Management Team
      • IT DR Management Team
      • Business Unit BCP Teams

      “Crisis Mode”

      Executive Team ↔Crisis Management Team↓ ↔ Emergency Response Teams (ERT)

      • BC Management Team
      • IT DR Management Team
      • Business Unit BCP Teams

      For more details on specific roles to include on these teams, as well as more information on crisis management, review Info-Tech’s blueprint, Implement Crisis Management Best Practices.

      Tool: BCM Teams, Roles, Contacts, and Vendors

      Track teams, roles, and contacts in this template. It is pre-populated with roles and responsibilities for business continuity, crisis management, IT disaster recovery, emergency response, and vendors and suppliers critical to business operations.

      • Expect overlap across teams. For example, the BC Management Team will include representation from each secondary team to ensure plans are in sync. Similarly, both the Crisis Communication Team and BC Management Team should include a representative from your legal team to ensure legal issues are considered in communications as well as overall crisis management.
      • Clarify spending and decision authority for key members of each team during a crisis.

      Track contact information in this template only if you don’t have a more streamlined way of tracking it elsewhere.

      Download Info-Tech’s Business Continuity Teams and Roles Tool

      Manage key vendors

      Review supplier capabilities and contracts to ensure they meet your requirements.

      Suppliers and vendors might include:

      • Material shipments
      • IT/telecoms service providers
      • Integrators and business process outsourcing providers
      • Independent contractors
      • Utilities (power, water, etc.)

      Supplier RTOs and RPOs should align with the acceptable RTOs and RPOs defined in the BIA. Where they do not, explore options for improvement.

      Confirm the following:

      1. The supplier’s own BC/DR capabilities – how they would recover their own operations in a disaster scenario.
      2. Any continuity services the supplier provides – how they can help you recover your operations in a disaster scenario.
      3. Their existing contractual obligations for service availability (e.g. SLAs).

      Download Info-Tech’s BCP Supplier Evaluation Questionnaire

      Organize your BCMS documentation

      Your BCP isn’t any one document. It’s multiple documents that work together.

      Continue to work through any additional required documentation. Build a repository where master copies of each document will reside and can be updated as required. Assign ownership of document management to someone with an understanding of the process (e.g. the BCP Coordinator).

      Governance Recovery
      BCMS Policy BCP Summary Core BCP Recovery Workflows
      Business Process Workflows Action Items & Project Roadmap BCP Recovery Checklists
      BIA Teams, Roles, Contact Information BCP Business Process Workarounds and Recovery Checklists
      BCP Maturity Scorecard BCP Project Charter Additional Recovery Workflows
      Business Unit Prioritization Tool BCP Presentation

      Info-Tech Best Practice

      Recovery documentation has a different audience, purpose, and lifecycle than governance documentation, and keeping the documents separate can help with content management. Disciplined document management keeps the plan current and accessible.

      Align your IT DRP with your BCP

      Use the following BCP outputs to inform your DRP:

      • Business process technology dependencies. This includes technology not controlled by IT (e.g. cloud-based services).
      • RTOs and RPOs for business processes.
      • Technology projects identified by the business to improve resilience (e.g. improved mobility support).
      PCP Outputs DRP Activities
      Business processes defined Identify critical applications

      Dependencies identified:

      • People
      • Enterprise tech
      • Personal devices
      • Workspace and facilities
      • Services and other inputs

      Identify IT dependencies:

      • Infrastructure
      • Secondary applications

      Recovery objectives defined:

      • BIA and RTOs/RPOs
      • Recovery workflows

      Identify recovery objectives:

      • BIA and RTOs/RPOs
      • IT Recovery workflows

      Projects identified to close gaps:

      • Resourcing changes (e.g. training secondary staff)
      • Process changes (e.g. optimize processes and define interim processes)
      • Technology changes (e.g. improving mobility)

      Identify projects to close gaps:

      • Projects to improve DR capability (e.g. data replication, standby systems).
      • Projects to improve resiliency (e.g. redundant components)

      Info-Tech Insight

      Don’t think of inconsistencies between your DRP and BCP as a problem. Discrepancies between the plans are part of the discovery process, and they’re an opportunity to have a conversation that can improve alignment between IT service capabilities and business needs. You should expect that there will be discrepancies – managing discrepancies is part of the ongoing process to refine and improve both plans.

      Schedule activities to keep BC and DR in sync

      BC/DR Planning Workflow

      1. Collect BCP outputs that impact IT DRP (e.g. technology RTOs/RPOs).

      2. As BCPs are done, BCP Coordinator reviews outputs with IT DRP Management Team.

      3. Use the RTOs/RPOs from the BCPs as a starting point to determine IT recovery plans.

      4. Identify investments required to meet business-defined RTOs/RPOs, and validate with the business.

      5. Create a DR technology roadmap to meet validated RTOs/RPOs.

      6. Review and update business unit BCPs to reflect updated RTOs/RPOs.

      Find and address shadow IT

      Reviewing business processes and dependencies can identify workarounds or shadow IT solutions that weren’t visible to IT and haven’t been included in IT’s DR plan.

      • If you identify technology process dependencies that IT didn’t know about, it can be an opportunity to start a conversation about service support. This can be a “teachable moment” to highlight the risks of adopting and implementing technology solutions without consulting IT.
      • Highlight the possible impact of using technology services that aren’t supported by IT. For example:
        • RTOs and RPOs may not be in line with business requirements.
        • Costs could be higher than supported solutions.
        • Security controls may not be in line with compliance requirements.
        • IT may not be able to offer support when the service breaks or build new features or functionality that might be required in the future.
      • Make sure that if IT is expected to support shadow IT solutions, these systems are included in the IT DRP and that the risks and costs of supporting the non-core solution are clear to all parties and are compared to an alternative, IT-recommended solutions.

      Shadow IT can be a symptom of larger service support issues. There should be a process for requesting and tracking non-standard services from IT with appropriate technical, security, and management oversight.

      Review and reprioritize BC projects to create an overall BC project roadmap

      Assign the BCP Coordinator the task of creating a master list of BC projects, and then work with the BC management team to review and reprioritize this list, as described below:

      1. Build a list of BC projects as you work with each business unit.
        1. Add proposed projects to a master copy of the BCP Project Roadmap Tool
        2. For each subsequent business unit, copy project names, scoring, and timelines into the master roadmap tool.
      2. Work with the Executive Sponsor, the IT BCM representative, and the BCM team to review and reprioritize projects.
        1. In the master BCP Project Roadmap Tool, review and update project scoring, taking into account the relative importance of each project within the overall list. Rationalize the list (e.g. eliminate duplicate projects).
      3. The project roadmap is a suggested list of projects at this stage. Assign a project sponsor and project manager (from the BC management team or appropriate delegates) to each project to take it through your organization’s normal project scoping and approval process.

      Improving business continuity capabilities is a marathon, not a sprint. Change for the better is still change and introduces risk – massive changes introduce massive risk. Incremental changes help minimize disruption. Use Info-Tech research to deliver organizational change.

      "Developing a BCP can be like solving a Rubik’s Cube. It’s a complex, interdepartmental concern with multiple and sometimes conflicting objectives. When you have one side in place, another gets pushed out of alignment." – Ray Mach, BCP Expert

      Step 4.3

      Test and maintain your BCP

      This step will walk you through the following activities:

      • Create additional documentation to support your business continuity plan.
      • Create a repository for documentation, and assign ownership for BCP documentation.

      This step involves the following participants:

      • BCP Coordinator

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Create a plan to maintain the BCP.

      Iterate on your plan

      Tend your garden, and pull the weeds.

      Mastery comes through practice and iteration. Iterating on and testing your plan will help you keep up to date with business changes, identify plan improvements, and help your organization’s employees develop a mindset of continuity readiness. Maintenance drives continued success; don’t let your plan become stagnant, messy, and unusable.

      Your BCM program should structure BCP reviews and updates by answering the following:

      1. When do we review the plan?
      2. What are the goals of a review?
      3. Who must lead reviews and update BCP documents?
      4. How do we track reviews, tests, and updates?

      Structure plan reviews

      There are more opportunities for improvements than just planned reviews.

      At a minimum, review goals should include:

      1. Identify and document changes to BCP requirements.
      2. Identify and document changes to BCP capabilities.
      3. Identify gaps and risks and ways to remediate risks and close gaps.

      Who leads reviews and updates documents?

      The BCP Coordinator is likely heavily involved in facilitating reviews and updating documentation, at least at first. Look for opportunities to hand off document ownership to the business units over time.

      How do we track reviews, tests, and updates?

      Keep track of your good work by keeping a log of document changes. If you don’t have one, you can use the last tab on the BCP-DRP Maintenance Checklist.

      When do we review the plan?

      1. Scheduled reviews: At a minimum, plan reviews once a year. Plan owners should review the documents, identify needed updates, and notify the coordinator of any changes to their plan.
      2. As-needed reviews: Project launches, major IT upgrades, office openings or moves, organizational restructuring – all of these should trigger a BCP review.
      3. Testing exercises: Schedule controlled exercises to test and improve different aspects of your continuity plan, and ensure that lessons learned become part of plan documentation.
      4. Retrospectives: Take the opportunity to learn from actual continuity events and crises by conducting retrospectives to evaluate your response and brainstorm improvements.

      Conduct a retrospective after major incidents

      Use a retrospective on your COVID-19 response as a starting point. Build on the questions below to guide the conversation.

      • If needed, how did we set up remote work for our users? What worked, and what didn’t?
      • Did we discover any long-term opportunities to improve business processes?
      • Did we use any continuity plans we have documented?
      • Did we effectively prioritize business processes for recovery?
      • Were expectations from our business users in line with our plans?
      • What parts of our plan worked, and where can we improve the plan?
      1. Gather stakeholders and team members
      2. Ask:
        1. What happened?
        2. What did we learn?
        3. What did we do well?
        4. What should we have done differently?
        5. What gaps should we take action to address?
      3. Prepare a plan to take action

      Outcomes and benefits

      • Confirm business priorities.
      • Validate that business recovery solutions and procedures are effective in meeting business requirements (i.e. RTOs and RPOs).
      • Identify gaps in continuity resources, procedures, or documentation, and options to close gaps.
      • Build confidence in the response team and recovery capabilities.

      Tool: Testing and Maintenance Schedule

      Build a light-weight maintenance schedule for your BCP and DRP plans.

      This tool helps you set a schedule for plan update activities, identify document and exercise owners, and log updates for audit and governance purposes.

      • Add the names of your documents and brainstorm update activities.
      • Activities (document updates, testing, etc.) might be scheduled regularly, as-needed, or both. If they happen “as needed,” identify the trigger for the activity.
      • Start tracking past activities and resulting changes in Tab 3. You can also track crises that tested your continuity capabilities on this tab.

      Info-Tech Insight

      Everyone gets busy. If there’s a meeting you can schedule months in advance, schedule it months in advance! Then send reminders closer to the date. As soon as you’re done the pilot BCP, set aside time in everyone’s calendar for your first review session, whether that’s three months, six months, or a year from now.

      Appendix

      Additional BCP Tools and Templates

      Template Library: Business Continuity Policy

      Create a high-level policy to govern BCP and clarify BCP requirements.

      Use this template to:

      • Outline the organizational commitment to BCM.
      • Clarify the mandate to prepare, validate, and maintain continuity plans that align with business requirements.
      • Define specific policy statements that signatories to the policy are expected to uphold.
      • Require key stakeholders to review and sign off on the template.

      Download Info-Tech’s Business Continuity Policy template

      Template Library: Workarounds & Recovery Checklists

      Capture the step-by-step details to execute workarounds and steps in the business recovery process.

      If you require more detail to support your recovery procedures, you can use this template to:

      • Record specific steps or checklists to support specific workarounds or recovery procedures.
      • Identify prerequisites for workarounds or recovery procedures.

      Download Info-Tech’s BCP Process Workarounds & Recovery Checklists Template

      Template Library: Notification, Assessment, Declaration

      Create a procedure that outlines the conditions for assessing a disaster situation and invoking the business continuity plan.

      Use this template to:

      • Guide the process whereby the business is notified of an incident, assesses the situation, and declares a disaster.
      • Set criteria for activating business continuity plans.
      • Review examples of possible events, and suggest options on how the business might proceed or react.

      Download Info-Tech’s BCP Notification, Assessment, and Disaster Declaration Plan template

      Template Library: BCP Recovery Workflow Example

      Review an example of BCP recovery workflows.

      Use this template to:

      • Generate ideas for your own recovery processes.
      • See real examples of recovery processes for warehousing, supply, and distribution operations.
      • Review an example of working BCP documentation.

      Download Info-Tech’s BCP Recovery Workflows Example

      Create a Pandemic Response Plan

      If you’ve been asked to build a pandemic-specific response plan, use your core BCP findings to complete these pandemic planning documents.

      • At the onset of the COVID-19 crisis, IT departments were asked to rapidly ramp up work-from-home capabilities and support other process workarounds.
      • IT managers already knew that obstacles to working from home would go beyond internet speed and needing a laptop. Business input is critical to uncover unexpected obstacles.
      • IT needed to address a range of issues from security risk to increased service desk demand from users who don’t normally work from home.
      • Workarounds to speed the process up had to be balanced with good IT practices and governance (Asset Management, Security, etc.)
      • If you’ve been asked to update your Pandemic Response Plan, use this template and your core BCP deliverables to deliver a set of streamlined documentation that draws on lessons learned from the COVID-19 pandemic.

      Structure HR’s role in the pandemic plan

      Leverage the following materials from Info-Tech’s HR-focused sister company, McLean & Company.

      These HR research resources live on the website of Info-Tech’s sister company, McLean & Company. Contact your Account Manager to gain access to these resources.

      Summary of Accomplishment

      Knowledge Gained

      This blueprint outlined:

      • The streamlined approach to BCP development.
      • A BIA process to identify acceptable, appropriate recovery objectives.
      • Tabletop planning exercises to document and validate business recovery procedures.

      Processes Optimized

      • Business continuity development processes were optimized, from business impact analysis to incident response planning.
      • In addition, pilot business unit processes were identified and clarified to support BCP development, which also provided the opportunity to review and optimize those processes.

      Key Deliverables Completed

      • Core BCP deliverables for the pilot business unit, including a business impact analysis, recovery workflows, and a project roadmap.
      • BCP Executive Presentation to communicate pilot results as well as a summary of the methodology to the executive team.
      • BCP Summary to provide a high-level view of BCP scope, objectives, capabilities, and requirements.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information.

      workshops@infotech.com

      1-888-670-8889

      Research Contributors and Experts

      Dr. Bernard A. Jones, MBCI, CBCP

      Professor and Continuity Consultant Berkeley College

      Dr. Jones is a professor at Berkeley College within the School of Professional Studies teaching courses in Homeland Security and Emergency Management. He is a member of the National Board of Directors for the Association of Continuity Professionals (ACP) as well as the Information & Publications Committee Chair for the Garden State Chapter of the ACP. Dr. Jones earned a doctorate degree in Civil Security Leadership, Management & Policy from New Jersey City University where his research focus was on organizational resilience.

      Kris L. Roberson

      Disaster Recovery Analyst Veterans United Home Loans

      Kris Roberson is the Disaster Recovery Analyst for Veterans United Home Loans, the #1 VA mortgage lender in the US. Kris oversees the development and maintenance of the Veterans United Home Loans DR program and leads the business continuity program. She is responsible for determining the broader strategies for DR testing and continuity planning, as well as the implementation of disaster recovery and business continuity technologies, vendors, and services. Kris holds a Masters of Strategic Leadership with a focus on organizational change management and a Bachelors in Music. She is a member of Infragard, the National Association of Professional Women, and Sigma Alpha Iota, and holds a Project+ certification.

      Trevor Butler

      General Manager of Information Technology City of Lethbridge

      As the General Manager of Information Technology with the City of Lethbridge, Trevor is accountable for providing strategic management and advancement of the city’s information technology and communications systems consistent with the goals and priorities of the corporation while ensuring that corporate risks are appropriately managed. He has 15+ years of progressive IT leadership experience, including 10+ years with public sector organizations. He holds a B.Mgt. and PMP certification along with masters certificates in both Project Management and Business Analysis.

      Robert Miller

      Information Services Director Witt/Kieffer

      Bob Miller is the Information Services Director at Witt/Kieffer. His department provides end-user support for all company-owned devices and software for Oak Brook, the regional offices, home offices, and traveling employees. The department purchases, implements, manages, and monitors the infrastructure, which includes web hosting, networks, wireless solutions, cell phones, servers, and file storage. Bob is also responsible for the firm’s security planning, capacity planning, and business continuity and disaster preparedness planning to ensure that the firm has functional technology to conduct business and continue business growth.

      Related Info-Tech Research

      Create a Right-Sized Disaster Recovery Plan

      Close the gap between your DR capabilities and service continuity requirements.

      Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind

      Go beyond satisfying auditors to drive process improvement, consistent IT operations, and effective knowledge transfer.

      Select the Optimal Disaster Recovery Deployment Model

      Determine which deployment models, including hybrid solutions, best meet your DR requirements.

      Bibliography

      “Business Continuity Planning.” IT Examination HandBook. The Federal Financial Institution Examination Council (FFIEC), February 2015. Web.

      “Business Continuity Plans and Emergency Contact Information.” FINRA, 12 February 2015. Web.

      “COBIT 5: A Business Framework for the Governance and Management of Enterprise IT.” ISACA, n.d. Web.

      Disaster Resource GUIDE. Emergency Lifeline Corporation, n.d. Web.

      “DR Rules & Regulations.” Disaster Recovery Journal, March 2017. Web.

      “Federal Information Security Management Act (FISMA).” Homeland Security, 2014. Web.

      FEMA. “Planning & Templates.” FEMA, n.d. Web.

      “FINRA-SEC-CFTC Joint Advisory (Regulatory Notice 13-25).” FINRA, August 2013. Web.

      Gosling, Mel and Andrew Hiles. “Business Continuity Statistics: Where Myth Meets Fact.” Continuity Central, 24 April 2009. Web.

      Hanwacker, Linda. “COOP Templates for Success Workbook.” The LSH Group, 2016. Web.

      Potter, Patrick. “BCM Regulatory Alphabet Soup – Part Two.” RSA Link, 28 August 2012. Web.

      The Good Practice Guidelines. Business Continuity Institute, 2013. Web.

      Wang, Dashun and James A. Evans. “When Small Teams are Better than Big Ones.” Harvard Business Review, 21 February 2019. Web.

      Standardize the Service Desk

      • Buy Link or Shortcode: {j2store}477|cart{/j2store}
      • member rating overall impact: 9.5/10 Overall Impact
      • member rating average dollars saved: $24,155 Average $ Saved
      • member rating average days saved: 24 Average Days Saved
      • Parent Category Name: Service Desk
      • Parent Category Link: /service-desk
      • Not everyone embraces their role in service support. Specialists would rather work on projects than provide service support.
      • The Service Desk lacks processes and workflows to provide consistent service. Service desk managers struggle to set and meet service-level expectations, which further compromises end-user satisfaction.

      Our Advice

      Critical Insight

      • Service desk improvement is an exercise in organizational change. Engage specialists across the IT organization in building the solution. Establish a single service-support team across the IT group and enforce it with a cooperative, customer-focused culture.
      • Don’t be fooled by a tool that’s new. A new service desk tool alone won’t solve the problem. Service desk maturity improvements depend on putting in place the right people and processes to support the technology.

      Impact and Result

      • Create a consistent customer service experience for service desk patrons, and increase efficiency, first-call resolution, and end-user satisfaction with the Service Desk.
      • Decrease time and cost to resolve service desk tickets.
      • Understand and address reporting needs to address root causes and measure success and build a solid foundation for future IT service improvements.

      Standardize the Service Desk Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Standardize the Service Desk Research – A step-by-step document that helps you improve customer service by driving consistency in your support approach and meet SLAs.

      Use this blueprint to standardize your service desk by assessing your current capability and laying the foundations for your service desk, design an effective incident management workflow, design a request fulfillment process, and apply the discussions and activities to make an actionable plan for improving your service desk.

      • Standardize the Service Desk – Phases 1-4

      2. Service Desk Maturity Assessment – An assessment tool to help guide process improvement efforts and track progress.

      This tool is designed to assess your service desk process maturity, identify gaps, guide improvement efforts, and measure your progress.

      • Service Desk Maturity Assessment

      3. Service Desk Project Summary – A template to help you organize process improvement initiatives using examples.

      Use this template to organize information about the service desk challenges that the organization is facing, make the case to build a right-sized service desk to address those challenges, and outline the recommended process changes.

      • Service Desk Project Summary

      4. Service Desk Roles and Responsibilities Guide – An analysis tool to determine the right roles and build ownership.

      Use the RACI template to determine roles for your service desk initiatives and to build ownership around them. Use the template and replace it with your organization's information.

      • Service Desk Roles and Responsibilities Guide

      5. Incident Management and Service Desk Standard Operating Procedure – A template designed to help service managers kick-start the standardization of service desk processes.

      The template will help you identify service desk roles and responsibilities, build ticket management processes, put in place sustainable knowledgebase practices, document ticket prioritization scheme and SLO, and document ticket workflows.

      • Incident Management and Service Desk SOP

      6. Ticket and Call Quality Assessment Tool – An assessment tool to check in on ticket and call quality quarterly and improve the quality of service desk data.

      Use this tool to help review the quality of tickets handled by agents and discuss each technician's technical capabilities to handle tickets.

      • Ticket and Call Quality Assessment Tool

      7. Workflow Library – A repository of typical workflows.

      The Workflow Library provides examples of typical workflows that make up the bulk of the incident management and request fulfillment processes at the service desk.

      • Incident Management and Service Desk Workflows (Visio)
      • Incident Management and Service Desk Workflows (PDF)

      8. Service Desk Ticket Categorization Schemes – A repository of ticket categories.

      The Ticket Categorization Schemes provide examples of ticket categories to organize the data in the service desk tool and produce reports that help managers manage the service desk and meet business requirements.

      • Service Desk Ticket Categorization Schemes

      9. Knowledge Manager – A job description template that includes a detailed explication of the responsibilities and expectations of a Knowledge Manager role.

      The Knowledge Manager's role is to collect, synthesize, organize, and manage corporate information in support of business units across the enterprise.

      • Knowledge Manager

      10. Knowledgebase Article Template – A comprehensive record of the incident management process.

      An accurate and comprehensive record of the incident management process, including a description of the incident, any workarounds identified, the root cause (if available), and the profile of the incident's source, will improve incident resolution time.

      • Knowledgebase Article Template

      11. Sample Communication Plan – A sample template to guide your communications around the integration and implementation of your overall service desk improvement initiatives.

      Use this template to develop a communication plan that outlines what stakeholders can expect as the process improvements recommended in the Standardize the Service Desk blueprint are implemented.

      • Sample Communication Plan

      12. Service Desk Roadmap – A structured roadmap tool to help build your service desk initiatives timeline.

      The Service Desk Roadmap helps track outstanding implementation activities from your service desk standardization project. Use the roadmap tool to define service desk project tasks, their owners, priorities, and timeline.

      • Service Desk Roadmap
      [infographic]

      Workshop: Standardize the Service Desk

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Lay Service Desk Foundations

      The Purpose

      Discover your challenges and understand what roles, metrics, and ticket handling procedures are needed to tackle the challenges.

      Key Benefits Achieved

      Set a clear understanding about the importance of service desk to your organization and service desk best practices.

      Activities

      1.1 Assess current state of the service desk.

      1.2 Review service desk and shift-left strategy.

      1.3 Identify service desk metrics and reports.

      1.4 Identify ticket handling procedures

      Outputs

      Current state assessment

      Shift-left strategy and implications

      Service desk metrics and reports

      Ticket handling procedures

      2 Design Incident Management

      The Purpose

      Build workflows for incident and critical incident tickets.

      Key Benefits Achieved

      Distinguish incidents from service requests.

      Ticket categorization facilitates ticket. routing and reporting.

      Develop an SLA for your service desk team for a consistent service delivery.

      Activities

      2.1 Build incident and critical incident management workflows.

      2.2 Design ticket categorization scheme and proper ticket handling guidelines.

      2.3 Design incident escalation and prioritization guidelines.

      Outputs

      Incident and critical incident management workflows

      Ticket categorization scheme

      Ticket escalation and prioritization guidelines

      3 Design Request Fulfilment

      The Purpose

      Build service request workflows and prepare self-service portal.

      Key Benefits Achieved

      Standardize request fulfilment processes.

      Prepare for better knowledge management and leverage self-service portal to facilitate shift-left strategy.

      Activities

      3.1 Build service request workflows.

      3.2 Build a targeted knowledgebase.

      3.3 Prepare for a self-serve portal project.

      Outputs

      Distinguishing criteria for requests and projects

      Service request workflows and SLAs

      Knowledgebase article template, processes, and workflows

      4 Build Project Implementation Plan

      The Purpose

      Now that you have laid the foundation of your service desk, put all the initiatives into an action plan.

      Key Benefits Achieved

      Discuss priorities, set timeline, and identify effort for your service desk.

      Identify the benefits and impacts of communicating service desk initiatives to stakeholders and define channels to communicate service desk changes.

      Activities

      4.1 Build an implementation roadmap.

      4.2 Build a communication plan

      Outputs

      Project implementation and task list with associated owners

      Project communication plan and workshop summary presentation

      Further reading

      Analyst Perspective

      "Customer service issues are rarely based on personality but are almost always a symptom of poor and inconsistent process. When service desk managers are looking to hire to resolve customer service issues and executives are pushing back, it’s time to look at improving process and the support strategy to make the best use of technicians’ time, tools, and knowledge sharing. Once improvements have been made, it’s easier to make the case to add people or introduce automation.

      Replacing service desk solutions will also highlight issues around poor process. Without fixing the baseline services, the new solution will simply wrap your issues in a prettier package.

      Ultimately, the service desk needs to be the entry point for users to get help and the rest of IT needs to provide the appropriate support to ensure the first line of interaction has the knowledge and tools they need to resolve quickly and preferably on first contact. If your plans include optimization to self-serve or automation, you’ll have a hard time getting there without standardizing first."

      Sandi Conrad

      Principal Research Director, Infrastructure & Operations Practice

      Info-Tech Research Group

      A method for getting your service desk out of firefighter mode

      This Research Is Designed For:

      • The CIO and senior IT management who need to increase service desk effectiveness and timeliness and improve end-user satisfaction.
      • The service desk manager who wants to lead the team from firefighting mode to providing consistent and proactive support.

      This Research Will Also Assist:

      • Service desk teams who want to increase their own effectiveness and move from a help desk to a service desk.
      • Infrastructure and applications managers who want to decrease reactive support activities and increase strategic project productivity by shifting repetitive and low-value work left.

      This Research Will Help You:

      • Create a consistent customer service experience for service desk patrons.
      • Increase efficiency, first-call resolution, and end-user satisfaction with the Service Desk.
      • Decrease time and cost to resolve service desk tickets.
      • Understand and address reporting needs to address root causes and measure success.
      • Build a solid foundation for future IT service improvements.

      Executive Summary

      Situation

      • The CIO and senior IT management who need to increase service desk effectiveness and timeliness and improve end-user satisfaction.
      • If only the phone could stop ringing, the Service Desk could become proactive, address service levels, and improve end-user IT satisfaction.

      Complication

      • Not everyone embraces their role in service support. Specialists would rather work on projects than provide service support.
      • The Service Desk lacks processes and workflows to provide consistent service. Service desk managers struggle to set and meet service-level expectations, which further compromises end-user satisfaction.

      Resolution

      • Go beyond the blind adoption of best-practice frameworks. No simple formula exists for improving service desk maturity. Use diagnostic tools to assess the current state of the Service Desk. Identify service support challenges and draw on best-practice frameworks intelligently to build a structured response to those challenges.
      • An effective service desk must be built on the right foundations. Understand how:
        • Service desk structure affects cost and ticket volume capacity.
        • Incident management workflows can improve ticket handling, prioritization, and escalation.
        • Request fulfillment processes create opportunities for streamlining and automating services.
        • Knowledge sharing supports the processes and workflows essential to effective service support.

      Info-Tech Insight

      Service desk improvement is an exercise in organizational change. Engage specialists across the IT organization in building the solution. Establish a single service-support team across the IT group and enforce it with a cooperative, customer-focused culture. Don’t be fooled by a tool that’s new. A new service desk tool alone won’t solve the problem. Service desk maturity improvements depend on putting in place the right people and processes to support the technology

      Directors and executives understand the importance of the service desk and believe IT can do better

      A double bar graph is depicted. The blue bars represent Effectiveness and the green bars represent Importance in terms of service desk at different seniority levels, which include frontline, manager, director, and executive.

      Source: Info-Tech, 2019 Responses (N=189 organizations)

      Service Desk Importance Scores

        No Importance: 1.0-6.9
        Limited Importance: 7.0-7.9
        Significant Importance: 8.0-8.9
        Critical Importance: 9.0-10.0

      Service Desk Effectiveness Scores

        Not in Place: N/A
        Not Effective: 0.0-4.9
        Somewhat Ineffective: 5.0-5.9
        Somewhat Effective: 6.0-6.9
        Very Effective: 7.0-10.0

      Info-Tech Research Group’s IT Management and Governance Diagnostic (MGD) program assesses the importance and effectiveness of core IT processes. Since its inception, the MGD has consistently identified the service desk as an area to leverage.

      Business stakeholders consistently rank the service desk as one of the top five most important services that IT provides

      Since 2013, Info-Tech has surveyed over 40,000 business stakeholders as part of our CIO Business Vision program.

      Business stakeholders ranked the following 12 core IT services in terms of importance:

      Learn more about the CIO Business Vision Program.
      *Note: IT Security was added to CIO Business Vision 2.0 in 2019

      Top IT Services for Business Stakeholders

      1. Network Infrastructure
      2. IT Security*
      3. Data Quality
      4. Service Desk
      5. Business Applications
      6. Devices
      7. Client-Facing Technology
      8. Analytical Capability
      9. IT Innovation Leadership
      10. Projects
      11. Work Orders
      12. IT Policies
      13. Requirements Gathering
      Source: Info-Tech Research Group, 2019 (N=224 organizations)

      Having an effective and timely service desk correlates with higher end-user satisfaction with all other IT services

      A double bar graph is depicted. The blue bar represents dissatisfied ender user, and the green bar represents satisfied end user. The bars show the average of dissatisfied and satisfied end users for service desk effectiveness and service desk timeliness.

      On average, organizations that were satisfied with service desk effectiveness rated all other IT processes 46% higher than dissatisfied end users.

      Organizations that were satisfied with service desk timeliness rated all other IT processes 37% higher than dissatisfied end users.
      “Satisfied” organizations had average scores =8.“Dissatisfied" organizations had average scores “Dissatisfied" organizations had average scores =6. Source: Info-Tech Research Group, 2019 (N=18,500+ respondents from 75 organizations)

      Standardize the service desk the Info-Tech way to get measurable results

      More than one hundred organizations engaged with Info-Tech, through advisory calls and workshops, for their service desk projects in 2016. Their goal was either to improve an existing service desk or build one from scratch.

      Organizations that estimate the business impact of each project phase help us shed light on the average measured value of the engagements.

      "The analysts are an amazing resource for this project. Their approach is very methodical, and they have the ability to fill in the big picture with detailed, actionable steps. There is a real opportunity for us to get off the treadmill and make real IT service management improvements"

      - Rod Gula, IT Director

      American Realty Advisors

      Three circles are depicted. The top circle shows the sum of measured value dollar impact which is US$1,659,493.37. The middle circle shows the average measured value dollar impact which is US$19,755.87. The bottom circle shows the average measured value time saved which is 27 days.

      Info-Tech’s approach to service desk standardization focuses on building service management essentials

      This image depicts all of the phases and steps in this blueprint.

      Info-Tech draws on the COBIT framework, which focuses on consistent delivery of IT services across the organization

      This image depicts research that can be used to improve IT processes. Service Desk is circled to demonstrate which research is being used.

      The service desk is the foundation of all other service management processes.

      The image shows how the service desk is a foundation for other service management processes.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Standardize the Service Desk – project overview

      This image shows the project overview of this blueprint.

      Info-Tech delivers: Use our tools and templates to accelerate your project to completion

      Project Summary

      Image of template.

      Service Desk Standard Operating Procedures

      Image of tool.

      Service Desk Maturity Assessment Tool

      Image of tool.

      Service Desk Implementation Roadmap

      Image of tool Incident, knowledge, and request management workflows

      Incident, knowledge, and request management workflows

      The project’s key deliverable is a service desk standard operating procedure

      Benefits of documented SOPs:

      Improved training and knowledge transfer: Routine tasks can be delegated to junior staff (freeing senior staff to work on higher priority tasks).

      IT automation, process optimization, and consistent operations: Defining, documenting, and then optimizing processes enables IT automation to be built on sound processes, so consistent positive results can be achieved.

      Compliance: Compliance audits are more manageable because the documentation is already in place.

      Transparency: Visually documented processes answer the common business question of “why does that take so long?”

      Cost savings: Work solved at first contact or with a minimal number of escalations will result in greater efficiency and more cost-effective support. This will also lead to better customer service.

      Impact of undocumented/undefined SOPs:

      Tasks will be difficult to delegate, key staff become a bottleneck, knowledge transfer is inconsistent, and there is a longer onboarding process for new staff

      IT automation built on poorly defined, unoptimized processes leads to inconsistent results.

      Documenting SOPs to prepare for an audit becomes a major time-intensive project.

      Other areas of the organization may not understand how IT operates, which can lead to confusion and unrealistic expectations.

      Support costs are highest through inefficient processes, and proactive work becomes more difficult to schedule, making the organization vulnerable to costly disruptions.

      Workshop Overview

      Image depicts workshop overview occurring over four days.

      Contact your account representative or email Workshops@InfoTech.com for more information.

      Phase 1

      Lay Service Desk Foundations

      Step 1.1:Assess current state

      Image shows the steps in phase 1. Highlight is on step 1.1

      This step will walk you through the following activities:

      • 1.1.1 Outline service desk challenges
      • 1.1.2 Assess the service desk maturity

      This step involves the following participants:

      • Project Sponsor
      • IT Director, CIO
      • IT Managers and Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      Alignment on the challenges that the service desk faces, an assessment of the current state of service desk processes and technologies, and baseline metrics against which to measure improvements.

      Deliverables

      • Service Desk Maturity Assessment

      Standardizing the service desk benefits the whole business

      The image depicts 3 circles to represent the service desk foundations.

      Embrace standardization

      • Standardization prevents wasted energy on reinventing solutions to recurring issues.
      • Standardized processes are scalable so that process maturity increases with the size of your organization.

      Increase business satisfaction

      • Improve confidence that the service desk can meet service levels.
      • Create a single point of contact for incidents and requests and escalate quickly.
      • Analyze trends to forecast and meet shifting business requirements.

      Reduce recurring issues

      • Create tickets for every task and categorize them accurately.
      • Generate reliable data to support root-cause analysis.

      Increase efficiency and lower operating costs

      • Empower end users and technicians with a targeted knowledgebase (KB).
      • Cross-train to improve service consistency.

      Case Study: The CIO of Westminster College took stock of existing processes before moving to empower the “helpless desk”

      Scott Lowe helped a small staff of eight IT professionals formalize service desk processes and increase the amount of time available for projects.

      When he joined Westminster College as CIO in 2006, the department faced several infrastructure challenges, including:

      • An unreliable network
      • Aging server replacements and no replacement plan
      • IT was the “department of no”
      • A help desk known as the “helpless desk”
      • A lack of wireless connectivity
      • Internet connection speed that was much too slow

      As the CIO investigated how to address the infrastructure challenges, he realized people cared deeply about how IT spent its time.

      The project load of IT staff increased, with new projects coming in every day.

      With a long project list, it became increasingly important to improve the transparency of project request and prioritization.

      Some weeks, staff spent 80% of their time working on projects. Other weeks, support requirements might leave only 10% for project work.

      He addressed the infrastructure challenges in part by analyzing IT’s routine processes.

      Internally, IT had inefficient support processes that reduced the amount of time they could spend on projects.

      They undertook an internal process analysis effort to identify processes that would have a return on investment if they were improved. The goal was to reduce operational support time so that project time could be increased.

      Five years later, they had a better understanding of the organization's operational support time needs and were able to shift workloads to accommodate projects without compromising support.

      Common challenges experienced by service desk teams

      Unresolved issues

      • Tickets are not created for all incidents.
      • Tickets are lost or escalated to the wrong technicians.
      • Poor data impedes root-cause analysis of incidents.

      Lost resources/accountability

      • Lack of cross-training and knowledge sharing.
      • Lack of skills coverage for critical applications and services.
      • Time is wasted troubleshooting recurring issues.
      • Reports unavailable due to lack of data and poor categorization.

      High cost to resolve

      • Tier 2/3 resolve issues that should be resolved at tier 1.
      • Tier 2/3 often interrupt projects to focus on service support.

      Poor planning

      • Lack of data for effective trend analysis leads to poor demand planning.
      • Lack of data leads to lost opportunities for templating and automation.

      Low business satisfaction

      • Users are unable to get assistance with IT services quickly.
      • Users go to their favorite technician instead of using the service desk.

      Outline the organization’s service desk challenges

      1.1.1 Brainstorm service desk challenges

      Estimated Time: 45 minutes

      A. As a group, outline the areas where you think the service desk is experiencing challenges or weaknesses. Use sticky notes or a whiteboard to separate the challenges into People, Process, and Technology so you have a wholistic view of the constraints across the department.

      B. Think about the following:

      • What have you heard from users? (e.g. slow response time)
      • What have you heard from executives? (e.g. poor communication)
      • What should you start doing? (e.g. documenting processes)
      • What should you stop doing? (e.g. work that is not being entered as tickets)

      C. Document challenges in the Service Desk Project Summary.

      Participants:

      • CIO
      • IT Managers
      • Service Desk Manager
      • Service Desk Agents

      Assess current service desk maturity to establish a baseline and create a plan for service desk improvement

      A current-state assessment will help you build a foundation for process improvements. Current-state assessments follow a basic formula:

      1. Determine the current state of the service desk.
      2. Determine the desired state of the service desk.
      3. Build a practical path from current to desired state.
      Image depicts 2 circles and a box. The circle on the 1. left has assess current state. The circle on the right has 2. assess target state. The box has 3. build a roadmap.

      Ideally, the current-state assessment should align the delivery of IT services with organizational needs. The assessment should achieve the following goals:

      1. Identify service desk pain points.
      2. Map each pain point to business services.
      3. Assign a broad business value to the resolution of each pain point.
      4. Map each pain point to a process.

      Expert Insight

      Image of expert.

      “How do you know if you aren’t mature enough? Nothing – or everything – is recorded and tracked, customer satisfaction is low, frustration is high, and there are multiple requests and incidents that nobody ever bothers to address.”

      Rob England

      IT Consultant & Commentator

      Owner Two Hills

      Also known as The IT Skeptic

      Assess the process maturity of the service desk to determine which project phase and steps will bring the most value

      1.1.2 Measure which activity will have the greatest impact

      The Service Desk Maturity Assessmenttool helps organizations assess their service desk process maturity and focus the project on the activities that matter most.

      The tool will help guide improvement efforts and measure your progress.

      • The second tab of the tool walks through a qualitative assessment of your service desk practices. Questions will prompt you to evaluate how you are executing key activities. Select the answer in the drop-down menus that most closely aligns with your current state.
      • The third tab displays your rate of process completeness and maturity. You will receive a score for each phase, an overall score, and advice based on your performance.
      • Document the results of the efficiency assessment in the Service Desk Project Summary.

      The tool is intended for periodic use. Review your answers each year and devise initiatives to improve the process performance where you need it most.

      Where do I find the data?

      Consult:

      • Service Manager
      • Service Desk Tools
      Image is the service desk tools.

      Step 1.2:Review service support best practices

      Image shows the steps in phase 1. Highlight is on step 1.2.

      This step will walk you through the following activities:

      1. 1.2.1 Identify roles and responsibilities in your organization
      2. 1.2.2 Map out the current and target structure of the service desk

      This step involves the following participants:

      • Project Sponsor
      • IT Director, CIO
      • IT Managers and Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      Identifying who is accountable for different support practices in the service desk will allow workload to be distributed effectively between functional teams and individuals. Closing the gaps in responsibilities will enable the execution of a shift-left strategy.

      Deliverables

      • Roles & responsibilities guide
      • Service desk structure

      Everyone in IT contributes to the success of service support

      Regardless of the service desk structure chosen to meet an organization’s service support requirements, IT staff should not doubt the role they play in service support.

      If you try to standardize service desk processes without engaging specialists in other parts of the IT organization, you will fail. Everyone in IT has a role to play in providing service support and meeting service-level agreements.

      Service Support Engagement Plan

      • Identify who is accountable for different service support processes.
      • Outline the different responsibilities of service desk agents at tier 1, tier 2, and tier 3 in meeting service-level agreements for service support.
      • Draft operational-level agreements between specialty groups and the service desk to improve accountability.
      • Configure the service desk tool to ensure ticket visibility and ownership across queues.
      • Engage tier 2 and tier 3 resources in building workflows for incident management, request fulfilment, and writing knowledgebase articles.
      • Emphasize the benefits of cooperation across IT silos:
        • Better customer service and end-user satisfaction.
        • Shorter time to resolve incidents and implement requests.
        • A higher tier 1 resolution rate, more efficient escalations, and fewer interruptions from project work.

      Info-Tech Insight

      Specialists tend to distance themselves from service support as they progress through their career to focus on projects.

      However, their cooperation is critical to the success of the new service desk. Not only do they contribute to the knowledgebase, but they also handle escalations from tiers 1 and 2.

      Clear project complications by leveraging roles and responsibilities

      R

      Responsible: This person is the staff member who completes the work. Assign at least one Responsible for each task, but this could be more than one.

      A

      Accountable: This team member delegates a task and is the last person to review deliverables and/or task. Sometimes Responsible and Accountable can be the same staff. Make sure that you always assign only one Accountable for each task and not more.

      C

      Consulted: People who do not carry out the task but need to be consulted. Typically, these people are subject matter experts or stakeholders.

      I

      Informed: People who receive information about process execution and quality and need to stay informed regarding the task.

      A RACI analysis is helpful with the following:

      • Workload Balancing: Allowing responsibilities to be distributed effectively between functional teams and individuals.
      • Change Management: Ensuring key functions and processes are not overlooked during organizational changes.
      • Onboarding: New employees can identify their own roles and responsibilities.

      A RACI chart outlines which positions are Responsible, Accountable, Consulted, and Informed

      Image shows example of RACI chart

      Create a list of roles and responsibilities in your organization

      1.2.1 Create RACI matrix to define responsibilities

      1. Use the Service Desk Roles and Responsibilities Guidefor a better understanding of the roles and responsibilities of different service desk tiers.
      2. In the RACI chart, replace the top row with specific roles in your organization.
      3. Modify or expand the process tasks, as needed, in the left column.
      4. For each role, identify the responsibility values that the person brings to the service desk. Fill out each column.
      5. Document in the Service Desk SOP. Schedule a time to share the results with organization leads.
      6. Distribute the chart between all teams in your organization.

      Notes:

      • Assign one Accountable for each task.
      • Have at least one Responsible for each task.
      • Avoid generic responsibilities, such as “team meetings.”
      • Keep your RACI definitions in your documents, as they are sometimes tough to remember.

      Participants

      • CIO
      • IT Managers
      • Service Desk Manager
      • Service Desk Agents

      What You'll Need

      • Service Desk SOP
      • Roles and Responsibilities Guide
      • Flip Chart
      • Whiteboard

      Build a single point of contact for the service desk

      Regardless of the service desk structure chosen to meet your service support requirements, end users should be in no doubt about how to access the service.

      Provide end users with:

      • A single phone number.
      • A single email address.
      • A single web portal for all incidents and requests.

      A single point of contact will ensure:

      • An agent is available to field incidents and requests.
      • Incidents and requests are prioritized according to impact and urgency.
      • Work is tracked to completion.

      This prevents ad hoc ticket channels such as shoulder grabs or direct emails, chats, or calls to a technician from interrupting work.

      A single point of contact does not mean the service desk is only accessible through one intake channel, but rather all tickets are directed to the service desk (i.e. tier 1) to be resolved or redirected appropriately.

      Image depicts 2 boxes. The smaller box labelled users and the larger box labelled Service Desk Tier 1. There are four double-sided arrows. The top is labelled email, the second is walk-in, the third is phone, the fourth is web portal.

      Directors and executives understand the importance of the service desk and believe IT can do better

      A double bar graph is depicted. The blue bars represent Effectiveness and the green bars represent Importance in terms of service desk at different seniority levels, which include frontline, manager, director, and executive.

      Source: Info-Tech, 2019 Responses (N=189 organizations)

      Service Desk Importance Scores

        No Importance: 1.0-6.9
        Limited Importance: 7.0-7.9
        Significant Importance: 8.0-8.9
        Critical Importance: 9.0-10.0

      Service Desk Effectiveness Scores

        Not in Place: N/A
        Not Effective: 0.0-4.9
        Somewhat Ineffective: 5.0-5.9
        Somewhat Effective: 6.0-6.9
        Very Effective: 7.0-10.0

      Info-Tech Research Group’s IT Management and Governance Diagnostic (MGD) program assesses the importance and effectiveness of core IT processes. Since its inception, the MGD has consistently identified the service desk as an area to leverage.

      Business stakeholders consistently rank the service desk as one of the top five most important services that IT provides

      Since 2013, Info-Tech has surveyed over 40,000 business stakeholders as part of our CIO Business Vision program.

      Business stakeholders ranked the following 12 core IT services in terms of importance:

      Learn more about the CIO Business Vision Program.
      *Note: IT Security was added to CIO Business Vision 2.0 in 2019

      Top IT Services for Business Stakeholders

      1. Network Infrastructure
      2. IT Security*
      3. Data Quality
      4. Service Desk
      5. Business Applications
      6. Devices
      7. Client-Facing Technology
      8. Analytical Capability
      9. IT Innovation Leadership
      10. Projects
      11. Work Orders
      12. IT Policies
      13. Requirements Gathering
      Source: Info-Tech Research Group, 2019 (N=224 organizations)

      Having an effective and timely service desk correlates with higher end-user satisfaction with all other IT services

      A double bar graph is depicted. The blue bar represents dissatisfied ender user, and the green bar represents satisfied end user. The bars show the average of dissatisfied and satisfied end users for service desk effectiveness and service desk timeliness.

      On average, organizations that were satisfied with service desk effectiveness rated all other IT processes 46% higher than dissatisfied end users.

      Organizations that were satisfied with service desk timeliness rated all other IT processes 37% higher than dissatisfied end users.
      “Satisfied” organizations had average scores =8.“Dissatisfied" organizations had average scores “Dissatisfied" organizations had average scores =6. Source: Info-Tech Research Group, 2019 (N=18,500+ respondents from 75 organizations)

      Standardize the service desk the Info-Tech way to get measurable results

      More than one hundred organizations engaged with Info-Tech, through advisory calls and workshops, for their service desk projects in 2016. Their goal was either to improve an existing service desk or build one from scratch.

      Organizations that estimate the business impact of each project phase help us shed light on the average measured value of the engagements.

      "The analysts are an amazing resource for this project. Their approach is very methodical, and they have the ability to fill in the big picture with detailed, actionable steps. There is a real opportunity for us to get off the treadmill and make real IT service management improvements"

      - Rod Gula, IT Director

      American Realty Advisors

      Three circles are depicted. The top circle shows the sum of measured value dollar impact which is US$1,659,493.37. The middle circle shows the average measured value dollar impact which is US$19,755.87. The bottom circle shows the average measured value time saved which is 27 days.

      Info-Tech’s approach to service desk standardization focuses on building service management essentials

      This image depicts all of the phases and steps in this blueprint.

      Info-Tech draws on the COBIT framework, which focuses on consistent delivery of IT services across the organization

      This image depicts research that can be used to improve IT processes. Service Desk is circled to demonstrate which research is being used.

      The service desk is the foundation of all other service management processes.

      The image shows how the service desk is a foundation for other service management processes.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Standardize the Service Desk – project overview

      This image shows the project overview of this blueprint.

      Info-Tech delivers: Use our tools and templates to accelerate your project to completion

      Project Summary

      Image of template.

      Service Desk Standard Operating Procedures

      Image of tool.

      Service Desk Maturity Assessment Tool

      Image of tool.

      Service Desk Implementation Roadmap

      Image of tool Incident, knowledge, and request management workflows

      Incident, knowledge, and request management workflows

      The project’s key deliverable is a service desk standard operating procedure

      Benefits of documented SOPs:

      Improved training and knowledge transfer: Routine tasks can be delegated to junior staff (freeing senior staff to work on higher priority tasks).

      IT automation, process optimization, and consistent operations: Defining, documenting, and then optimizing processes enables IT automation to be built on sound processes, so consistent positive results can be achieved.

      Compliance: Compliance audits are more manageable because the documentation is already in place.

      Transparency: Visually documented processes answer the common business question of “why does that take so long?”

      Cost savings: Work solved at first contact or with a minimal number of escalations will result in greater efficiency and more cost-effective support. This will also lead to better customer service.

      Impact of undocumented/undefined SOPs:

      Tasks will be difficult to delegate, key staff become a bottleneck, knowledge transfer is inconsistent, and there is a longer onboarding process for new staff

      IT automation built on poorly defined, unoptimized processes leads to inconsistent results.

      Documenting SOPs to prepare for an audit becomes a major time-intensive project.

      Other areas of the organization may not understand how IT operates, which can lead to confusion and unrealistic expectations.

      Support costs are highest through inefficient processes, and proactive work becomes more difficult to schedule, making the organization vulnerable to costly disruptions.

      Workshop Overview

      Image depicts workshop overview occurring over four days.

      Contact your account representative or email Workshops@InfoTech.com for more information.

      Phase 1

      Lay Service Desk Foundations

      Step 1.1:Assess current state

      Image shows the steps in phase 1. Highlight is on step 1.1

      This step will walk you through the following activities:

      • 1.1.1 Outline service desk challenges
      • 1.1.2 Assess the service desk maturity

      This step involves the following participants:

      • Project Sponsor
      • IT Director, CIO
      • IT Managers and Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      Alignment on the challenges that the service desk faces, an assessment of the current state of service desk processes and technologies, and baseline metrics against which to measure improvements.

      Deliverables

      • Service Desk Maturity Assessment

      Standardizing the service desk benefits the whole business

      The image depicts 3 circles to represent the service desk foundations.

      Embrace standardization

      • Standardization prevents wasted energy on reinventing solutions to recurring issues.
      • Standardized processes are scalable so that process maturity increases with the size of your organization.

      Increase business satisfaction

      • Improve confidence that the service desk can meet service levels.
      • Create a single point of contact for incidents and requests and escalate quickly.
      • Analyze trends to forecast and meet shifting business requirements.

      Reduce recurring issues

      • Create tickets for every task and categorize them accurately.
      • Generate reliable data to support root-cause analysis.

      Increase efficiency and lower operating costs

      • Empower end users and technicians with a targeted knowledgebase (KB).
      • Cross-train to improve service consistency.

      Case Study: The CIO of Westminster College took stock of existing processes before moving to empower the “helpless desk”

      Scott Lowe helped a small staff of eight IT professionals formalize service desk processes and increase the amount of time available for projects.

      When he joined Westminster College as CIO in 2006, the department faced several infrastructure challenges, including:

      • An unreliable network
      • Aging server replacements and no replacement plan
      • IT was the “department of no”
      • A help desk known as the “helpless desk”
      • A lack of wireless connectivity
      • Internet connection speed that was much too slow

      As the CIO investigated how to address the infrastructure challenges, he realized people cared deeply about how IT spent its time.

      The project load of IT staff increased, with new projects coming in every day.

      With a long project list, it became increasingly important to improve the transparency of project request and prioritization.

      Some weeks, staff spent 80% of their time working on projects. Other weeks, support requirements might leave only 10% for project work.

      He addressed the infrastructure challenges in part by analyzing IT’s routine processes.

      Internally, IT had inefficient support processes that reduced the amount of time they could spend on projects.

      They undertook an internal process analysis effort to identify processes that would have a return on investment if they were improved. The goal was to reduce operational support time so that project time could be increased.

      Five years later, they had a better understanding of the organization's operational support time needs and were able to shift workloads to accommodate projects without compromising support.

      Common challenges experienced by service desk teams

      Unresolved issues

      • Tickets are not created for all incidents.
      • Tickets are lost or escalated to the wrong technicians.
      • Poor data impedes root-cause analysis of incidents.

      Lost resources/accountability

      • Lack of cross-training and knowledge sharing.
      • Lack of skills coverage for critical applications and services.
      • Time is wasted troubleshooting recurring issues.
      • Reports unavailable due to lack of data and poor categorization.

      High cost to resolve

      • Tier 2/3 resolve issues that should be resolved at tier 1.
      • Tier 2/3 often interrupt projects to focus on service support.

      Poor planning

      • Lack of data for effective trend analysis leads to poor demand planning.
      • Lack of data leads to lost opportunities for templating and automation.

      Low business satisfaction

      • Users are unable to get assistance with IT services quickly.
      • Users go to their favorite technician instead of using the service desk.

      Outline the organization’s service desk challenges

      1.1.1 Brainstorm service desk challenges

      Estimated Time: 45 minutes

      A. As a group, outline the areas where you think the service desk is experiencing challenges or weaknesses. Use sticky notes or a whiteboard to separate the challenges into People, Process, and Technology so you have a wholistic view of the constraints across the department.

      B. Think about the following:

      • What have you heard from users? (e.g. slow response time)
      • What have you heard from executives? (e.g. poor communication)
      • What should you start doing? (e.g. documenting processes)
      • What should you stop doing? (e.g. work that is not being entered as tickets)

      C. Document challenges in the Service Desk Project Summary.

      Participants:

      • CIO
      • IT Managers
      • Service Desk Manager
      • Service Desk Agents

      Assess current service desk maturity to establish a baseline and create a plan for service desk improvement

      A current-state assessment will help you build a foundation for process improvements. Current-state assessments follow a basic formula:

      1. Determine the current state of the service desk.
      2. Determine the desired state of the service desk.
      3. Build a practical path from current to desired state.
      Image depicts 2 circles and a box. The circle on the 1. left has assess current state. The circle on the right has 2. assess target state. The box has 3. build a roadmap.

      Ideally, the current-state assessment should align the delivery of IT services with organizational needs. The assessment should achieve the following goals:

      1. Identify service desk pain points.
      2. Map each pain point to business services.
      3. Assign a broad business value to the resolution of each pain point.
      4. Map each pain point to a process.

      Expert Insight

      Image of expert.

      “How do you know if you aren’t mature enough? Nothing – or everything – is recorded and tracked, customer satisfaction is low, frustration is high, and there are multiple requests and incidents that nobody ever bothers to address.”

      Rob England

      IT Consultant & Commentator

      Owner Two Hills

      Also known as The IT Skeptic

      Assess the process maturity of the service desk to determine which project phase and steps will bring the most value

      1.1.2 Measure which activity will have the greatest impact

      The Service Desk Maturity Assessmenttool helps organizations assess their service desk process maturity and focus the project on the activities that matter most.

      The tool will help guide improvement efforts and measure your progress.

      • The second tab of the tool walks through a qualitative assessment of your service desk practices. Questions will prompt you to evaluate how you are executing key activities. Select the answer in the drop-down menus that most closely aligns with your current state.
      • The third tab displays your rate of process completeness and maturity. You will receive a score for each phase, an overall score, and advice based on your performance.
      • Document the results of the efficiency assessment in the Service Desk Project Summary.

      The tool is intended for periodic use. Review your answers each year and devise initiatives to improve the process performance where you need it most.

      Where do I find the data?

      Consult:

      • Service Manager
      • Service Desk Tools
      Image is the service desk tools.

      Step 1.2:Review service support best practices

      Image shows the steps in phase 1. Highlight is on step 1.2.

      This step will walk you through the following activities:

      1. 1.2.1 Identify roles and responsibilities in your organization
      2. 1.2.2 Map out the current and target structure of the service desk

      This step involves the following participants:

      • Project Sponsor
      • IT Director, CIO
      • IT Managers and Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      Identifying who is accountable for different support practices in the service desk will allow workload to be distributed effectively between functional teams and individuals. Closing the gaps in responsibilities will enable the execution of a shift-left strategy.

      Deliverables

      • Roles & responsibilities guide
      • Service desk structure

      Everyone in IT contributes to the success of service support

      Regardless of the service desk structure chosen to meet an organization’s service support requirements, IT staff should not doubt the role they play in service support.

      If you try to standardize service desk processes without engaging specialists in other parts of the IT organization, you will fail. Everyone in IT has a role to play in providing service support and meeting service-level agreements.

      Service Support Engagement Plan

      • Identify who is accountable for different service support processes.
      • Outline the different responsibilities of service desk agents at tier 1, tier 2, and tier 3 in meeting service-level agreements for service support.
      • Draft operational-level agreements between specialty groups and the service desk to improve accountability.
      • Configure the service desk tool to ensure ticket visibility and ownership across queues.
      • Engage tier 2 and tier 3 resources in building workflows for incident management, request fulfilment, and writing knowledgebase articles.
      • Emphasize the benefits of cooperation across IT silos:
        • Better customer service and end-user satisfaction.
        • Shorter time to resolve incidents and implement requests.
        • A higher tier 1 resolution rate, more efficient escalations, and fewer interruptions from project work.

      Info-Tech Insight

      Specialists tend to distance themselves from service support as they progress through their career to focus on projects.

      However, their cooperation is critical to the success of the new service desk. Not only do they contribute to the knowledgebase, but they also handle escalations from tiers 1 and 2.

      Clear project complications by leveraging roles and responsibilities

      R

      Responsible: This person is the staff member who completes the work. Assign at least one Responsible for each task, but this could be more than one.

      A

      Accountable: This team member delegates a task and is the last person to review deliverables and/or task. Sometimes Responsible and Accountable can be the same staff. Make sure that you always assign only one Accountable for each task and not more.

      C

      Consulted: People who do not carry out the task but need to be consulted. Typically, these people are subject matter experts or stakeholders.

      I

      Informed: People who receive information about process execution and quality and need to stay informed regarding the task.

      A RACI analysis is helpful with the following:

      • Workload Balancing: Allowing responsibilities to be distributed effectively between functional teams and individuals.
      • Change Management: Ensuring key functions and processes are not overlooked during organizational changes.
      • Onboarding: New employees can identify their own roles and responsibilities.

      A RACI chart outlines which positions are Responsible, Accountable, Consulted, and Informed

      Image shows example of RACI chart

      Create a list of roles and responsibilities in your organization

      1.2.1 Create RACI matrix to define responsibilities

      1. Use the Service Desk Roles and Responsibilities Guidefor a better understanding of the roles and responsibilities of different service desk tiers.
      2. In the RACI chart, replace the top row with specific roles in your organization.
      3. Modify or expand the process tasks, as needed, in the left column.
      4. For each role, identify the responsibility values that the person brings to the service desk. Fill out each column.
      5. Document in the Service Desk SOP. Schedule a time to share the results with organization leads.
      6. Distribute the chart between all teams in your organization.

      Notes:

      • Assign one Accountable for each task.
      • Have at least one Responsible for each task.
      • Avoid generic responsibilities, such as “team meetings.”
      • Keep your RACI definitions in your documents, as they are sometimes tough to remember.

      Participants

      • CIO
      • IT Managers
      • Service Desk Manager
      • Service Desk Agents

      What You'll Need

      • Service Desk SOP
      • Roles and Responsibilities Guide
      • Flip Chart
      • Whiteboard

      Build a tiered generalist service desk to optimize costs

      A tiered generalist service desk with a first-tier resolution rate greater than 60% has the best operating cost and customer satisfaction of all competing service desk structural models.

      Image depicts a tiered generalist service desk example. It shows a flow from users to tier 1 and to tiers 2 and 3.

      The success of a tiered generalist model depends on standardized, defined processes

      Image lists the processes and benefits of a successful tiered generalist service desk.

      Define the structure of the service desk

      1.2.2 Map out the current and target structure of the service desk

      Estimated Time: 45 minutes

      Instructions:

      1. Using the model from the previous slides as a guide, discuss how closely it matches the current service desk structure.
      2. Map out a similar diagram of your existing service desk structure, intake channels, and escalation paths.
      3. Review the structure and discuss any changes that could be made to improve efficiency. Revise as needed.
      4. Document the outcome in the Service Desk Project Summary.

      Image depicts a tiered generalist service desk example. It shows a flow from users to tier 1 and to tiers 2 and 3.

      Participants

      • CIO
      • IT Managers
      • Service Desk Manager
      • Service Desk Agents

      Use a shift-left strategy to lower service support costs, reduce time to resolve, and improve end-user satisfaction

      Shift-left strategy:

      • Shift service support tasks from specialists to generalists.
      • Implement self-service.
      • Automate incident resolution.
      Image shows the incident and service request resolution in a graph. It includes metrics of cost per ticket, average time to resolve, and end-user satisfaction.

      Work through the implications of adopting a shift-left strategy

      Overview:

      Identify process gaps that you need to fill to support the shift-left strategy and discuss how you could adopt or improve the shift-left strategy, using the discussion questions below as a guide.

      Which process gaps do you need to fill to identify ticket trends?

      • What are your most common incidents and service requests?
      • Which tickets could be resolved at tier 1?
      • Which tickets could be resolved as self-service tickets?
      • Which tickets could be automated?

      Which processes do you most need to improve to support a shift-left strategy?

      • Which incident and request processes are well documented?
      • Do you have recurring tickets that could be automated?
      • What is the state of your knowledgebase maintenance process?
      • Which articles do you most need to support tier 1 resolution?
      • What is the state of your web portal? How could it be improved to support self-service?

      Document in the Project Summary

      Step 1.3: Identify service desk metrics and reports

      Image shows the steps in phase 1. Highlight is on step 1.3.

      This step will walk you through the following activities:

      • 1.3 Create a list of required reports to identify relevant metrics

      This step involves the following participants:

      • Project Sponsor
      • IT Managers and Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      Managers and analysts will have service desk metrics and reports that help set expectations and communicate service desk performance.

      Deliverables

      • A list of service desk performance metrics and reports

      Engage business unit leaders with data to appreciate needs

      Service desk reports are an opportunity to communicate the story of IT and collect stakeholder feedback. Interview business unit leaders and look for opportunities to improve IT services.

      Start with the following questions:

      • What are you hearing from your team about working with IT?
      • What are the issues that are contributing to productivity losses?
      • What are the workarounds your team does because something isn’t working?
      • Are you able to access the information you need?

      Work with business unit leaders to develop an action plan.

      Remember to communicate what you do to address stakeholder grievances.

      The service recovery paradox is a situation in which end users think more highly of IT after the organization has corrected a problem with their service compared to how they would regard the company if the service had not been faulty in the first place.

      The point is that addressing issues (and being seen to address issues) will significantly improve end-user satisfaction. Communicate that you’re listening and acting, and you should see satisfaction improve.

      Info-Tech Insight

      Presentation is everything:

      If you are presenting outside of IT, or using operational metrics to create strategic information, be prepared to:

      • Discuss trends.
      • Identify organizational and departmental impacts.
      • Assess IT costs and productivity.

      For example, “Number of incidents with ERP system has decreased by 5% after our last patch release. We are working on the next set of changes and expect the issues to continue to decrease.”

      Engage technicians to ensure they input quality data in the service desk tool

      You need better data to address problems. Communicate to the technical team what you need from them and how their efforts contribute to the usefulness of reports.

      Tickets MUST:

      • Be created for all incidents and service requests.
      • Be categorized correctly, and categories updated when the ticket is resolved.
      • Be closed after the incidents and service requests are resolved or implemented.

      Emphasize that reports are analyzed regularly and used to manage costs, improve services, and request more resources.

      Info-Tech Insight

      Service Desk Manager: Technical staff can help themselves analyze the backlog and improve service metrics if they’re looking at the right information. Ensure their service desk dashboards are helping them identify high-priority and quick-win tickets and anticipate potential SLA breaches.

      Produce service desk reports targeted to improve IT services

      Use metrics and reports to tell the story of IT.

      Metrics should be tied to business requirements and show how well IT is meeting those requirements and where obstacles exist.

      Tailor metrics and reports to specific stakeholders.

      Technicians require mostly real-time information in the form of a dashboard, providing visibility into a prioritized list of tickets for which they are responsible.

      Supervisors need tactical information to manage the team and set client expectations as well as track and meet strategic goals.

      Managers and executives need summary information that supports strategic goals. Start by looking at executive goals for the support team and then working through some of the more tactical data that will help support those goals.

      One metric doesn’t give you the whole picture

      • Don’t put too much emphasis on a single metric. At best, it will give you a distorted picture of your service desk performance. At worst, it will distort the behavior of your agents as they may adopt poor practices to meet the metric.
      • The solution is to use tension metrics: metrics that work together to give you a better sense of the state of operations.
      • Tension metrics ensure a balanced focus toward shared goals.

      Example:

      First-call resolution (FCR), end-user satisfaction, and number of tickets reopened all work together to give you a complete picture. As FCR goes up, so should end-user satisfaction, as number of tickets re-opened stays steady or declines. If the three metrics are heading in different directions, then you know you have a problem.

      Rely on internal metrics to measure and improve performance

      External metrics provide useful context, but they represent broad generalizations across different industries and organizations of different sizes. Internal metrics measured annually are more reliable.

      Internal metrics provide you with information about your actual performance. With the right continual improvement process, you can improve those metrics year over year, which is a better measure of the performance of your service desk.

      Whether a given metric is the right one for your service desk will depend on several different factors, not the least of which include:

      • The maturity of your service desk processes.
      • Your ticket volume.
      • The complexity of your tickets.
      • The degree to which your end users are comfortable with self-service.

      Info-Tech Insight

      Take external metrics with a grain of salt. Most benchmarks represent what service desks do across different industries, not what they should do. There also might be significant differences between different industries in terms of the kinds of tickets they deal with, differences which the overall average obscures.

      Use key service desk metrics to build a business case for service support improvements

      The right metrics can tell the business how hard IT works and how many resources it needs to perform:

      1. End-User Satisfactions:
        • The most important metric for measuring the perceived value of the service desk. Determine this based on a robust annual satisfaction survey of end users and transactional satisfaction surveys sent with a percentage of tickets.
      2. Ticket Volume and Cost per Ticket:
        • A key indicator of service desk efficiency, computed as the monthly operating expense divided by the average ticket volume per month.
      3. First-Contact Resolution Rate:
        • The biggest driver of end-user satisfaction. Depending on the kind of tickets you deal with, you can measure first-contact, first-tier, or first-day resolution.
      4. Average Time to Resolve (Incident) or Fulfill (Service Requests):
        • An assessment of the service desk's ability to resolve tickets effectively, measuring the time elapsed between the moment the ticket status is set to “open” and the moment it is set to “resolved.”

      Info-Tech Insight

      Metrics should be tied to business requirements. They tell the story of how well IT is meeting those requirements and help identify when obstacles get in the way. The latter can be done by pointing to discrepancies between the internal metrics you expected to reach but didn’t and external metrics you trust.

      Use service desk metrics to track progress toward strategic, operational, and tactical goals

      Image depicts a chart to show the various metrics in terms of strategic goals, tactical goals, and operational goals.

      Cost per ticket and customer satisfaction are the foundation metrics of service support

      Ultimately, everything boils down to cost containment (measured by cost per ticket) and quality of service (measured by customer satisfaction).

      Cost per ticket is a measure of the efficiency of service support:

      • A higher than average cost per ticket is not necessarily a bad thing, particularly if accompanied by higher-than-average quality levels.
      • Conversely, a low cost per ticket is not necessarily good, particularly if the low cost is achieved by sacrificing quality of service.

      Cost per ticket is the total monthly operating expense of the service desk divided by the monthly ticket volume. Operating expense includes the following components:

      • Salaries and benefits for desktop support technicians
      • Salaries and benefits for indirect personnel (team leads, supervisors, workforce schedulers, dispatchers, QA/QC personnel, trainers, and managers)
      • Technology expense (e.g. computers, software licensing fees)
      • Telecommunications expenses
      • Facilities expenses (e.g. office space, utilities, insurance)
      • Travel, training, and office supplies
      Image displays a pie chart that shows the various service desk costs.

      Create a list of required reports to identify metrics to track

      1.3.1 Start by identifying the reports you need, then identify the metrics that produce them

      1. Answer the following questions to determine the data your reports require:
        • What strategic initiatives do you need to track?
          • Example: reducing mean time to resolve, meeting SLAs
        • What operational areas need attention?
          • Example: recurring issues that need a permanent resolution
        • What kind of issues do you want to solve?
          • Example: automate tasks such as password reset or software distribution
        • What decisions or processes are held up due to lack of information?
          • Example: need to build a business case to justify infrastructure upgrades
        • How can the data be used to improve services to the business?
          • Example: recurring issues by department
      2. Document report and metrics requirements in Service Desk SOP.
      3. Provide the list to your tool administrator to create reports with auto-distribution.

      Participants

      • CIO
      • IT Managers
      • Service Desk Manager
      • Service Desk Agents

      What You'll Need

      • Service Desk SOP
      • Flip Chart
      • Whiteboard

      Step 1.4: Review ticket handling procedures

      Image shows the steps in phase 1. Highlight is on step 1.4.

      This step will walk you through the following activities:

      • 1.4.1 Review ticket handling practices
      • 1.4.2 Identify opportunities to automate ticket creation and reduce recurring tickets

      This step involves the following participants:

      • Project Sponsor
      • IT Managers and Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      Managers and analysts will have best practices for ticket handling and troubleshooting to support ITSM data quality and improve first-tier resolution.

      DELIVERABLES

      • List of ticket templates and recurring tickets
      • Ticket and Call QA Template and ticket handling best practices

      Start by reviewing the incident intake process to find opportunities for improvement

      If end users are avoiding your service desk, you may have an intake problem. Create alternative ways for users to seek help to manage the volume; keep in mind not every request is an emergency.

      Image shows the various intake channels and the recommendation.

      Identify opportunities for improvement in your ticket channels

      The two most efficient intake channels should be encouraged for the majority of tickets.

      • Build a self-service portal.
        • Do users know where to find the portal?
        • How many tickets are created through the portal?
        • Is the interface easy to use?
      • Deal efficiently with email.
        • How quickly are messages picked up?
        • Are they manually transferred to a ticket or does the service desk tool automatically create a ticket?

      The two most traditional and fastest methods to get help must deal with emergencies and escalation effectively.

      • Phone should be the fastest way to get help for emergencies.
        • Are enough agents answering calls?
        • Are voicemails picked up on time?
        • Are the automated call routing prompts clear and concise?
      • Are walk-ins permitted and formalized?
        • Do you always have someone at the desk?
        • Is your equipment secure?
        • Are walk-ins common because no one picks up the phone or is the traffic as you’d expect?

      Ensure technicians create tickets for all incidents and requests

      Why Collect Ticket Data?

      If many tickets are missing, help service support staff understand the need to collect the data. Reports will be inaccurate and meaningless if quality data isn’t entered into the ticketing system.

      Image shows example of ticket data

      Set ticket handling expectations to drive a consistent process

      Set expectations:

      • Create and update tickets, but not at the expense of good customer service. Agents can start the ticket but shouldn’t spend five minutes creating the ticket when they should be troubleshooting the problem.
      • Update the ticket when the issue is resolved or needs to be escalated. If agents are escalating, they should make sure all relevant information is passed along to the next technician.
      • Update user of ETA if issue cannot be resolved quickly.
      • Ticket templates for common incidents can lead to fast creation, data input, and categorizations. Templates can reduce the time it takes to create tickets from two minutes to 30 seconds.
      • Update categories to reflect the actual issue and resolution.
      • Reference or link to the knowledgebase article as the documented steps taken to resolve the incident.
      • Validate incident is resolved with client; automate this process with ticket closure after a certain time.
      • Close or resolve the ticket on time.

      Use the Ticket and Call Quality Assessment Tool to improve the quality of service desk data

      Build a process to check-in on ticket and call quality monthly

      Better data leads to better decisions. Use the Ticket and Call Quality Assessment Toolto check-in on the ticket and call quality monthly for each technician and improve service desk data quality.

      1. Fill tab 1 with technician’s name.
      2. Use either tab 2 (auto-scoring) or tab 3 (manual scoring) to score the agent. The assessment includes ticket evaluation, call evaluation, and overall metric.
      3. Record the results of each review in the score summary of tab 1.
      Image shows tool.

      Use ticket templates to make ticket creation, updating, and resolution more efficient

      A screenshot of the Ticket and Call Quality Assessment Tool

      Implement measures to improve ticket handling and identify ticket template candidates

      1.4.1 Identify opportunities to automate ticket creation

      1. Poll the team and discuss.
        • How many members of the team are not creating tickets? Why?
        • How can we address those barriers?
        • What are the expectations of management?
      2. Brainstorm five to ten good candidates for ticket templates.
        • What data can auto-fill?
        • What will help process the ticket faster?
        • What automations can we build to ensure a fast, consistent service?
        • Note:
          • Ticket template name
          • Information that will auto-fill from AD and other applications
          • Categories and resolution codes
          • Automated routing and email responses
      3. Document ticket template candidates in the Service Desk Roadmap to capture the actions.

      Participants

      • Service Desk Manager
      • Service Desk Agents

      What You'll Needs

      • Flip Chart
      • Whiteboard

      Phase 2

      Design Incident Management Processes

      Step 2.1: Build incident management workflows

      Image shows the steps in phase 2. Highlight is on step 2.1.

      This step will walk you through the following activities:

      • 2.1.1 Review incident management challenges
      • 2.1.2 Define the incident management workflow
      • 2.1.3 Define the critical incident management workflow
      • 2.1.4 Design critical incident communication plan

      This step involves the following participants:

      • IT Managers
      • Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      Workflows for incident management and critical incident management will improve the consistency and quality of service delivery and prepare the service desk to negotiate reliable service levels with the organization.

      DELIVERABLES

      • Incident management workflows
      • Critical incident management workflows
      • Critical incident communication plan

      Communicate the great incident resolution work that you do to improve end-user satisfaction

      End users think more highly of IT after the organization has corrected a problem with their service than they would have had the service not been faulty in the first place.

      Image displays a graph to show the service recovery paradox

      Info-Tech Insight

      Use the service recovery paradox to your advantage. Address service desk challenges explicitly, develop incident management processes that get services back online quickly, and communicate the changes.

      If you show that the service desk recovered well from the challenges end users raised, you will get greater loyalty from them.

      Assign incident roles and responsibilities to promote accountability

      The role of an incident coordinator or manager can be assigned to anyone inside the service desk that has a strong knowledge of incident resolution, attention to detail, and knows how to herd cats.

      In organizations with high ticket volumes, a separate role may be necessary.

      Everyone must recognize that incident management is a cross-IT organization process and it does not have to be a unique service desk process.

      An incident coordinator is responsible for:

      • Improving incident management processes.
      • Tracking metrics and producing reports.
      • Developing and maintaining the incident management system.
      • Developing and maintaining critical incident processes.
      • Ensuring the service support team follows the incident management process.
      • Gathering post-mortem information from the various technical resources on root cause for critical or severity 1 incidents.

      The Director of IT Services invested in incident management to improve responsiveness and set end-user expectations

      Practitioner Insight

      Ben Rodrigues developed a progressive plan to create a responsive, service-oriented culture for the service support organization.

      "When I joined the organization, there wasn’t a service desk. People just phoned, emailed, maybe left [sticky] notes for who they thought in IT would resolve it. There wasn’t a lot of investment in developing clear processes. It was ‘Let’s call somebody in IT.’

      I set up the service desk to clarify what we would do for end users and to establish some SLAs.

      I didn’t commit to service levels right away. I needed to see how many resources and what skill sets I would need. I started by drafting some SLA targets and plugging them into our tracking application. I then monitored how we did on certain things and established if we needed other skill sets. Then I communicated those SOPs to the business, so that ‘if you have an issue, this is where you go, and this is how you do it,’ and then shared those KPIs with them.

      I had monthly meetings with different function heads to say, ‘this is what I see your guys calling me about,’ and we worked on something together to make some of the pain disappear."

      -Ben Rodrigues

      Director, IT Services

      Gamma Dynacare

      Sketch out incident management challenges to focus improvements

      Common Incident Management Challenges

      End Users

      • No faith in the service desk beyond speaking with their favorite technician.
      • No expectations for response or resolution time.
      • Non-IT staff are disrupted as people ask their colleagues for IT advice.

      Technicians

      • No one manages and escalates incidents.
      • Incidents are unnecessarily urgent and more likely to have a greater impact.
      • Agents are flooded with requests to do routine tasks during desk visits.
      • Specialist support staff are subject to constant interruptions.
      • Tickets are lost, incomplete, or escalated incorrectly.
      • Incidents are resolved from scratch rather than referring to existing solutions.

      Managers

      • Tickets are incomplete or lack historical information to address complaints.
      • Tickets in system don’t match the perceived workload.
      • Unable to gather data for budgeting or business analysis.

      Info-Tech Insight

      Consistent incident management processes will improve end-user satisfaction with all other IT services.

      However, be prepared to overcome these common obstacles as you put the process in place, including:

      • Absence of management or staff commitment.
      • Lack of clarity on organizational needs.
      • Outdated work practices.
      • Poorly defined service desk goals and responsibilities.
      • Lack of a reliable knowledgebase.
      • Inadequate training.
      • Resistance to change.

      Prepare to implement or improve incident management

      2.1.1 Review incident management challenges and metrics

      1. Review your incident management challenges and the benefits of addressing them.
      2. Review the level of service you are providing with the current resources. Define clear goals and deliverables for the improvement initiative.
      3. Decide how the incident management process will interface with the service desk. Who will take on the responsibility for resolving incidents? Specifically, who will:
        • Log incidents.
        • Perform initial incident troubleshooting.
        • Own and monitor tickets.
        • Communicate with end users.
        • Update records with the resolution.
        • Close incidents.
        • Implement next steps (e.g. initiate problem management).
      4. Document recommendations and the incident management process requirements in the Service Desk SOP.

      Participants

      • Service Desk Manager
      • Service Desk Agents

      What You’ll Need

      • Service Desk SOP
      • Flip Chart
      • Whiteboard

      Distinguish between different kinds of tickets for better SLAs

      Different ticket types are associated with radically different prioritization, routing, and service levels. For instance, most incidents are resolved within a business day, but requests take longer to implement.

      If you fail to distinguish between ticket types, your metrics will obscure service desk performance.

      Common Service Desk Tickets

      • Incidents
        • An unanticipated interruption of a service.
          • The goal of incident management is to restore the service as soon as possible, even if the resolution involves a workaround.
      • Problems
        • The root cause of several incidents.
          • The goal of problem management is to detect the root cause and provide long-term resolution and prevention.
      • Requests
        • A generic description for small changes or service access
          • Requests are small, frequent, and low risk. They are best handled by a process distinct from incident, change, and project management.
      • Changes
        • Modification or removal of anything that could influence IT services.
          • The scope includes significant changes to architectures, processes, tools, metrics, and documentation.

      Info-Tech Insight

      Organizations sometimes mistakenly classify small projects as service requests, which can compromise your data, resulting in a negative impact to the perceived value of the service desk.

      Separate incidents and service requests for increased customer service and better-defined SLAs

      Defining the differences between service requests and incidents is not just for reporting purposes. It also has a major impact on how service is delivered.

      Incidents are unexpected disruptions to normal business processes and require attempts to restore services as soon as possible (e.g. the printer is not working).

      Service requests are tasks that don’t involve something that is broken or has an immediate impact on services. They do not require immediate resolution and can typically be scheduled (e.g. new software).

      Image shows a chart on incidents and service requests.

      Focus on the big picture first to capture and streamline how your organization resolves incidents

      Image displays a flow chart to show how to organize resolving incidents.

      Document your incident management workflow to identify opportunities for improvement

      Image shows a flow cart on how to organize incident management.

      Workflow should include:

      • Ticket creation and closure
      • Triage
      • Troubleshooting
      • Escalations
      • Communications
      • Change management
      • Documentation
      • Vendor escalations

      Notes:

      • Notification and alerts should be used to set or reset expectations on delivery or resolution
      • Identify all the steps where a customer is informed and ensure we are not over or under communicating

      Collaborate to define each step of the incident management workflow

      2.1.2 Define the incident management workflow

      Estimated Time: 60 minutes

      Option 1: Whiteboard

      1. Discuss the workflow and draw it on the whiteboard.
      2. Assess whether you are using the best workflow. Modify it if necessary.
      3. Engage the team in refining the process workflow.
      4. Transfer data to Visio and add to the SOP.

      Option 2: Tabletop Exercise

      1. Distribute index cards to each member of the team.
      2. Have each person write a single task they perform on the index card. Be granular. Include the title or the name of the person responsible.
      3. Mark cards that are decision points. Use a card of a different color or use a marker to make a colored dot.
      4. Arrange the index cards in order, removing duplicates.
      5. Assess whether you are using the best workflow. Engage the team to refine it if necessary.
      6. Transfer data to Visio and add to the Service Desk SOP.

      Participants

      • Service Manager
      • Service Desk Support
      • Applications or Infrastructure Support

      What You’ll Need

      • Flip Chart Paper
      • Sticky Notes
      • Pens
      • Service Desk SOP
      • Project Summary

      Formalize the process for critical incident management to reduce organizational impact

      Discuss these elements to see how the organization will handle them.

      • Communication plan:
        • Who communicates with end users?
        • Who communicates with the executive team?
      • It’s important to separate the role of the technician trying to solve a problem with the need to communicate progress.
      • Change management:
      • Define a separate process for regular and emergency change management to ensure changes are timely and appropriate.
      • Business continuity plan:
      • Identify criteria to decide when a business continuity plan (BCP) must be implemented during a critical incident to minimize the business impact of the incident.
      • Post-mortems:
      • Formalize the process of discussing and documenting lessons learned, understanding outstanding issues, and addressing the root cause of incidents.
      • Source of incident notification:
      • Does the process change if users notify the service desk of an issue or if the systems management tools alert technicians?

      Critical incidents are high-impact, high-urgency events that put the effectiveness and timeliness of the service desk center stage.

      Build a workflow that focuses on quickly bringing together the right people to resolve the incident and reduces the chances of recurrence.

      Document your critical incident management workflow to identify opportunities for improvement

      Image shows a flow cart on how to organize critical incident management.

      Workflow should include:

      • Ticket creation and closure
      • Triage
      • Troubleshooting
      • Escalations
      • Communications plan
      • Change management
      • Disaster recovery or business continuity plan
      • Documentation
      • Vendor escalations
      • Post-mortem

      Collaborate to define each step of the critical incident management workflow

      2.1.3 Define the critical incident management workflow

      Estimated Time: 60 minutes

      Option 1: Whiteboard

      1. Discuss the workflow and draw it on the whiteboard.
      2. Assess whether you are using the best workflow. Modify it if necessary.
      3. Engage the team in refining the process workflow.
      4. Transfer data to Visio and add to the SOP.

      Option 2: Tabletop Exercise

      1. Distribute index cards to each member of the team.
      2. Have each person write a single task they perform on the index card. Be granular. Include the title or the name of the person responsible.
      3. Mark cards that are decision points. Use a card of a different color or use a marker to make a colored dot.
      4. Arrange the index cards in order, removing duplicates.
      5. Assess whether you are using the best workflow. Engage the team to refine it if necessary.
      6. Transfer data to Visio and add to the Service Desk SOP.

      Participants

      • Service Manager
      • Service Desk Support
      • Applications or Infrastructure Support

      What You’ll Need

      • Flip Chart Paper
      • Sticky Notes
      • Pens
      • Service Desk SOP

      Establish a critical incident management communication plan

      When it comes to communicating during major incidents, it’s important to get the information just right. Users don’t want too little, they don’t want too much, they just want what’s relevant to them, and they want that information at the right time.

      As an IT professional, you may not have a background in communications, but it becomes an important part of your job. Broad guidelines for good communication during a critical incident are:

      1. Communicate as broadly as the impact of your incident requires.
      2. Communicate as much detail as a specific audience requires, but no more than necessary.
      3. Communicate as far ahead of impact as possible.

      Why does communication matter?

      Sending the wrong message, at the wrong time, to the wrong stakeholders, can result in:

      • Drop in customer satisfaction.
      • Wasted time and resources from multiple customers contacting you with the same issue.
      • Dissatisfied executives kept in the dark.
      • Increased resolution time if the relevant providers and IT staff are not informed soon enough to help.

      Info-Tech Insight

      End users understand that sometimes things break. What’s important to them is that (1) you don’t repeatedly have the same problem, (2) you keep them informed, and (3) you give them enough notice when their systems will be impacted and when service will be returned.

      Automate communication to save time and deliver consistent messaging to the right stakeholders

      In the middle of resolving a critical incident, the last thing you have time for is worrying about crafting a good message. Create a series of templates to save time by providing automated, tailored messages for each stage of the process that can be quickly altered and sent out to the right stakeholders.

      Once templates are in place, when the incident occurs, it’s simply a matter of:

      1. Choosing the relevant template.
      2. Updating recipients and messaging if necessary.
      3. Adding specific, relevant data and fields.
      4. Sending the message.

      When to communicate?

      Tell users the information they need to know when they need to know it. If a user is directly impacted, tell them that. If the incident does not directly affect the user, the communication may lead to decreased customer satisfaction or failure to pay attention to future relevant messaging.

      What to say?

      • Keep messaging short and to the point.
      • Only say what you know for sure.
      • Provide only the details the audience needs to know to take any necessary action or steps on their side and no more. There’s no need to provide details on the reason for the failure before it’s resolved, though this can be done after resolution and restoration of service.

      You’ll need distinct messages for distinct audiences. For example:

      • To incident resolvers: “Servers X through Y in ABC Location are failing intermittently. Please test the servers and all the connections to determine the exact cause so we can take corrective action ASAP.”
      • To the IT department head: “Servers X through Y in ABC Location are failing intermittently. We are beginning tests. We will let you know when we have determined the exact cause and can give you an estimated completion time.”
      • To executives: “We’re having an issue with some servers at ABC Location. We are testing to determine the cause and will let you know the estimated completion time as soon as possible.”
      • To end users: “We are experience some service issues. We are working on a resolution diligently and will restore service as soon as possible.”

      Map out who will need to be contacted in the event of a critical incident

      2.1.4 Design the critical incident communication plan

      • Identify critical incidents that require communication.
      • Identify stakeholders who will need to be informed about each incident.
      • For each audience, determine:
        1. Frequency of communication
        2. Content of communication
      Use the sample template to the right as an example.

      Some questions to assist you:

      • Whose work will be interrupted, either by their services going down or by their workers having to drop everything to solve the incident?
      • What would happen if we didn’t notify this person?
      • What level of detail do they need?
      • How often would they want to be updated?
      Document outcomes in the Service Desk SOP. Image shows template of unplanned service outage.

      Measure and improve customer satisfaction with the use of relationship and transactional surveys

      Customer experience programs with a combination of relationship and transactional surveys tend to be more effective. Merging the two will give a wholistic picture of the customer experience.

      Relationship Surveys

      Relationship surveys focus on obtaining feedback on the overall customer experience.

      • Inform how well you are doing or where you need improvement in the broad services provided.
      • Provide a high-level perspective on the relationship between the business and IT.
      • Help with strategic improvement decisions.
      • Should be sent over a duration of time and to the entire customer base after they’ve had time to experience all the services provided by the service desk. This can be done as frequently as per quarter or on a yearly basis.
      • E.g. An annual satisfaction survey such as Info-Tech’s End User Satisfaction Diagnostic.

      Transactional Surveys

      Transactional surveys are tied to a specific interaction or transaction your end users have with a specific product or service.

      • Help with tactical improvement decisions.
      • Questions should point to a specific interaction.
      • Usually only a few questions that are quick and easy to complete following the transaction.
      • Since transactional surveys allow you to improve individual relationships, they should be sent shortly after the interaction with the service desk has occurred.
      • E.g. How satisfied are you with the way your ticket was resolved?

      Add transactional end-user surveys at ticket close to escalate unsatisfactory results

      A simple quantitative survey at the closing of a ticket can inform the service desk manager of any issues that were not resolved to the end user’s satisfaction. Take advantage of workflows to escalate poor results immediately for quick follow-up.

      Image shows example of survey question with rating.

      If a more complex survey is required, you may wish to include some of these questions:

      Please rate your overall satisfaction with the way your issue was handled (1=unsatisfactory, 5=fantastic)

      • The professionalism of the analyst.
      • The technical skills or knowledge of the analyst.
      • The timeliness of the service provided.
      • The overall service experience.

      Add an open-ended, qualitative question to put the number in context, and solicit critical feedback:

      What could the service desk have done to improve your experience?

      Define a process to respond to both negative and positive feedback

      Successful customer satisfaction programs respond effectively to both positive and negative outcomes. Late or lack of responses to negative comments may increase customer frustration, while not responding at all to the positive comments may give the perception of indifference. If customers are taking the time to fill out the survey, good or bad, they should be followed up with

      Take these steps to handle survey feedback:

      1. Assign resources to receive, read, and track responses. The entire team doesn’t need to receive every response, while a single resource may not have capacity to respond in a timely manner. Decide what makes the most sense in your environment.
      2. Respond to negative feedback: It may not be possible to respond to every customer that fills out a survey. Set guidelines for responding to negative surveys with no details on the issue; don’t spend time guessing why they were upset, simply ask the user why they were unsatisfied. The critical piece of taking advantage of the service recovery paradox is in the follow-up to the customer.
      3. Investigate and improve: Make sure you investigate the issue to ensure that it is a justified complaint or whether the issue is a symptom of another issue’s root cause. Identify remediation steps to ensure the issue does not repeat itself, and then communicate to the customer the action you have taken to improve.
      4. Act on positive feedback as well: If it’s easy for customers to provide feedback, then make room in your process for handling the positive results. Appreciate the time and effort your customers take to give kudos and use it as a tool to build a long-term relationship with that user. Saying thank you goes a long way and when customers know their time matters, they will be encouraged to fill out those surveys. This is also a good way to show what a great job the service desk team did with the interaction.

      Analyze survey feedback month over month to complement and justify metric results already in place

      When you combine the tracking and analysis of relationship and transactional survey data you will be able to dive into specific issues, identify trends and patterns, assess impact to users, and build a plan to make improvements.

      Once the survey data is centralized, categorized, and available you can start to focus on metrics. At a minimum, for transactional surveys, consider tracking:

      • Breakdown of satisfaction scores with trends over time
      • Unsatisfactory surveys that are related to incidents and service requests
      • Total surveys that have been actioned vs pending

      For relationship surveys, consider tracking:

      • Satisfaction scores by department and seniority level
      • Satisfaction with IT services, applications, and communication
      • Satisfaction with IT’s business enablement

      Scores of overall satisfaction with IT

      Image Source: Info-Tech End User Satisfaction Report

      Prioritize company-wide improvement initiatives by those that have the biggest impact to the entire customer base first and then communicate the plan to the organization using a variety of communication channels that will draw your customers in, e.g. dashboards, newsletters, email alerts.

      Info-Tech Insight

      Consider automating or using your ITSM notification system as a direct communication method to inform the service desk manager of negative survey results.

      Step 2.2: Design ticket categorization

      Image shows the steps in phase 2. Highlight is on step 2.2

      This step will walk you through the following activities:

      • 2.2.1 Assess ticket categorization
      • 2.2.2 Enhance ticket categories with resolution and status codes

      This step involves the following participants:

      • IT Managers
      • Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      The reviewed ticket categorization scheme will be easier to use and deploy more consistently, which will improve the categorization of data and the reliability of reports.

      DELIVERABLES

      • Optimized ticket categorization

      Design a ticket classification scheme to produce useful reports

      Reliable reports depend on an effective categorization scheme.

      Too many options cause confusion; too few options provide little value. As you build the classification scheme over the next few slides, let call routing and reporting requirements be your guide.

      Effective classification schemes are concise, easy to use correctly, and easy to maintain.

      Image shows example of a ticket classification scheme.

      Keep these guidelines in mind:

      • A good categorization scheme is exhaustive and mutually exclusive: there’s a place for every ticket and every ticket fits in only one place.
      • As you build your classification scheme, ensure the categories describe the actual asset or service involved based on final resolution, not how it was reported initially.
      • Pre-populate ticket templates with relevant categories to dramatically improve reporting and routing accuracy.
      • Use a tiered system to make the categories easier to navigate. Three tiers with 6-8 categories per tier provides up to 512 sub-categories, which should be enough for the most ambitious team.
      • Track only what you will use for reporting purposes. If you don’t need a report on individual kinds of laptops, don’t create a category beyond “laptops.”
      • Avoid “miscellaneous” categories. A large portion of your tickets will eventually end up there.

      Info-Tech Insight

      Don’t do it alone! Collaborate with managers in the specialized IT groups responsible for root-cause analysis to develop a categorization scheme that makes sense for them.

      The first approach to categorization breaks down the IT portfolio into asset types

      WHY SHOULD I START WITH ASSETS?

      Start with asset types if asset management and configuration management processes figure prominently in your practice or on your service management implementation roadmap.

      Image displays example of asset types and how to categorize them.

      Building the Categories

      Ask these questions:

      • Type: What kind of asset am I working on?
      • Category: What general asset group am I working on?
      • Subcategory: What particular asset am I working on?

      Need to make quick progress? Use Info-Tech Research Group’s Service Desk Ticket Categorization Schemes template.

      Info-Tech Insight

      Think about how you will use the data to determine which components need to be included in reports. If components won’t be used for reporting, routing, or warranty, reporting down to the component level adds little value.

      The second approach to categorization breaks down the IT portfolio into types of services

      WHY SHOULD I START WITH SERVICES?

      Start with asset services if service management generally figures prominently in your practice, especially service catalog management.

      Image displays example of service types and how to categorize them.

      Building the Categories

      Ask these questions:

      • Type: What kind of service am I working on?
      • Category: What general service group am I working on?
      • Subcategory: What particular service am I working on?

      Need to make quick progress? Use Info-Tech Research Group’s Service Desk Ticket Categorization Schemes template.

      Info-Tech Insight

      Remember, ticket categories are not your only source of reports. Enhance the classification scheme with resolution and status codes for more granular reporting.

      Improve the categorization scheme to enhance routing and reporting

      2.2.1 Assess whether the service desk can improve its ticket categorization

      1. As a group, review existing categories, looking for duplicates and designations that won’t affect ticket routing. Reconcile duplicates and remove non-essential categories.
      2. As a group, re-do the categories, ensuring that the new categorization scheme will meet the reporting requirements outlined earlier.
        • Are categories exhaustive and mutually exclusive?
        • Is the tier simple and easy to use (i.e. 3 tiers x 8 categories)?
      3. Test against recent tickets to ensure you have the right categories.
      4. Record the ticket categorization scheme in the Service Desk Ticket Categorization Schemes template.

      A screenshot of the Service Desk Ticket Categorization Schemes template.

      Participants

      • Service Desk Manager
      • Service Desk Agents

      What You’ll Need

      • Flip Chart
      • Whiteboard
      • Service Desk Ticket Categorization Scheme

      Enhance the classification scheme with resolution and status codes for more granular reporting

      Resolution codes differ from detailed resolution notes.

      • A resolution code is a field within the ticketing system that should be updated at ticket close to categorize the primary way the ticket was resolved.
      • This is important for reporting purposes as it adds another level to the categorization scheme and can help you identify knowledgebase article candidates, training needs, or problems.

      Ticket statuses are a helpful field for both IT and end users to identify the current status of the ticket and to initiate workflows.

      • The most common statuses are open, pending/in progress, resolved, and closed (note the difference between resolved and closed).
      • Waiting on user or waiting on vendor are also helpful statuses to stop the clock when awaiting further information or input.

      Common Examples:

      Resolution Codes

      • How to/training
      • Configuration change
      • Upgrade
      • Installation
      • Data import/export/change
      • Information/research
      • Reboot

      Status Fields

      • Declined
      • Open
      • Closed
      • Waiting on user
      • Waiting on vendor
      • Reopened by user

      Identify and document resolution and status codes

      2.2.2 Enhance ticket categories with resolution codes

      Discuss:

      • How can we use resolution information to enhance reporting?
      • Are current status fields telling the right story?
      • Are there other requirements like project linking?

      Draft:

      1. Write out proposed resolution codes and status fields and critically assess their value.
      2. Resolutions can be further broken down by incident and service request if desired.
      3. Test resolution codes against a few recent tickets.
      4. Record the ticket categorization scheme in the Service Desk SOP.

      Participants

      • CIO
      • Service Desk Manager
      • Service Desk Technician(s)

      What You’ll Need

      • Whiteboard or Flip Chart
      • Markers

      Step 2.3: Design incident escalation and prioritization

      Image shows the steps in phase 2. Highlight is on step 2.3.

      This step will walk you through the following activities:

      • 2.3.1 Build a small number of rules to facilitate prioritization
      • 2.3.2 Define escalation rules
      • 2.3.3 Define automated escalations
      • 2.3.4 Provide guidance to each tier around escalation steps and times

      This step involves the following participants:

      • IT Managers
      • Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      The reviewed ticket escalation and prioritization will streamline queue management, improve the quality of escalations, and ensure agents work on the right tickets at the right time.

      DELIVERABLES

      • Optimized ticket prioritization scheme
      • Guidelines for ticket escalations
      • List of automatic escalations

      Build a ticket prioritization matrix to make escalation assessment less subjective

      Most IT leaders agree that prioritization is one of the most difficult aspects of IT in general. Set priorities based on business needs first.

      Mission-critical systems or problems that affect many people should always come first (i.e. Severity Level 1).

      The bulk of reported problems, however, are often individual problems with desktop PCs (i.e. Severity Level 3 or 4).

      Some questions to consider when deciding on problem severity include:

      • How is productivity affected?
      • How many users are affected?
      • How many systems are affected?
      • How critical are the affected systems to the organization?

      Decide how many severity levels the organization needs the service desk to have. Four levels of severity are ideal for most organizations.

      Image shows example ticket prioritization matrix

      Collect the ticket prioritization scheme in one diagram to ensure service support aligns to business requirements

      Image shows example ticket prioritization matrix

      Prioritize incidents based on severity and urgency to foreground critical issues

      2.3.1 Build a clearly defined priority scheme

      Estimated Time: 60 minutes

      1. Decide how many levels of severity are appropriate for your organization.
      2. Build a prioritization matrix, breaking down priority levels by impact and urgency.
      3. Build out the definitions of impact and urgency to complete the prioritization matrix.
      4. Run through examples of each priority level to make sure everyone is on the same page.

      Image shows example ticket prioritization matrix

      Document in the SOP

      Participants

      • Service Managers
      • Service Desk Support
      • Applications or Infrastructure Support

      What You'll Need

      • Flip Chart Paper
      • Sticky Notes
      • Pens
      • Service Desk SOP

      Example of outcome from 2.3.1

      Define response and resolution targets for each priority level to establish service-level objectives for service support

      Image shows example of response and resolution targets.

      Build clear rules to help agents determine when to escalate

      2.3.2 Assign response, resolution, and escalation times to each priority level

      Estimated Time: 60 minutes

      Instructions:

      For each incident priority level, define the associated:

      1. Response time – time from when incident record is created to the time the service desk acknowledges to the customer that their ticket has been received and assigned.
      2. Resolution time – time from when the incident record is created to the time that the customer has been advised that their problem has been resolved.
      3. Escalation time – maximum amount of time that a ticket should be worked on without progress before being escalated to someone else.

      Participants

      • Service Managers
      • Service Desk Support
      • Applications or Infrastructure Support

      What You'll Need

      • Flip Chart Paper
      • Sticky Notes
      • Pens

      Image shows example of response and resolution targets

      Use the table on the previous slide as a guide.

      Discuss the possible root causes for escalation issues

      WHY IS ESCALATION IMPORTANT?

      Escalation is not about admitting defeat, but about using your resources properly.

      Defining procedures for escalation reduces the amount of time the service desk spends troubleshooting before allocating the incident to a higher service tier. This reduces the mean time to resolve and increases end-user satisfaction.

      You can correlate escalation paths to ticket categories devised in step 2.2.

      Image shows example on potential root causes for escalation issues.

      Build decision rights to help agents determine when to escalate

      2.3.3 Provide guidance to each tier around escalation steps and times

      Estimated Time: 60 minutes

      Instructions

      1. For each support tier, define escalation rules for troubleshooting (steps that each tier should take before escalation).
      2. For each support tier, define maximum escalation times (maximum amount of time to work on a ticket without progress before escalating).
      Example of outcome from step 2.3.3 to determine when to escalate issues.

      Create a list of application specialists to get the escalation right the first time

      2.3.4 Define automated escalations

      Estimated Time: 60 minutes

      1. Identify applications that will require specialists for troubleshooting or access rights.
      2. Identify primary and secondary specialists for each application.
      3. Identify vendors that will receive escalations either immediately or after troubleshooting.
      4. Set up application groups in the service desk tool.
      5. Set up workflows in the service desk tool where appropriate.
      6. Document the automated escalations in the categorization scheme developed in step 2.2 and in the Service Desk Roles and Responsibilities Guide.

      A screenshot of the Service Desk Roles and Responsibilities Guide

      Participants

      • Service Managers
      • Service Desk Support
      • Applications or Infrastructure Support

      What You'll Need

      • Flip Chart Paper
      • Sticky Notes
      • Pens

      Phase 3

      Design Request Fulfilment Processes

      Step 3.1: Build request workflows

      Image shows the steps in phase 3. Highlight is on step 3.1.

      This step will walk you through the following activities:

      • 3.1.1 Distinguish between requests and small projects
      • 3.1.2 Define service requests with SLAs
      • 3.1.3 Build and critique request workflows

      This step involves the following participants:

      • IT Managers
      • Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      Workflows for service requests will improve the consistency and quality of service delivery and prepare the service desk to negotiate reliable service levels with the organization.

      DELIVERABLES

      • Workflows for the most common service requests
      • An estimated service level for each service request
      • Request vs. project criteria

      Standardize service requests for more efficient delivery

      Definitions:

      • An incident is an unexpected disruption to normal business processes and requires attempts to restore service as soon as possible (e.g. printer not working).
      • A service request is a request where nothing is broken or impacting a service and typically can be scheduled rather than requiring immediate resolution (e.g. new software application).
      • Service requests are repeatable, predictable, and easier to commit to SLAs.
      • By committing to SLAs, expectations can be set for users and business units for service fulfillment.
      • Workflows for service requests should be documented and reviewed to ensure consistency of fulfillment.
      • Documentation should be created for service request procedures that are complex.
      • Efficiencies can be created through automation such as with software deployment.
      • All service requests can be communicated through a self-service portal or service catalog.

      PREPARE A FUTURE SERVICE CATALOG

      Standardize requests to develop a consistent offering and prepare for a future service catalog.

      Document service requests to identify time to fulfill and approvals.

      Identify which service requests can be auto-approved and which will require a workflow to gain approval.

      Document workflows and analyze them to identify ways to improve SLAs. If any approvals are interrupting technical processes, rearrange them so that approvals happen before the technical team is involved.

      Determine support levels for each service offering and ensure your team can sustain them.

      Where it makes sense, automate delivery of services such as software deployment.

      Distinguish between service requests and small projects to ensure agents and end users follow the right process

      The distinction between service requests and small projects has two use cases, which are two sides of the same resourcing issue.

      • Service desk managers need to understand the difference to ensure the right approval process is followed. Typically, projects have more stringent intake requirements than requests do.
      • PMOs need to understand the difference to ensure the right people are doing the work and that small, frequent changes are standardized, automated, and taken out of the project list.

      What’s the difference between a service request and a small project?

      • The key differences involve resource scope, frequency, and risk.
      • Requests are likely to require fewer resources than projects, be fulfilled more often, and involve less risk.
      • Requests are typically done by tier 1 and 2 employees throughout the IT organization.
      • A request can turn into a small project if the scope of the request grows beyond the bounds of a normal request.

      Example: A mid-sized organization goes on a hiring blitz and needs to onboard 150 new employees in one quarter. Submitting and scheduling 150 requests for onboarding new employees would require much more time and resources.

      Projects are different from service requests and have different criteria

      A project, by terminology, is a temporary endeavor planned around producing a specific organizational or business outcome.

      Common Characteristics of Projects:

      • Time sensitive, temporary, one-off.
      • Uncertainty around how to create the unique thing, product, or service that is the project’s goal.
      • Non-repetitive work and sizeable enough to introduce heightened risk and complexity.
      • Strategic focus, business case-informed capital funding, and execution activities driven by a charter.
      • Introduces change to the organization.
      • Multiple stakeholders involved and cross-functional resourcing.

      Info-Tech Insight

      Projects require greater risk, effort, and resources than a service request and should be redirected to the PMO.

      Standard service requests vs. non-standard service requests: criteria to make them distinct

      • If there is no differentiation between standard and non-standard requests, those tickets can easily move into the backlog, growing it very quickly.
      • Create a process to easily identify non-standard requests when they enter the ticket queue to ensure customers are made aware of any delay of service, especially if it is a product or service currently not offered. This will give time for any approvals or technical solutioning that may need to occur.
      • Take recurring non-standard requests and make them standard. This is a good way to determine if there are any gaps in services offered and another vehicle to understand what your customers want.

      Standard Requests

      • Very common requests, delivered on an on-going basis
      • Defined process
      • Measured in hours or days
      • Uses service catalog, if it exists
      • Formalized and should already be documented
      • The time to deal with the request is defined

      Non-Standard Requests

      • Higher level complexity than standard requests
      • Cannot be fulfilled via service catalog
      • No defined process
      • Not supplied by questions that Service Request Definition (SRD) offers
      • Product or service is not currently offered, and it may need time for technical review, additional approvals, and procurement processes

      The right questions can help you distinguish between standard requests, non-standard requests, and projects

      Where do we draw the line between a standard and non-standard request and a project?

      The service desk can’t and shouldn’t distinguish between requests and projects on its own. Instead, engage stakeholders to determine where to draw the line.

      Whatever criteria you choose, define them carefully.

      Be pragmatic: there is no single best set of criteria and no single best definition for each criterion. The best criteria and definitions will be the ones that work in your organizational context.

      Common distinguishing factors and thresholds:

      Image shows table of the common distinguishing factors and thresholds.

      Distinguish between standard and non-standard service requests and projects

      3.1.1 Distinguish between service requests and projects

      1. Divide the group into two small teams.
      2. Each team will brainstorm examples of service requests and small projects.
      3. Identify factors and thresholds that distinguish between the two groups of items.
      4. Bring the two groups together and discuss the two sets of criteria.
      5. Consolidate one set of criteria that will help make the distinction between projects and service requests.
      6. Capture the table in the Service Desk SOP.

      Image shows blank template of the common distinguishing factors and thresholds.

      Participants

      • Service Desk Manager
      • Service Desk Agents

      What You'll Need

      • Service Desk SOP
      • Flip Chart
      • Whiteboard

      Distinguishing factors and thresholds

      Don’t standardize request fulfilment processes alone

      Everyone in IT contributes to the fulfilment of requests, but do they know it?

      New service desk managers sometimes try to standardize request fulfilment processes on their own only to encounter either apathy or significant resistance to change.

      Moving to a tiered generalist service desk with a service-oriented culture, a high first-tier generalist resolution rate, and collaborative T2 and T3 specialists can be a big change. It is critical to get the request workflows right.

      Don’t go it alone. Engage a core team of process champions from all service support. With executive support, the right process building exercises can help you overcome resistance to change.

      Consider running the process building activities in this project phase in a working session or a workshop setting.

      Info-Tech Insight

      If they build it, they will come. Service desk improvement is an exercise in organizational change that crosses IT disciplines. Organizations that fail to engage IT specialists from other silos often encounter resistance to change that jeopardizes the process improvements they are trying to make. Overcome resistance by highlighting how process changes will benefit different groups in IT and solicit the feedback of specialists who can affect or be affected by the changes.

      Define standard service requests with SLAs and workflows

      WHY DO I NEED WORKFLOWS?

      Move approvals out of technical IT processes to make them more efficient. Evaluate all service requests to see where auto-approvals make sense. Where approvals are required, use tools and workflows to manage the process.

      Example:

      Image is an example of SLAs and workflows.

      Approvals can be the main roadblock to fulfilling service requests

      Image is example of workflow approvals.

      Review the general standard service request and inquiry fulfillment processes

      As standard service requests should follow standard, repeatable, and predictable steps to fulfill, they can be documented with workflows.

      Image is a flow chart of service and inquiry request processes.

      Review the general standard service request and inquiry fulfillment processes

      Ensure there is a standard and predictable methodology for assessing non-standard requests; inevitably those requests may still cause delay in fulfillment.

      Create a process to ensure reasonable expectations of delivery can be set with the end user and then identify what technology requests should become part of the existing standard offerings.

      Image is a flowchart of non-standard request processes

      Document service requests to ensure consistent delivery and communicate requirements to users

      3.1.2 Define service requests with SLAs

      1. On a flip chart, list standard service requests.
      2. Identify time required to fulfill, including time to schedule resources.
      3. Identify approvals required; determine if approvals can be automated through defining roles.
      4. Discuss opportunities to reduce SLAs or automate, but recognize that this may not happen right away.
      5. Discuss plans to communicate SLAs to the business units, recognizing that some users may take a bit of time to adapt to the new SLAs.
      6. Work toward improving SLAs as new opportunities for process change occur.
      7. Document SLAs in the Service Desk SOP and update as SLAs change.
      8. Build templates in the service desk tool that encapsulate workflows and routing, SLAs, categorization, and resolution.

      Participants

      • Service Desk Managers
      • Service Desk Agents

      What You'll Need

      • Service Desk SOP
      • Flip Chart
      • Whiteboard

      Info-Tech Insight

      These should all be scheduled services. Anything that is requested as a rush needs to be marked as a higher urgency or priority to track end users who need training on the process.

      Analyze service request workflows to improve service delivery

      3.1.3 Build and critique request workflows

      1. Divide the group into small teams.
      2. Each team will choose one service request from the list created in the previous module and then draw the workflow. Include decision points and approvals.
      3. Discuss availability and technical support:
        • Can the service be fulfilled during regular business hours or 24x7?
        • Is technical support and application access available during regular business hours or 24x7?
      4. Reconvene and present workflows to the group.
      5. Document workflows in Visio and add to the Service Desk SOP. Where appropriate, enter workflows in the service desk tool.

      Critique workflows for efficiencies and effectiveness:

      • Do the workflows support the SLAs identified in the previous exercise?
      • Are the workflows efficient?
      • Is the IT staff consistently following the same workflow?
      • Are approvals appropriate? Is there too much bureaucracy or can some approvals be removed? Can they be preapproved?
      • Are approvals interrupting technical processes? If so, can they be moved?

      Participants

      • Service Desk Managers
      • Service Desk Agents

      What You'll Need

      • Service Desk SOP
      • Project Summary
      • Flip Chart
      • Whiteboard

      Step 3.2: Build a targeted knowledgebase

      Image shows the steps in phase 3. Highlight is on step 3.2.

      This step will walk you through the following activities:

      • 3.2.1 Design knowledge management processes
      • 3.2.2 Create actionable knowledgebase articles

      This step involves the following participants:

      • IT Managers
      • Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      The section will introduce service catalogs and get the organization to envision what self-service tools it might include.

      DELIVERABLES

      • Knowledgebase policy and process

      A knowledgebase is an essential tool in the service management toolbox

      Knowledge Management

      Gathering, analyzing, storing & sharing knowledge to reduce the need to rediscover known solutions.

      Knowledgebase

      Organized repository of IT best practices and knowledge gained from practical experiences.

      • End-User KB
      • Give end users a chance to resolve simple issues themselves without submitting a ticket.

      • Internal KB
      • Shared resource for service desk staff and managers to share and use knowledge.

      Use the knowledgebase to document:

      • Steps for pre-escalation troubleshooting.
      • Known errors.
      • Workarounds or solutions to recurring issues.
      • Solutions that require research or complex troubleshooting.
      • Incidents that have many root causes. Start with the most frequent solution and work toward less likely issues.

      Draw on organizational goals to define the knowledge transfer target state

      Image is Info-Tech’s Knowledge Transfer Maturity Model
      *Source: McLean & Company, 2013; N=120

      It’s better to start small than to have nothing at all

      Service desk teams are often overwhelmed by the idea of building and maintaining a comprehensive integrated knowledgebase that covers an extensive amount of information.

      Don’t let this idea stop you from building a knowledgebase! It takes time to build a comprehensive knowledgebase and you must start somewhere.

      Start with existing documentation or knowledge that depends on the expertise of only a few people and is easy to document and you will already see the benefits.

      Then continue to build and improve from there. Eventually, knowledge management will be a part of the culture.

      Engage the team to build a knowledgebase targeted on your most important incidents and requests

      WHERE DO I START?

      Inventory and consolidate existing documentation, then evaluate it for audience relevancy, accuracy, and usability. Use the exercise and the next slides to develop a knowledgebase template.

      Produce a plan to improve the knowledgebase.

      • Identify the current top five or ten incidents from the service desk reports and create related knowledgebase articles.
      • Evaluate for end-user self-service or technician resolution.
      • Note any resolutions that require access rights to servers.
      • Assign documentation creation tasks for the knowledgebase to individual team members each week.
      • Apply only one incident per article.
      • Set goals for each technician to submit one or two meaningful articles per month.
      • Assign a knowledge manager to monitor creation and edit and maintain the database.
      • Set policy to drive currency of the knowledgebase. See the Service Desk SOP for an example of a workable knowledge policy.

      Use a phased approach to build a knowledgebase

      Image is an example of a phased approach to build a knowledge base

      Use a quarterly, phased approach to continue to build and maintain your knowledgebase

      Continual Knowledgebase Maintenance:

      • Once a knowledgebase is in place, future articles should be written using established templates.
      • Articles should be regularly reviewed and monitored for usage. Outdated information will be retired and archived.
      • Ticket trend analysis should be done on an ongoing basis to identify new articles.
      • A proactive approach will anticipate upcoming issues based on planned upgrades and maintenance or other changes, and document resolution steps in knowledgebase articles ahead of time.

      Every Quarter:

      1. Conduct a ticket trend analysis. Identify the most important and common tickets.
      2. Review the knowledgebase to identify relevant articles that need to be revised or written.
      3. Use data from knowledge management tool to track expiring content and lesser used articles.
      4. Assign the task of writing articles to all IT staff members.
      5. Build and revise ticket templates for incident and service requests.

      Assign a knowledge manager role to ensure accountability for knowledgebase maintenance

      Assign a knowledge manager to monitor creation and edit and maintain database.

      Knowledge Manager/Owner Role:

      • Has overall responsibility for the knowledgebase.
      • Ensures content is consistent and maintains standards.
      • Regularly monitors and updates the list of issues that should be added to the knowledgebase.
      • Regularly reviews existing knowledgebase articles to ensure KB is up to date and flags content to retire or review.
      • Assigns content creation tasks.
      • Optimizes knowledgebase structure and organization.
      • See Info-Tech’s knowledge manager role description if you need a hand defining this position.

      The knowledge manager role will likely be a role assigned to an existing resource rather than a dedicated position.

      Develop a template to ensure knowledgebase articles are easy to read and write

      A screenshot of the Knowledgebase Article Template

      QUICK TIPS

      • Use non-technical language whenever possible to help less-technical readers.
      • Identify error messages and use screenshots where it makes sense.
      • Take advantage of social features like voting buttons to increase use.
      • Use Info-Tech’s Knowledge Base Article Template to get you started.

      Analyze the necessary features for your knowledgebase and compare them against existing tools

      Service desk knowledgebases range in complexity from simple FAQs to fully integrated software suites.

      Options include:

      • Article search with negative and positive filters.
      • Tagging, with the option to have keywords generate top matches.
      • Role-based permissions (to prevent unauthorized deletions).
      • Ability to turn a ticket resolution into a knowledgebase article (typically only available if knowledgebase tool is part of the service desk tool).
      • Natural language search.
      • Partitioning so relevant articles only appear for specific audiences.
      • Editorial workflow management.
      • Ability to set alerts for scheduled article review.
      • Article reporting (most viewed, was it useful?).
      • Rich text fields for attaching screenshots.

      Determine which features your organization needs and check to see if your tools have them.

      For more information on knowledgebase improvement, refer to Info-Tech’s Optimize the Service Desk With a Shift-Left Strategy.

      Document your knowledge management maintenance workflow to identify opportunities for improvement

      Workflow should include:

      • How you will identify top articles that need to be written
      • How you will ensure articles remain relevant
      • How you will assign new articles to be written, inclusive of peer review
      Image of flowchart of knowledgebase maintenance process.

      Design knowledgebase management processes

      3.2.1 Design knowledgebase management processes

      1. Assign a knowledge manager to monitor creation and edit and maintain the database. See Info-Tech’s knowledge manager role description if you need a hand defining this position.
      2. Discuss how you can use the service desk tool to integrate the knowledgebase with incident management, request fulfilment, and self-service processes.
      3. Discuss the suitability of a quarterly process to build and edit articles for a target knowledgebase that covers your most important incidents and requests.
      4. Set knowledgebase creation targets for tier 1, 2, and 3 analysts.
      5. Identify relevant performance metrics.
      6. Brainstorm elements that might be used as an incentive program to encourage the creation of knowledgebase articles and knowledge sharing more generally.
      7. Set policy to drive currency of knowledgebase. See the Service Desk SOP for an example of a workable knowledge policy.

      Participants

      • Service Desk Manager
      • Service Desk Agents

      What You’ll Need

      • Service Desk SOP
      • Flip Chart
      • Whiteboard

      Create actionable knowledgebase articles

      3.2.2 Run a knowledgebase working group

      Write and critique knowledgebase articles.

      1. On a whiteboard, build a list of potential knowledgebase articles divided by audience: Technician or End User.
      2. Each team member chooses one topic and spends 20 minutes writing.
      3. Each team member either reads the article and has the team critique or passes to the technician to the right for peer review. If there are many participants, break into smaller groups.
      4. Set a goal with the team for how, when, and how often knowledgebase articles will be created.
      5. Capture knowledgebase processes in the Service Desk SOP.

      Audience: Technician

      • Password update
      • VPN printing
      • Active directory – policy, procedures, naming conventions
      • Cell phones
      • VPN client and creation set-up

      Audience: End users

      • Set up email account
      • Password creation policy
      • Voicemail – access, change greeting, activities
      • Best practices for virus, malware, phishing attempts
      • Windows 10 tips and tricks

      Participants

      • Service Desk Manager
      • Service Desk Agents

      What You’ll Need

      • Service Desk SOP
      • Flip Chart
      • Whiteboard

      Step 3.3: Prepare for a self-service portal project

      Image shows the steps in phase 3. Highlight is on step 3.3.

      This step will walk you through the following activities:

      • 3.3.1 Develop self-service tools for the end user
      • 3.3.2 Make a plan for creating or improving the self-service portal

      This step involves the following participants:

      • IT Managers
      • Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      The section prepares you to tackle a self-service portal project once the service desk standardization is complete.

      DELIVERABLES

      • High-level activities to create a self-service portal

      Design the self-service portal with the users’ computer skills in mind

      A study by the OECD offers a useful reminder of one of usability’s most hard-earned lessons: you are not the user.

      • There is an important difference between IT professionals and the average user that’s even more damaging to your ability to predict what will be a good self-service tool: skills in using computers, the internet, and technology in general.
      • An international research study explored the computer skills of 215,942 people aged 16-65 in 33 countries.
      • The results show that across 33 rich countries, only 5% of the population has strong computer-related abilities and only 33% of people can complete medium-complexity computer tasks.
      • End users are skilled, they just don’t have the same level of comfort with computers as the average IT professional. Design your self-service tools with that fact in mind.
      Image is of a graph showing the ability of computer skills from age 16-65 among various countries.

      Take an incremental and iterative approach to developing your self-service portal

      Use a web portal to offer self-serve functionality or provide FAQ information to your customers to start.

      • Don’t build from scratch. Ideally, use the functionality included with your ITSM tool.
      • If your ITSM tool doesn’t have an adequate self-service portal functionality, then harness other tools that IT already uses. Common examples include Microsoft SharePoint and Google Forms.
      • Make it as easy as possible to access the portal:
        • Deploy an app to managed devices or put the app in your app store.
        • Create a shortcut on people’s start menus or home screens.
        • Print the URL on swag such as mousepads.
      • Follow Info-Tech’s approach to developing your user facing service catalog.

      Some companies use vending machines as a form of self serve. Users can enter their purchase code and “buy” a thin client, mouse, keyboard, software, USB keys, tablet, headphones, or loaners.

      Info-Tech Insight

      Building the basics first will provide your users with immediate value. Incrementally add new features to your portal.

      Optimize the portal: self-service should be faster and more convenient than the alternative

      Design the portal by demand, not supply

      Don’t build a portal framed around current offerings and capabilities just for the sake of it. Build the portal based on what your users want and need if you want them to use it.

      Make user experience a top priority

      The portal should be designed for users to self-serve, and thus self-service must be seamless, clear, and attractive to users.

      Speak your users’ language

      Keep in mind that users may not have high technical literacy or be familiar with terminology that you find commonplace. Use terms that are easy to understand.

      Appeal to both clickers and searchers

      Ensure that users can find what they’re looking for both by browsing the site and by using search functionality.

      Use one central portal for all departments

      If multiple departments (i.e. HR, Finance) use or will use a portal, set up a shared portal so that users won’t have to guess where to go to ask for help.

      You won’t know unless you test

      You will know how to navigate the portal better than anyone, but that doesn’t mean it’s intuitive for a new user. Test the portal with users to collect and incorporate feedback.

      Self-service portal examples (1/2)

      Image is of an example of the self-service portal

      Image source: Cherwell Service Management

      Self-service examples (2/2)

      Image is of an example of the self-service portal

      Image source: Team Dynamix

      Keep the end-user facing knowledgebase relevant with workflows, multi-device access, and social features

      Workflows:

      • Easily manage peer reviews and editorial and relevance review.
      • Enable links and importing between tickets and knowledgebase articles.
      • Enable articles to appear based on ticket content.

      Multi-device access:

      • Encourage users to access self-service.
      • Enable technicians to solve problems from anywhere.

      Social features:

      • Display most popular articles first to solve trending issues.
      • Enable voting to improve usability of articles.
      • Allow collaboration on self-service.

      For more information on building self-service portal, refer to Info-Tech’s Optimize the Service Desk with a Shift-Left Strategy

      Draft a high-level project plan for a self-service portal project

      3.3.1 Draft a high-level project plan for a self-service portal project

      1. Identify stakeholders who can contribute to the project.
        • Who will help with FAQ creation?
        • Who can design the self-service portal?
        • Who needs to sign off on the project?
      2. Identify the high-level tasks that need to be done.
        • How many FAQs need to be created?
        • How will we design the service catalog’s web portal?
        • What might a phased approach look like?
        • How can we break down the project into design, build, and implementation tasks?
        • What is the rough timeline for these tasks?
      3. Capture the high-level activities in the Service Desk Roadmap.

      Participants

      • Service Desk Manager
      • Service Desk Agents

      What You’ll Need

      • Flip Chart
      • Whiteboard
      • Implementation Roadmap

      Once you have a service portal, you can review the business requirements for a service catalog

      A service catalog is a communications device that lists the IT services offered by an organization. The service catalog is designed to enable the creation of a self-service portal for the end user. The portal augments the service desk so analysts can spend time managing incidents and providing technical support.

      The big value comes from workflows:

      • Improved economics and a means to measure the costs to serve over time.
      • Incentive for adoption because things work better.
      • Abstracts delivery from offer to serve so you can outsource, insource, crowdsource, slow, speed, reassign, and cover absences without involving the end user.

      There are three types of catalogs:

      • Static:Informational only, so can be a basic website.
      • Routing and workflow: Attached to service desk tool.
      • Workflow and e-commerce: Integrated with service desk tool and ERP system.
      Image is an example of service catalog

      Image courtesy of University of Victoria

      Understand the time and effort involved in building a service catalog

      A service catalog will streamline IT service delivery, but putting one together requires a significant investment. Service desk standardization comes first.

      • Workflows and back-end services must be in place before setting up a service catalog.
      • Think of the catalog as just the delivery mechanism for service you currently provide. If they aren’t running well and delivery is not consistent, you don’t want to advertise SLAs and options.
      • Service catalogs require maintenance.
      • It’s not a one-time investment – service catalogs must be kept up to date to be useful.
      • Service catalog building requires input from VIPs.
      • Architects and wordsmiths are not the only ones that spend effort on the service catalog. Leadership from IT and the business also provide input on policy and content.

      Sample Service Catalog Efforts

      • A college with 17 IT staff spent one week on a simple service catalog.
      • A law firm with 110 IT staff spent two months on a service catalog project.
      • A municipal government with 300 IT people spent over seven months and has yet to complete the project.
      • A financial organization with 2,000 IT people has spent seven months on service catalog automation alone! The whole project has taken multiple years.

      “I would say a client with 2,000 users and an IT department with a couple of hundred, then you're looking at six months before you have the catalog there.”

      – Service Catalog Implementation Specialist,

      Health Services

      Draft a high-level project plan for a self-service portal project

      3.2.2 Make a plan for creating or improving the self-service portal

      Identify stakeholders who can contribute to the project.

      • Who will help with FAQs creation?
      • Who can design the self-service portal?
      • Who needs to sign off on the project?

      Evaluate tool options.

      • Will you stick with your existing tool or invest in a new tool?

      Identify the high-level tasks that need to be done.

      • How will we design the web portal?
      • What might a phased approach look like?
      • What is the rough timeline for these tasks?
      • How many FAQs need to be created?
      • Will we have a service catalog, and what type?

      Document the plan and tasks in the Service Desk Roadmap.

      Examples of publicly posted service catalogs:

      University of Victoria is an example of a catalog that started simple and now includes multiple divisions, notifications, systems status, communications, e-commerce, incident registration, and more.

      Indiana University is a student, faculty, and staff service catalog and self-service portal that goes beyond IT services.

      If you are ready to start building a service catalog, use Info-Tech’s Design and Build a User-Facing Service Catalog blueprint to get started.

      Phase 4

      Plan the Implementation of the Service Desk

      Step 4.1: Build communication plan

      Image shows the steps in phase 4. Highlight is on step 4.1.

      This step will walk you through the following activities:

      • 4.1.1 Create the communication plan

      This step involves the following participants:

      • CIO
      • IT Director
      • IT Managers
      • Service Desk Manager(s)
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      The communication plan and project summary will help project managers outline recommendations and communicate their benefits.

      DELIVERABLES

      • Communication plan
      • Project summary

      Effectively communicate the game plan to IT to ensure the success of service desk improvements

      Communication is crucial to the integration and overall implementation of your service desk improvement.

      An effective communication plan will:

      • Gain support from management at the project proposal phase.
      • Create end-user buy-in once the program is set to launch.
      • Maintainthe presence of the program throughout the business.
      • Instill ownership throughout the business, from top-level management to new hires.

      Build a communication plan to:

      1. Communicate benefits to IT:
        • Share the standard operating procedures for training and feedback.
        • Train staff on policies as they relate to end users and ensure awareness of all policy changes.
        • As changes are implemented, continue to solicit feedback on what is and is not working and communicate adjustments as appropriate.
      2. Train technicians:
        • Make sure everyone is comfortable communicating changes to customers.
      3. Measure success:
        • Review SLAs and reports. Are you consistently meeting SLAs?
        • Is it safe to communicate with end users?

      Create your communication plan to anticipate challenges, remove obstacles, and secure buy-in

      Why:

      • What problems are you trying to solve?

      What:

      • What processes will it affect (that will affect me)?

      Who:

      • Who will be affected?
      • Who do I go to if I have issues with the new process?
      3 gears are depicted. The top gear is labelled managers with an arrow going clockwise. The middle gear is labelled technical staff with an arrow going counterclockwise. The bottom gear is labelled end users with an arrow going clockwise

      When:

      • When will this be happening?
      • When will it affect me?

      How:

      • How will these changes manifest themselves?

      Goal:

      • What is the final goal?
      • How will it benefit me?

      Create a communication plan to outline the project benefits

      Improved business satisfaction:

      • Improve confidence that the service desk can solve issues within the service-level agreement.
      • Channel incidents and requests through the service desk.
      • Escalate incidents quickly and accurately.

      Fewer recurring issues:

      • Tickets are created for every incident and categorized correctly.
      • Reports can be used for root-cause analysis.

      Increased efficiency or lower cost to serve:

      • Use FAQs to enable end users to self-solve.
      • Use knowledgebase to troubleshoot once, solve many times.
      • Cross-train to improve service consistency.

      Enhanced demand planning:

      • Trend analysis and reporting improve IT’s ability to forecast and address the demands of the business.

      Organize the information to manage the deployment of key messages

      Example of how to organize and manage key messages

      Create the communication plan

      4.1.1 Create the communication plan

      Estimated Time: 45 minutes

      Develop a stakeholder analysis.

      1. Identify everyone affected by the project.
      2. Assess their level of interest, value, and influence.
      3. Develop a communication strategy tailored to their level of engagement.

      Craft key messages tailored to each stakeholder group.

      Finalize the communication plan.

      1. Examine your roadmap and determine the most appropriate timing for communications.
      2. Assess when communications must happen with executives, business unit leaders, end users, and technicians.
      3. Identify any additional communication challenges that have come up.
      4. Identify who will send out the communications.
      5. Identify multiple methods for getting the messages out (newsletters, emails, posters, company meetings).
      6. For inspiration, you can refer to the Sample Communication Plan for the project.

      Participants

      • CIO
      • IT Managers
      • Service Desk Manager
      • Service Desk Agents

      Step 4.2: Build implementation roadmap

      Image shows the steps in phase 4. Highlight is on step 4.2.

      This step will walk you through the following activities:

      • 4.2.1 Build implementation roadmap

      This step involves the following participants:

      • CIO
      • IT Director
      • IT Managers
      • Service Desk Manager
      • Representation from tier 2 and tier 3 specialists

      Outcomes

      The implementation plan will help track and categorize the next steps and finalize the project.

      DELIVERABLES

      • Implementation roadmap

      Collaborate to create an implementation plan

      4.2.1 Create the implementation plan

      Estimated Time: 45 minutes

      Determine the sequence of improvement initiatives that have been identified throughout the project.

      The purpose of this exercise is to define a timeline and commit to initiatives to reach your goals.

      Instructions:

      1. Review the initiatives that will be taken to improve the service desk and revise tasks, as necessary.
      2. Input each of the tasks in the data entry tab and provide a description and rationale behind the task.
      3. Assign an effort, priority, and cost level to each task (high, medium, low).
      4. Assign ownership to each task.
      5. Identify the timeline for each task based on the priority, effort, and cost (short, medium, and long term).
      6. Highlight risk for each task if it will be deferred.
      7. Track the progress of each task with the status column.

      Participants

      • CIO
      • IT Managers
      • Service Desk Manager
      • Service Desk Agents

      A screenshot of the Roadmap tool.

      Document using the Roadmap tool.

      Related Info-Tech Research

      Standardize the Service Desk

      ImplementHardware and Software Asset Management

      Optimize Change Management Incident and Problem Management Build a Continual Improvement Plan for the Service Desk

      The Standardize blueprint reviews service desk structures and metrics and builds essential processes and workflows for incident management, service request fulfillment, and knowledge management practices.

      Once the service desk is operational, there are three paths to basic ITSM maturity:

      • Having the incident management processes and workflows built allows you to:
        • Introduce Change Management to reduce change-related incidents.
        • Introduce Problem Management to reduce incident recurrence.
        • Introduce Asset Management to augment service management processes with reliable data.

      Solicit targeted department feedback on core IT service capabilities, IT communications, and business enablement. Use the results to assess the satisfaction of end users, with each service broken down by department and seniority level.

      Works cited

      “Help Desk Staffing Models: Simple Analysis Can Save You Money.” Giva, Inc., 2 Sept. 2009. Web.

      Marrone et al. “IT Service Management: A Cross-national Study of ITIL Adoption.” Communications of the Association for Information Systems: Vol. 34, Article 49. 2014. PDF.

      Rumburg, Jeff. “Metric of the Month: First Level Resolution Rate.” MetricNet, 2011. Web.

      “Service Recovery Paradox.” Wikipedia, n.d. Web.

      Tang, Xiaojun, and Yuki Todo. “A Study of Service Desk Setup in Implementing IT Service Management in Enterprises.” Technology and Investment: Vol. 4, pp. 190-196. 2013. PDF.

      “The Survey of Adult Skills (PIAAC).” Organisation for Economic Co-operation and Development (OECD), 2016. Web.

      Contributors

      • Jason Aqui, IT Director, Bellevue College
      • Kevin Sigil, IT Director, Southwest Care Centre
      • Lucas Gutierrez, Service Desk Manager, City of Santa Fe
      • Rama Dhuwaraha, CIO, University of North Texas System
      • Annelie Rugg, CIO, UCLA Humanities
      • Owen McKeith, Manager IT Infrastructure, Canpotex
      • Rod Gula, IT Director, American Realty Association
      • Rosalba Trujillo, Service Desk Manager, Northgate Markets
      • Jason Metcalfe, IT Manager, Mesalabs
      • Bradley Rodgers, IT Manager, SecureTek
      • Daun Costa, IT Manager, Pita Pit
      • Kari Petty, Service Desk Manager, Mansfield Oil
      • Denis Borka, Service Desk Manager, PennTex Midstream
      • Lateef Ashekun, IT Manager, City of Atlanta
      • Ted Zeisner, IT Manager, University of Ottawa Institut de Cardiologie

      Adopt Generative AI in Solution Delivery

      • Buy Link or Shortcode: {j2store}146|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Development
      • Parent Category Link: /development
      • Delivery teams are under continuous pressure to deliver high value and quality solutions with limited capacity in complex business and technical environments. Common challenges experienced by these teams include:
        • Attracting and retaining talent
        • Maximizing the return on technology
        • Confidently shifting to digital
        • Addressing competing priorities
        • Fostering a collaborative culture
        • Creating high-throughput teams
      • Gen AI offers a unique opportunity to address many of these challenges.

      Our Advice

      Critical Insight

      • Your stakeholders' understanding of Gen AI, its value, and its application can be driven by hype and misinterpretation. This confusion can lead to unrealistic expectations and set the wrong precedent for the role Gen AI is intended to play.
      • Your SDLC is not well documented and is often executed inconsistently. An immature practice will not yield the benefits stakeholders expect.
      • The Gen AI marketplace is broad and diverse. Selecting the appropriate tools and partners is confusing and overwhelming.
      • There is a skills gap for what is needed to configure, adopt, and operate Gen AI.

      Impact and Result

      • Ground your Gen AI expectations. Set realistic and achievable goals centered on driving business value and efficiency across the entire SDLC by enabling Gen AI in key tasks and activities. Propose the SDLC as the ideal pilot for Gen AI.
      • Select the right Gen AI opportunities. Discuss how proven Gen AI capabilities can be applied to your solution delivery practice to achieve the outcomes and priorities stakeholders expect. Lessons learned sow the foundation for future Gen AI scaling.
      • Assess your Gen AI readiness in your solution delivery teams. Clarify the roles, processes, and tools needed for the implementation, use, and maintenance of Gen AI.

      Adopt Generative AI in Solution Delivery Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Adopt Generative AI in Solution Delivery Storyboard – A step-by-step guide that helps you assess whether Gen AI is right for your solution delivery practices.

      Gain an understanding of the potential opportunities that Gen AI can provide your solution delivery practices and answer the question "What should I do next?"

      • Adopt Generative AI in Solution Delivery Storyboard

      2. Gen AI Solution Delivery Readiness Assessment Tool – A tool to help you understand if your solution delivery practice is ready for Gen AI.

      Assess the readiness of your solution delivery team for Gen AI. This tool will ask several questions relating to your people, process, and technology, and recommend whether or not the team is ready to adopt Gen AI practices.

      • Gen AI Solution Delivery Readiness Assessment Tool
      [infographic]

      Further reading

      Adopt Generative AI in Solution Delivery

      Drive solution quality and team productivity with the right generative AI capabilities.

      Analyst Perspective

      Build the case for Gen AI with the right opportunities.

      Generative AI (Gen AI) presents unique opportunities to address many solution delivery challenges. Code generation can increase productivity, synthetic data generation can produce usable test data, and scanning tools can identify issues before they occur. To be successful, teams must be prepared to embrace the changes that Gen AI brings. Stakeholders must also give teams the opportunity to optimize their own processes and gauge the fit of Gen AI.

      Start small with the intent to learn. The right pilot initiative helps you learn the new technology and how it benefits your team without the headache of complex setups and lengthy training and onboarding. Look at your existing solution delivery tools to see what Gen AI capabilities are available and prioritize the use cases where Gen AI can be used out of the box.

      This is a picture of Andrew Kum-Seun

      Andrew Kum-Seun
      Research Director,
      Application Delivery and Management
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Delivery teams are under continuous pressure to deliver high-value, high-quality solutions with limited capacity in complex business and technical environments. Common challenges experienced by these teams include:

      • Attracting and retaining talent
      • Maximizing the return on technology
      • Confidently shifting to digital
      • Addressing competing priorities
      • Fostering a collaborative culture
      • Creating high-throughput teams

      Generative AI (Gen AI) offers a unique opportunity to address many of these challenges.

      Common Obstacles

      • Your stakeholders' understanding of what is Gen AI, its value and its application, can be driven by hype and misinterpretation. This confusion can lead to unrealistic expectations and set the wrong precedent for the role Gen AI is intended to play.
      • Your solution delivery process is not well documented and is often executed inconsistently. An immature practice will not yield the benefits stakeholders expect.
      • The Gen AI marketplace is very broad and diverse. Selecting the appropriate tools and partners is confusing and overwhelming.
      • There is a skills gap for what is needed to configure, adopt, and operate Gen AI.

      Info-Tech's Approach

      • Ground your Gen AI expectations. Set realistic and achievable goals centered on driving business value and efficiency across the entire solution delivery process by enabling Gen AI in key tasks and activities. Propose this process as the ideal pilot for Gen AI.
      • Select the right Gen AI opportunities. Discuss how proven Gen AI capabilities can be applied to your solution delivery practice and achieve the outcomes and priorities stakeholders expect. Lessons learned sow the foundation for future Gen AI scaling.
      • Assess your Gen AI readiness in your solution delivery teams. Clarify the roles, processes, and tools needed for the implementation, use, and maintenance of Gen AI.

      Info-Tech Insight

      Position Gen AI as a tooling opportunity to enhance the productivity and depth of your solution delivery practice. Current Gen AI tools are unable to address the various technical and human complexities that commonly occur in solution delivery. Assess the fit of Gen AI by augmenting low-risk, out-of-the-box tools in key areas of your solution delivery process and teams.

      Insight Summary

      Overarching Info-Tech Insight

      Position Gen AI is a tooling opportunity to enhance the productivity and depth of your solution delivery practice. However, current Gen AI tools are unable to address the various technical and human complexities that commonly occur in solution delivery. Assess the fit of Gen AI by augmenting low-risk, out-of-the-box tools in key areas of your solution delivery process and teams.

      Understand and optimize first, automate with Gen AI later.
      Gen AI magnifies solution delivery inefficiencies and constraints. Adopt a user-centric perspective to understand your solution delivery teams' interactions with solution delivery tools and technologies to better replicate how they complete their tasks and overcome challenges.

      Enable before buy. Buy before build.
      Your solution delivery vendors see AI as a strategic priority in their product and service offering. Look into your existing toolset and see if you already have the capabilities. Otherwise, prioritize using off-the-shelf solutions with pre-trained Gen AI capabilities and templates.

      Innovate but don't experiment.
      Do not reinvent the wheel and lower your risk of success. Stick to the proven use cases to understand the value and fit of Gen AI tools and how your teams can transform the way they work. Use your lessons learned to discover scaling opportunities.

      Blueprint benefits

      IT benefits

      Business benefits

      • Select the Gen AI tools and capabilities that meet both the solution delivery practice and team goals, such as:
      • Improved team productivity and throughput.
      • Increased solution quality and value.
      • Greater team satisfaction.
      • Motivate stakeholder buy-in for the investment in solution delivery practice improvements.
      • Validate the fit and opportunities with Gen AI for future adoption in other IT departments.
      • Increase IT satisfaction by improving the throughput and speed of solution delivery.
      • Reduce the delivery and operational costs of enterprise products and services.
      • Use a pilot to demonstrate the fit and value of Gen AI capabilities and supporting practices across business and IT units.

      What is Gen AI?

      An image showing where Gen AI sits within the artificial intelligence.  It consists of four concentric circles.  They are labeled from outer-to-inner circle in the following order: Artificial Intelligence; Machine Learning; Deep Learning; Gen AI

      Generative AI (Gen AI)
      A form of ML whereby, in response to prompts, a Gen AI platform can generate new output based on the data it has been trained on. Depending on its foundational model, a Gen AI platform will provide different modalities and use case applications.

      Machine Learning (ML)
      The AI system is instructed to search for patterns in a data set and then make predictions based on that set. In this way, the system learns to provide accurate content over time. This requires a supervised intervention if the data is inaccurate. Deep learning is self-supervised and does not require intervention.

      Artificial Intelligence (AI)
      A field of computer science that focuses on building systems to imitate human behavior. Not all AI systems have learning behavior; many systems (such as customer service chatbots) operate on preset rules.

      Info-Tech Insight

      Many vendors have jumped on Gen AI as the latest marketing buzzword. When vendors claim to offer Gen AI functionality, pin down what exactly is generative about it. The solution must be able to induce new outputs from inputted data via self-supervision – not trained to produce certain outputs based on certain inputs.

      Augment your solution delivery teams with Gen AI

      Position Gen AI as a tooling opportunity to enhance the productivity and depth of your solution delivery practice. Current Gen AI tools are unable to address the various technical and human complexities that commonly occur in solution delivery; assess the fit of Gen AI by augmenting low-risk, out-of-the-box tools in key areas of your solution delivery process and teams.

      Solution Delivery Team

      Humans

      Gen AI Bots

      Product owner and decision maker
      Is accountable for the promised delivery of value to the organization.

      Business analyst and architect
      Articulates the requirements and aligns the team to the business and technical needs.

      Integrator and builder
      Implements the required solution.

      Collaborator
      Consults and supports the delivery.

      Administrator
      Performs common administrative tasks to ensure smooth running of the delivery toolchain and end-solutions.

      Designer and content creator
      Provides design and content support for common scenarios and approaches.

      Paired developer and tester
      Acts as a foil for existing developer or tester to ensure high quality output.

      System monitor and support
      Monitors and recommends remediation steps for operational issues that occur.

      Research deliverable

      This research is accompanied by a supporting deliverable to help you accomplish your goals.

      Gen AI Solution Delivery Readiness Assessment Tool

      Assess the readiness of your solution delivery team for Gen AI. This tool will ask several questions relating to your people, process, and technology, and recommend whether the team is ready to adopt Gen AI practices.

      This is a series of three screenshots from the Gen AI Solution Delivery Readiness Assessment Tool

      Step 1.1

      Set the context

      Activities

      1.1.1 Understand the challenges of your solution delivery teams.

      1.1.2 Outline the value you expect to gain from Gen AI.

      This step involves the following participants:

      • Applications VP
      • Applications Director
      • Solution Delivery Manager
      • Solution Delivery Team

      Outcomes of this step

      • SWOT Analysis to help articulate the challenges facing your teams.
      • A Gen AI Canvas that will articulate the value you expect to gain.

      IT struggles to deliver solutions effectively

      • Lack of skills and resources
        Forty-six percent of respondents stated that it was very or somewhat difficult to attract, hire, and retain developers (GitLab, 2023; N=5,010).
      • Delayed software delivery
        Code development (37%), monitoring/observability (30%), deploying to non-production environments (30%), and testing (28%) were the top areas where software delivery teams or organizations encountered the most delays (GitLab, 2023, N=5,010).
      • Low solution quality and satisfaction
        Only 64% of applications were identified as effective by end users. Effective applications are identified as at least highly important and have high feature and usability satisfaction (Application Portfolio Assessment, August 2021 to July 2022; N=315).
      • Burnt out teams
        While workplace flexibility comes with many benefits, longer work hours jeopardize wellbeing. Sixty-two percent of organizations reported increased working hours, while 80% reported an increase in flexibility ("2022 HR Trends Report," McLean & Company, 2022; N=394) .

      Creating high-throughput teams is an organizational priority.

      CXOs ranked "optimize IT service delivery" as the second highest priority. "Achieve IT business" was ranked first.

      (CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568)

      1.1.1 Understand the challenges of your solution delivery teams

      1-3 hours

      1. Complete a SWOT analysis of your solution delivery team to discover areas where Gen AI can be applied.
      2. Record this information in the Gen AI Solution Delivery Readiness Assessment Tool.

      Strengths

      Internal characteristics that are favorable as they relate to solution delivery

      Weaknesses

      Internal characteristics that are unfavorable or need improvement

      Opportunities

      External characteristics that you may use to your advantage

      Threats

      External characteristics that may be potential sources of failure or risk

      Record the results in the Gen AI Solution Delivery Readiness Assessment Tool

      Output

      • SWOT analysis of current state of solution delivery practice

      Participants

      • Applications VP
      • Applications Director
      • Solution Delivery Manager
      • Solution Delivery Team

      Gen AI can help solve your solution delivery challenges

      Why is software delivery an ideal pilot candidate for Gen AI?

      • Many software delivery practices are repeatable and standardized.
      • Software delivery roles that are using and implementing Gen AI are technically savvy.
      • Automation is a staple in many commonly used tools.
      • Change will likely not impact business operations.

      Improved productivity

      Gen AI jumpstarts the most laborious and mundane parts of software delivery. Delivery teams saved 22 hours (avg) per software use case when using AI in 2022, compared to last year when AI was not used ("Generative AI Speeds Up Software Development," PRNewswire, 2023).

      Fungible resources

      Teams are transferrable across different frameworks, platforms, and products. Gen AI provides the structure and guidance needed to work across a wider range of projects ("Game changer: The startling power generative AI is bringing to software development," KPMG, 2023).

      Improved solution quality

      Solution delivery artifacts (e.g. code) are automatically scanned to quickly identify bugs and defects based on recent activities and trends and validate against current system performance and capacity.

      Business empowerment

      AI enhances the application functionalities workers can build with low- and no-code platforms. In fact, "AI high performers are 1.6 times more likely than other organizations to engage non-technical employees in creating AI applications" ("The state of AI in 2022 — and a half decade in review." McKinsey, 2022, N=1,492).

      However, various fears, uncertainties, and doubts challenge Gen AI adoption

      Black Box

      Little transparency is provided on the tool's rationale behind content creation, decision making, and the use and storage of training data, creating risks for legal, security, intellectual property, and other areas.

      Role Replacement

      Some workers have job security concerns despite Gen AI being bound to their rule-based logic framework, the quality of their training data, and patterns of consistent behavior.

      Skills Gaps

      Teams need to gain expertise in AI/ML techniques, training data preparation, and continuous tooling improvements to support effective Gen AI adoption across the delivery practice and ensure reliable operations.

      Data Inaccuracy

      Significant good quality data is needed to build trust in the applicability and reliability of Gen AI recommendations and outputs. Teams must be able to combine Gen AI insights with human judgment to generate the right outcome.

      Slow Delivery of AI Solution

      Timelines are sensitive to organizational maturity, experience with Gen AI, and investments in good data management practices. 65% of organizations said it took more than three months to deploy an enterprise-ready AIOps solution (OpsRamp, 2022).

      Define the value you want Gen AI to deliver

      Well-optimized Gen AI instills stakeholder confidence in ongoing business value delivery and ensures stakeholder buy-in, provided proper expectations are set and met. However, business value is not interpreted or prioritized the same across the organization. Come to a common business value definition to drive change in the right direction by balancing the needs of the individual, team, and organization.

      Business value cannot always be represented by revenue or reduced expenses. Dissecting value by the benefit type and the value source's orientation allows you to see the many ways in which Gen AI brings value to the organization.

      Financial benefits vs. intrinsic needs

      • Financial benefits refers to the degree to which the value source can be measured through monetary metrics, such as revenue generation and cost saving.
      • Intrinsic needs refers to how a product, service, or business capability enhanced with Gen AI meets functional, user experience, and existential needs.

      Inward vs. outward orientation

      • Inward refers to value sources that are internally impacted by Gen AI and improve your employees' and teams' effectiveness in performing their responsibilities.
      • Outward refers to value sources that come from your interaction with external stakeholders and customers and were improved from using Gen AI.

      See our Build a Value Measurement Framework blueprint for more information about business value definition.

      An image of the Business Value Matrix for Gen AI

      Measure success with the right metrics

      Establishing and monitoring metrics are powerful ways to drive behavior and strategic changes in your organization. Determine the right measures that demonstrate the value of your Gen AI implementation by aligning them with your Gen AI objectives, business value drivers, and non-functional requirements.

      Select metrics with different views

      1. Solution delivery practice effectiveness
        The ability of your practice to deliver, support, and operate solutions with Gen AI
        Examples: Solution quality and throughput, delivery and operational costs, number of defects and issues, and system quality
      2. Solution quality and value
        The outcome of your solutions delivered with Gen AI tools
        Examples: Time and money saved, utilization of products and services, speed of process execution, number of errors, and compliance with standards
      3. Gen AI journey goals and milestones
        Your organization's position in your Gen AI journey
        Examples: Maturity score, scope of Gen AI adoption, comfort and
        confidence with Gen AI capabilities, and complexity of Gen AI use cases

      Leverage Info-Tech's Diagnostics

      IT Management & Governance

      • Improvement to application development quality and throughput effectiveness
      • Increased importance of application delivery and maintenance capabilities across the IT organization
      • Delegation of delivery accountability across more IT roles

      CIO Business Vision

      • Improvements to IT satisfaction and value from delivered solutions
      • Changes to the value and importance of IT core services enabled with Gen AI
      • The state of business and IT relationships
      • Capability to deliver and support Gen AI effectively

      1.1.2 Outline the value you expect to gain from Gen AI

      1-3 hours

      1. Complete the following fields to build your Gen AI canvas:
        1. Problem that Gen AI is intending to solve
        2. List of stakeholders
        3. Desired business and IT outcomes
        4. In-scope solution delivery teams, systems, and capabilities.
      2. Record this information in the Gen AI Solution Delivery Readiness Assessment Tool.

      Output

      • Gen AI Canvas

      Participants

      • Applications VP
      • Applications Director
      • Solution Delivery Manager
      • Solution Delivery Team

      Record the results in the Gen AI Solution Delivery Readiness Assessment Tool

      1.1.2 Example

      Example of an outline of the value you expect to gain from Gen AI

      Problem statements

      • Manual testing procedures hinder pace and quality of delivery.
      • Inaccurate requirement documentation leads to constant redesigning.

      Business and IT outcomes

      • Improve code quality and performance.
      • Expedite solution delivery cycle.
      • Improve collaboration between teams and reduce friction.

      List of stakeholders

      • Testing team
      • Application director
      • CIO
      • Design team
      • Project manager
      • Business analysts

      In-scope solution delivery teams, system, and capabilities

      • Web
      • Development
      • App development
      • Testing
      • Quality assurance
      • Business analysts
      • UI/UX design

      Align your objectives to the broader AI strategy

      Why is an organizational AI strategy important for Gen AI?

      • All Gen AI tactics and capabilities are designed, delivered, and managed to support a consistent interpretation of the broader AI vision and goals.
      • An organizational strategy gives clear understanding of the sprawl, criticality, and risks of Gen AI solutions and applications to other IT capabilities dependent on AI.
      • Gen AI initiatives are planned, prioritized, and coordinated alongside other software delivery practice optimizations and technology modernization initiatives.
      • Resources, skills, and capacities are strategically allocated to meet the needs of Gen AI considering other commitments in the software delivery optimization backlog and roadmap.
      • Gen AI expectations and practices uphold the persona, values, and principles of the software delivery team.

      What is an AI strategy?

      An AI strategy details the direction, activities, and tactics to deliver on the promise of your AI portfolio. It often includes:

      • AI vision and goals
      • Application, automation, and process portfolio involved or impacted by AI
      • Values and principles
      • Health of your AI portfolio
      • Risks and constraints
      • Strategic roadmap

      Step 1.2

      Evaluate opportunities for Gen AI

      Activities

      1.2.1 Align Gen AI opportunities with teams and capabilities.

      This step involves the following participants:

      • Applications VP
      • Applications Director
      • Solution Delivery Manager
      • Solution Delivery Team

      Outcomes of this step

      • Understand the Gen AI opportunities for your solution delivery practice.

      Learn how Gen AI is employed in solution delivery

      Gen AI opportunity Common Gen AI tools and vendors Teams than can benefit How can teams leverage this? Case study
      Synthetic data generation
      • Testing
      • Data Analysts
      • Privacy and Security
      • Create test datasets
      • Replace sensitive personal data

      How Unity Leverages Synthetic Data

      Code generation
      • Development
      • Testing
      • Code Templates & Boilerplate
      • Code Refactoring

      How CI&T accelerated development by 11%

      Defect forecasting and debugging
      • Project Manager & Quality Assurance
      • Development
      • Testing
      • Identify root cause
      • Static and dynamic code analysis
      • Debugging assistance

      Altran Uses Microsoft Code Defect AI Solution

      Requirements documentation and elicitation
      • Business Analysts
      • Development
      • Document functional requirements
      • Writing test cases

      Google collaborates with Replit to reduce time to bring new products to market by 30%

      UI design and prototyping
      • UI/UX Design
      • Development
      • Deployment
      • Rapid prototyping
      • Design assistance

      How Spotify is Upleveling Their Entire Design Team

      Other common AI opportunities solutions include test case generation, code translation, use case creation, document generation, and automated testing.

      Opportunity 1: Synthetic data generation

      Create artificial data that mimics the structure of real-life data.

      What are the expected benefits?

      • Availability of test data: Creation of large volumes of data compatible for testing multiple systems within the organization.
      • Improved privacy: Substituting real data with artificial leads to reduced data leaks.
      • Quicker data provisioning: Automated generation of workable datasets aligned to company policies.

      What are the notable risks and challenges?

      • Generalization and misrepresentations: Data models used in synthetic data generation may not be an accurate representation of production data because of potentially conflicting definitions, omission of dependencies, and multiple sources of truth.
      • Lack of accurate representation: It is difficult for synthetic data to fully capture real-world data nuances.
      • Legal complexities: Data to build and train the Gen AI tool does not comply with data residency and management standards and regulations.

      How should teams prepare for synthetic data generation?

      It can be used:

      • To train machine learning models when there is not enough real data, or the existing data does not meet specific needs.
      • To improve quality of test by using data that closely resembles production without the risk of leveraging sensitive and private information.

      "We can simply say that the total addressable market of synthetic data and the total addressable market of data will converge,"
      Ofir Zuk, CEO, Datagen (Forbes, 2022)

      Opportunity 2: Code generation

      Learn patterns and automatically generate code.

      What are the expected benefits?

      • Increased productivity: It allows developers to generate more code quickly.
      • Improved code consistency: Code is generated using a standardized model and lessons learnt from successful projects.
      • Rapid prototyping: Expedite development of a working prototype to be verified and validated.

      What are the notable risks and challenges?

      • Limited contextual understanding: AI may lack domain-specific knowledge or understanding of requirements.
      • Dependency: Overreliance on AI generated codes can affect developers' creativity.
      • Quality concerns: Generated code is untested and its alignment to coding and quality standards is unclear.

      How should teams prepare for code generation?

      It can be used to:

      • Build solutions without the technical expertise of traditional development.
      • Discover different solutions to address coding challenges.
      • Kickstart new development projects with prebuilt code.

      According to a survey conducted by Microsoft's GitHub, a staggering 92% of programmers were reported as using AI tools in their workflow (GitHub, 2023).

      Opportunity 3: Defect forecasting & debugging

      Predict and proactively address defects before they occur.

      What are the expected benefits?

      • Reduced maintenance cost: Find defects earlier in the delivery process, when it's cheaper to fix them.
      • Increased efficiency: Testing efforts can remain focused on critical and complex areas of solution.
      • Reduced risk: Find critical defects before the product is deployed to production.

      What are the notable risks and challenges?

      • False positives and negatives: Incorrect interpretation and scope of defect due to inadequate training of the Gen AI model.
      • Inadequate training: Training data does not reflect the complexity of the solutions code.
      • Not incorporating feedback: Gen AI models are not retrained in concert with solution changes.

      How should teams prepare for defect forecasting and debugging?

      It can be used to:

      • Perform static and dynamic code analysis to find vulnerabilities in the solution source code.
      • Forecast potential issues of a solution based on previous projects and industry trends.
      • Find root cause and suggest solutions to address found defects.

      Using AI technologies, developers can reduce the time taken to debug and test code by up to 70%, allowing them to finish projects faster and with greater accuracy (Aloa, 2023).

      Opportunity 4: Requirements documentation & elicitation

      Capturing, documenting, and analyzing function and nonfunctional requirements.

      What are the expected benefits?

      • Improve quality of requirements: Obtain different perspectives and contexts for the problem at hand and help identify ambiguities and misinterpretation of risks and stakeholder expectation.
      • Increased savings: Fewer resources are consumed in requirements elicitation activities.
      • Increased delivery confidence: Provide sufficient information for the solution delivery team to confidently estimate and commit to the delivery of the requirement.

      What are the notable risks and challenges?

      • Conflicting bias: Gen AI models may interpret the problem differently than how the stakeholders perceive it.
      • Organization-specific interpretation: Inability of the Gen AI models to accommodate unique interpretation of terminologies, standards, trends and scenarios.
      • Validation and review: Interpreting extracted insights requires human validation.

      How should teams prepare for requirements documentation & elicitation?

      It can be used to:

      • Document requirements in a clear and concise manner that is usable to the solution delivery team.
      • Analyze and test requirements against various user, business, and technical scenarios.

      91% of top businesses surveyed report having an ongoing investment in AI (NewVantage Partners, 2021).

      Opportunity 5: UI design and prototyping

      Analyze existing patterns and principles to generate design, layouts, and working solutions.

      What are the expected benefits?

      • Increased experimentation: Explore different approaches and tactics to solve a solution delivery problem.
      • Improved collaboration: Provide quick design layouts that can be reshaped based on stakeholder feedback.
      • Ensure design consistency: Enforce a UI/UX design standard for all solutions.

      What are the notable risks and challenges?

      • Misinterpretation of UX Requirements: Gen AI model incorrectly assumes a specific interpretation of user needs, behaviors, and problem.
      • Incorrect or missing requirements: Lead to extensive redesigns and iterations, adding to costs while hampering user experience.
      • Design creativity: May lack originality and specific brand aesthetics if not augmented well with human customizability and creativity.

      How should teams prepare for UI design and prototyping?

      It can be used to:

      • Visualize the solution through different views and perspectives such as process flows and use-case diagrams.
      • Create working prototypes that can be verified and validated by stakeholders and end users.

      A study by McKinsey & Company found that companies that invest in AI-driven design outperform their peers in revenue growth and customer experience metrics. They were found to achieve up to two times higher revenue growth than industry peers and up to 10% higher net promoter score (McKinsey & Company, 2018).

      Determine the importance of your opportunities by answering these questions

      Realizing the complete potential of Gen AI relies on effectively fostering its adoption and resulting changes throughout the entire solution delivery process.

      What are the challenges faced by your delivery teams that could be addressed by Gen AI?

      • Recognize the precise pain points, bottlenecks, or inefficiencies faced by delivery teams.
      • Include all stakeholders' perspectives during problem discovery and root cause analysis.

      What's holding back Gen AI adoption in the organization?

      • Apart from technical barriers, address cultural and organizational challenges and discuss how organizational change management strategies can mitigate Gen AI adoption risk.

      Are your objectives aligned with Gen AI capabilities?

      • Identify areas where processes can be modernized and streamlined with automation.
      • Evaluate the current capabilities and resources available within the organization to leverage Gen AI technologies effectively.

      How can Gen AI improve the entire solution delivery process?

      • Investigate and evaluate the improvements Gen AI can reasonably deliver, such as increased accuracy, quickened delivery cycles, improved code quality, or enhanced cross-functional collaboration.

      1.2.1 Align Gen AI opportunities to teams and capabilities

      1-3 hours

      1. Associate the Gen AI opportunities that can be linked to your system capabilities. These opportunities refer to the potential applications of generative AI techniques, such as code generation or synthetic data, to address specific challenges.
        1. Start by analyzing your system's requirements, constraints, and areas where Gen AI techniques can bring value. Identify the potential benefits of integrating Gen AI, such as increased productivity, or enhanced creativity.
        2. Next, discern potential risks or challenges, such as dependency or quality concerns, associated with the opportunity implementation.
      2. Record this information in the Gen AI Solution Delivery Readiness Assessment Tool.

      Output

      • Gen AI opportunity selection

      Participants

      • Applications VP
      • Applications Director
      • Solution Delivery Manager
      • Solution Delivery Team

      Record the results in the Gen AI Solution Delivery Readiness Assessment Tool

      Keep an eye out for red flags

      Not all Gen AI opportunities are delivered and adopted the same. Some present a bigger risk than others.

      • Establishing vague targets and success criteria
      • Defining Gen AI as substitution of human capital
      • Open-source software not widely adopted or validated
      • High level of dependency on automation
      • Unadaptable cross-functional training across organization
      • Overlooking privacy, security, legal, and ethical implications
      • Lack of Gen AI expertise and understanding of good practices

      Step 1.3

      Assess your readiness for Gen AI

      Activities

      1.3.1 Assess your readiness for Gen AI.

      This step involves the following participants:

      • Applications VP
      • Applications Director
      • Solution Delivery Manager
      • Solution Delivery Team

      Outcomes of this step

      • A completed Gen AI Readiness Assessment to confirm how prepared you are to embrace Gen AI in your solution delivery team.

      Prepare your SDLC* to leverage Gen AI

      As organizations evolve and adopt more tools and technology, their solution delivery processes become more complex. Process improvement is needed to simplify complex and undocumented software delivery activities and artifacts and prepare it for Gen AI. Gen AI scales process throughput and output quantity, but it multiplies the negative impact of problems the process already has.

      When is your process ready for Gen AI?

      • Solution value Ensures the accuracy and alignment of the committed feature and change requests to what the stakeholder truly expects and receives.
      • ThroughputDelivers new products, enhancements, and changes at a pace and frequency satisfactory to stakeholder expectations and meets delivery commitments.
      • Process governance Has clear ownership and appropriate standardization. The roles, activities, tasks, and technologies are documented and defined. At each stage of the process someone is responsible and accountable.
      • Process management Follows a set of development frameworks, good practices, and standards to ensure the solution and relevant artifacts are built, tested, and delivered consistently and repeatably.
      • Technical quality assurance – Accommodates committed non-functional requirements within the stage's outputs to ensure products meet technical excellence expectations.

      *software development lifecycle

      To learn more, visit Info-Tech's Modernize Your SDLC blueprint.

      To learn more, visit Info-Tech's Build a Winning Business Process Automation Playbook

      Assess the impacts from Gen AI changes

      Ensure that no stone is left unturned as you evaluate the fit of Gen AI and prepare your adoption and support plans.

      By shining a light on considerations that might have otherwise escaped planners and decision makers, an impact analysis is an essential component to Gen AI success. This analysis should answer the following questions on the impact to your solution delivery teams.

      1. Will the change impact how our clients/customers receive, consume, or engage with our products/services?
      2. Will there be an increase in operational costs, and a change to compensation and/or rewards?
      3. Will this change increase the workload and alter staffing levels?
      4. Will the vision or mission of the team change?
      5. Will a new or different set of skills be needed?
      6. Will the change span multiple locations/time zones?
      7. Are multiple products/services impacted by this change?
      8. Will the workflow and approvals be changed, and will there be a substantial change to scheduling and logistics?
      9. Will the tools of the team be substantially different?
      10. Will there be a change in reporting relationships?

      See our Master Organizational Change Management Practices blueprint for more information.

      Brace for impact

      A thorough analysis of change impacts will help your software delivery teams and change leaders:

      • Bypass avoidable problems.
      • Remove non-fixed barriers to success.
      • Acknowledge and minimize the impact of unavoidable barriers.
      • Identify and leverage potential benefits.
      • Measure the success of the change.

      Many key IT capabilities are required to successfully leverage Gen AI

      Portfolio Management

      An accurate and rationalized inventory of all Gen AI tools verifies they support the goals and abide to the usage policies of the broader delivery practice. This becomes critical when tooling is updated frequently and licenses and open- source community principles drastically change (e.g. after an acquisition).

      Quality Assurance

      Gen AI tools are routinely verified and validated to ensure outcomes are accurate, complete, and aligned to solution delivery quality standards. Models are retrained using lessons learned, new use cases, and updated training data.

      Security & Access Management

      Externally developed and trained Gen AI models may not include the measures, controls, and tactics you need to prevent vulnerabilities and protect against threats that are critical in your security frameworks, policies, and standards.

      Data Management & Governance

      All solution delivery data and artifacts can be transformed and consumed in various ways as they transit through solution delivery and Gen AI tools. Data integrations, structures, and definitions must be well-defined, governed, and monitored.

      OPERATIONAL SUPPORT

      Resources are available to support the ongoing operations of the Gen AI tool, including infrastructure, preparing training data, and managing integration with other tools. They are also prepared to recover backups, roll back, and execute recovery plans at a moment's notice.

      Apply Gen AI good practices in your solution delivery practice

      1. Keep the human in the loop.
        Gen AI models cannot produce high-quality content with 100% confidence. Keeping the human in the loop allows people to directly give feedback to the model to improve output quality.
      2. Strengthen prompt and query engineering.
        The value of the outcome is dependent on what is being asked. Good prompts and queries focus on creating the optimal input by selecting and phrasing the appropriate words, sentence structures, and punctuation to illustrate the focus, scope, problem, and boundaries.
      3. Thoughtfully prepare your training data.
        Externally hosted Gen AI tools may store your training data in their systems or use it to train their other models. Intellectual property and sensitive data can leak into third-party systems and AI models if it is not properly masked and sanitized.
      4. Build guardrails into your Gen AI models.
        Guardrails can limit the variability of any misleading Gen AI responses by defining the scope and bounds of the response, enforcing the policies of its use, and clarifying the context of its response.
      5. Monitor your operational costs.
        The cost breakdown will vary among the types of Gen AI solution and the vendor offerings. Cost per query, consultant fees, infrastructure hosting, and licensing costs are just a few cost factors. Open source can be an attractive cost-saving option, but you must be willing to invest in the roles to assume traditional vendor accountabilities.
      6. Check the licenses of your Gen AI tool.
        Each platform has licenses and agreements on how their solution can or cannot be used. They limit your ability to use the tool for commercial purposes or reproductions or may require you to purchase and maintain a specific license to use their solution and materials.

      See Build Your Generative AI Roadmap for more information.

      Assess your Gen AI readiness

      • Solution delivery team
        The team is educated on Gen AI, its use cases, and the tools that enable it. They have the skills and capacity to implement, create, and manage Gen AI.
      • Solution delivery process and tools
        The solution delivery process is documented, repeatable, and optimized to use Gen AI effectively. Delivery tools are configured to enable, leverage and manage Gen AI assets to improve their performance and efficiency.
      • Solution delivery artifacts
        Delivery artifacts (e.g. code, scripts, documents) that will be used to train and be leveraged by Gen AI tools are discoverable, accurate, complete, standardized, of sufficient quantity, optimized for Gen AI use, and stored in an accessible shared central repository.
      • Governance
        Defined policies, role definitions, guidelines, and processes that guide the implementation, development, operations, and management of Gen AI.
      • Vision and executive support
        Clear alignment of Gen AI direction, ambition, and objectives with broader business and IT priorities. Stakeholders support the Gen AI initiative and allocate human and financial resources for its implementation within the solution delivery team.
      • Operational support
        The capabilities to manage the Gen AI tools and ensure they support the growing needs of the solution delivery practice, such as security management, hosting infrastructure, risk and change management, and data and application integration.

      1.3.1 Assess your readiness for Gen AI

      1-3 hours

      1. Review the current state of your solution delivery teams including their capacity, skills and knowledge, delivery practices, and tools and technologies.
      2. Determine the readiness of your team to adopt Gen AI.
      3. Discuss the gaps that need to be filled to be successful with Gen AI.
      4. Record this information in the Gen AI Solution Delivery Readiness Assessment Tool.

      Record the results in the Gen AI Solution Delivery Readiness Assessment Tool

      Output

      • Gen AI Solution Delivery Readiness Assessment

      Participants

      • Applications VP
      • Applications Director
      • Solution Delivery Manager
      • Solution Delivery Team

      Recognize that Gen AI does not require a fully optimized solution delivery process

      1. Consideration; 2. Exploration; 3. Incorporation; 4. Proliferation; 5. Optimization.  Steps 3-5 are Recommended maturity levels to properly embrace Gen AI.

      To learn more, visit Info-Tech's Develop Your Value-First Business Process Automation (BPA) Strategy.

      Be prepared to take the next steps

      Deliver Gen AI to your solution delivery teams

      Modernize Your SDLC
      Efficient and effective SDLC practices are vital, as products need to readily adjust to evolving and changing business needs and technologies.

      Adopt Generative AI in Solution Delivery
      Generative AI can drive productivity and solution quality gains to your solution delivery teams. Level set expectations with the right use case to demonstrate its value potential.

      Select Your AI Vendor & Implementation Partner
      The right vendor and partner are critical for success. Build the selection criteria to shortlist the products and services that best meets the current and future needs of your teams.

      Drive Business Value With Off-the-Shelf AI
      Build a framework that will guide your teams through the selection of an off-the-shelf AI tool with a clear definition of the business case and preparations for successful adoption.

      Build Your Enterprise Application Implementation Playbook
      Your Gen AI implementation doesn't start with technology, but with an effective plan that your team supports and is aligned to broader stakeholder and sponsor priorities and goals.

      Build your Gen AI practice

      • Get Started With AI
      • AI Strategy & Generative AI Roadmap
      • AI Governance

      Related Info-Tech Research

      Build a Winning Business Process Automation Playbook
      Optimize and automate your business processes with a user-centric approach.

      Embrace Business Managed Applications
      Empower the business to implement their own applications with a trusted business-IT relationship.

      Application Portfolio Management Foundations
      Ensure your application portfolio delivers the best possible return on investment.

      Maximize the Benefits from Enterprise Applications with a Center of Excellence
      Optimize your organization's enterprise application capabilities with a refined and scalable methodology.

      Create an Architecture for AI
      Build your target state architecture from predefined best-practice building blocks.

      Deliver on Your Digital Product Vision
      Build a product vision your organization can take from strategy through execution.

      Enhance Your Solution Architecture Practices
      Ensure your software systems solution is architected to reflect stakeholders' short- and long-term needs.

      Apply Design Thinking to Build Empathy With the Business
      Use design thinking and journey mapping to make IT the business' go-to problem solver.

      Modernize Your SDLC
      Deliver quality software faster with new tools and practices.

      Drive Business Value With Off-the-Shelf AI
      A practical guide to ensure return on your off-the-shelf AI investment.

      Bibliography

      "Altran Helps Developers Write Better Code Faster with Azure AI." Microsoft, 2020.
      "Apply Design Thinking to Complex Teams, Problems, and Organizations." IBM, 2021.
      Bianca. "Unleashing the Power of AI in Code Generation: 10 Applications You Need to Know — AITechTrend." AITechTrend, 16 May 2023.
      Biggs, John. "Deep Code Cleans Your Code with the Power of AI." TechCrunch, 26 Apr 2018.
      "Chat GPT as a Tool for Business Analysis — the Brazilian BA." The Brazilian BA, 24 Jan 2023.
      Davenport, Thomas, and Randy Bean. "Big Data and AI Executive Survey 2019." New Vantage Partners, 2019.
      Davenport, Thomas, and Randy Bean. "Big Data and AI Executive Survey 2021." New Vantage Partners, 2021.
      Das, Tamal. "9 Best AI-Powered Code Completion for Productive Development." Geek flare, 5 Apr 2023.
      Gondrezick, Ilya. "Council Post: How AI Can Transform the Software Engineering Process." Forbes, 24 Apr 2020.
      "Generative AI Speeds up Software Development: Compass UOL Study." PR Newswire, 29 Mar 2023.
      "GitLab 2023 Global Develops Report Series." Gitlab, 2023.
      "Game Changer: The Startling Power Generative AI Is Bringing to Software Development." KPMG, 30 Jan 2023.
      "How AI Can Help with Requirements Analysis Tools." TechTarget, 28 July 2020.
      Indra lingam, Ashanta. "How Spotify Is Upleveling Their Entire Design Team." Framer, 2019.
      Ingle, Prathamesh. "Top Artificial Intelligence (AI) Tools That Can Generate Code to Help Programmers." Matchcoat, 1 Jan 2023.
      Kaur, Jagreet . "AI in Requirements Management | Benefits and Its Processes." Xenon Stack, 13 June 2023.
      Lange, Danny. "Game On: How Unity Is Extending the Power of Synthetic Data beyond the Gaming Industry." CIO, 17 Dec 2020.
      Lin, Ying. "10 Artificial Intelligence Statistics You Need to Know in 2020." OBERLO, 17 Mar. 2023.
      Mauran, Cecily. "Whoops, Samsung Workers Accidentally Leaked Trade Secrets via ChatGPT." Mashable, 6 Apr 2023.

      Go the Extra Mile With Blockchain

      • Buy Link or Shortcode: {j2store}130|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Data Management
      • Parent Category Link: /data-management
      • The transportation and logistics industry is facing a set of inherent flaws, such as high processing fees, fraudulent information, and lack of transparency, that blockchain is set to transform and alleviate.
      • Many companies have FOMO (fear of missing out), causing them to rush toward blockchain adoption without first identifying the optimal use case.

      Our Advice

      Critical Insight

      • Understand how blockchain can alleviate your pain points before rushing to adopt the technology. You have been hearing about blockchain for some time now and are feeling pressured to adopt it. Moreover, the series of issues hindering the transportation and logistics industry, such as the lack of transparency, poor cash flow management, and high processing fees, are frustrating business leaders and thereby adding additional pressure on CIOs to adopt the technology. While blockchain is complex, you should focus on its key features of transparency, integrity, efficiency, and security to identify how it can help your organization.
      • Ensure your use case is actually useful and can be valuable to your organization by selecting a business idea that is viable, feasible, and desirable. Applying design thinking tactics to your evaluation process provides a practical approach that will help you avoid wasting resources (both time and money) and hurting IT’s image in the eyes of the business. While it is easy to get excited and invest in a new technology to help maintain your image as a thought leader, you must ensure that your use case is fully developed prior to doing so.

      Impact and Result

      • Understand blockchain’s transformative potential for the transportation and logistics industry by breaking down how its key benefits can alleviate inherent industry flaws.
      • Identify business processes and stakeholders that could benefit from blockchain.
      • Build and evaluate an inventory of use cases to determine where blockchain could have the greatest impact on your organization.
      • Articulate the value and organizational fit of your proposed use case to the business to gain their buy-in and support.

      Go the Extra Mile With Blockchain Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why your organization should care about blockchain’s transformative potential for the transportation and logistics industry and how Info-Tech will support you as you identify and build your blockchain use case.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Evaluate why blockchain can disrupt the transportation and logistics industry

      Analyze the four key benefits of blockchain as they relate to the transportation and logistics industry to understand how the technology can resolve issues being experienced by industry incumbents.

      • Go the Extra Mile With Blockchain – Phase 1: Evaluate Why Blockchain Can Disrupt the Transportation and Logistics Industry
      • Blockchain Glossary

      2. Build and evaluate an inventory of use cases

      Brainstorm a set of blockchain use cases for your organization and apply design thinking tactics to evaluate and select the optimal one to pitch to your executives for prototyping.

      • Go the Extra Mile With Blockchain – Phase 2: Build and Evaluate an Inventory of Use Cases
      • Blockchain Use Case Evaluation Tool
      • Prototype One Pager
      [infographic]

      Establish High-Value IT Performance Dashboards and Metrics

      • Buy Link or Shortcode: {j2store}58|cart{/j2store}
      • member rating overall impact: 9.0/10 Overall Impact
      • member rating average dollars saved: $8,599 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: Performance Measurement
      • Parent Category Link: /performance-measurement

      While most CIOs understand the importance of using metrics to measure IT’s accomplishments, needs, and progress, when it comes to creating dashboards to communicate these metrics, they:

      • Concentrate on the data instead of the audience.
      • Display information specific to IT activities instead of showing how IT addresses business goals and problems.
      • Use overly complicated, out of context graphs that crowd the dashboard and confuse the viewer.

      Our Advice

      Critical Insight

      While most CIOs understand the importance of using metrics to measure IT’s accomplishments, needs, and progress, when it comes to creating dashboards to communicate these metrics, they:

      • Concentrate on the data instead of the audience.
      • Display information specific to IT activities instead of showing how IT addresses business goals and problems.
      • Use overly complicated, out of context graphs that crowd the dashboard and confuse the viewer.

      Impact and Result

      Use Info-Tech’s ready-made dashboards for executives to ensure you:

      • Speak to the right audience
      • About the right things
      • In the right quantity
      • Using the right measures
      • At the right time.

      Establish High-Value IT Performance Dashboards and Metrics Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish High-Value IT Performance Metrics and Dashboards – a document that walks you through Info-Tech’s ready-made IT dashboards.

      This blueprint guides you through reviewing Info-Tech’s IT dashboards for your audience and organization, then walks you through practical exercises to customize the dashboards to your audience and organization. The blueprint also gives practical guidance for delivering your dashboards and actioning your metrics.

      • Establish High-Value IT Performance Metrics and Dashboards Storyboard

      2. Info-Tech IT Dashboards and Guide – Ready-made IT dashboards for the CIO to communicate to the CXO.

      IT dashboards with visuals and metrics that are aligned and organized by CIO priority and that allow you to customize with your own data, eliminating 80% of the dashboard design work.

      • Info-Tech IT Dashboards and Guide

      3. IT Dashboard Workbook – A step-by-step tool to identify audience needs, translate needs into metrics, design your dashboard, and track/action your metrics.

      The IT Dashboard Workbook accompanies the Establish High Value IT Metrics and Dashboards blueprint and guides you through customizing the Info-Tech IT Dashboards to your audience, crafting your messages, delivering your dashboards to your audience, actioning metrics results, and addressing audience feedback.

      • Info-Tech IT Dashboards Workbook

      4. IT Metrics Library

      Reference the IT Metrics Library for ideas on metrics to use and how to measure them.

      • IT Metrics Library

      5. HR Metrics Library

      Reference the HR Metrics Library for ideas on metrics to use and how to measure them.

      • HR Metrics Library

      Infographic

      Workshop: Establish High-Value IT Performance Dashboards and Metrics

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Test Info-tech’s IT Dashboards Against Your Audience’s Needs and Translate Audience Needs Into Metrics

      The Purpose

      Introduce the Info-Tech IT Dashboards to give the participants an idea of how they can be used in their organization.

      Understand the importance of starting with the audience and understanding audience needs before thinking about data and metrics.

      Explain how audience needs translate into metrics.

      Key Benefits Achieved

      Understanding of where to begin when it comes to considering dashboards and metrics (the audience).

      Identified audience and needs and derived metrics from those identified needs.

      Activities

      1.1 Review the info-Tech IT Dashboards and document impressions for your organization.

      1.2 Identify your audience and their attributes.

      1.3 Identify timeline and deadlines for dashboards.

      1.4 Identify and prioritize audience needs and desired outcomes.

      1.5 Associate metrics to each need.

      1.6 Identify a dashboard for each metric.

      Outputs

      Initial impressions of Info-Tech IT Dashboards.

      Completed Tabs 2 and 3 of the IT Dashboard Workbook.

      2 Inventory Your Data and Assess Data Quality and Readiness

      The Purpose

      Provide guidance on how to derive metrics and assess data.

      Key Benefits Achieved

      Understand the importance of considering how you will measure each metric and get the data.

      Understand that measuring data can be costly and that sometimes you just can’t afford to get the measure or you can’t get the data period because the data isn’t there.

      Understand how to assess data quality and readiness.

      Activities

      2.1 Complete a data inventory for each metric on each dashboard: determine how you will measure the metric, the KPI, any observation biases, the location of the data, the type of source, the owner, and the security/compliance requirements.

      2.2 Assess data quality for availability, accuracy, and standardization.

      2.3 Assess data readiness and the frequency of measurement and reporting.

      Outputs

      Completed Tab 4 of the IT Dashboard Workbook.

      3 Design and Build Your Dashboards

      The Purpose

      Guide participants in customizing the Info-Tech IT Dashboards with the data identified in previous steps.

      This step may vary as some participants may not need to alter the Info-Tech IT Dashboards other than to add their own data.

      Key Benefits Achieved

      Understanding of how to customize the dashboards to the participants’ organization.

      Activities

      3.1 Revisit the Info-Tech IT Dashboards and use the identified metrics to determine what should change in them.

      3.2 Build your dashboards by editing the Info-Tech IT Dashboards with your changes as planned in Step 3.1.

      Outputs

      Assessed Info-Tech IT Dashboards for your audience’s needs.

      Completed Tab 5 of the IT Dashboard Workbook.

      Finalized dashboards.

      4 Deliver Your Dashboard and Plan to Action Metrics

      The Purpose

      Guide participants in learning how to create a story around the dashboards.

      Guide participants in planning to action metrics and where to record results.

      Guide participants in how to address results of metrics and feedback from audience about dashboards.

      Key Benefits Achieved

      Participants understand how to speak to their dashboards.

      Participants understand how to action metrics results and feedback about dashboards.

      Activities

      4.1 Craft your story.

      4.2 Practice delivering your story.

      4.3 Plan to action your metrics.

      4.4 Understand how to record and address your results.

      Outputs

      Completed Tabs 6 and 7 of the IT Dashboard Workbook.

      5 Next Steps and Wrap-Up

      The Purpose

      Finalize work outstanding from previous steps and answer any questions.

      Key Benefits Achieved

      Participants have thought about and documented how to customize the Info-Tech IT Dashboards to use in their organization, and they have everything they need to customize the dashboards with their own metrics and visuals (if necessary).

      Activities

      5.1 Complete in-progress deliverables from previous four days.

      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Outputs

      Completed IT Dashboards tailored to your organization.

      Completed IT Dashboard Workbook

      Further reading

      Establish High-Value IT Performance Dashboards and Metrics

      Spend less time struggling with visuals and more time communicating about what matters to your executives.

      Analyst Perspective

      A dashboard is a communication tool that helps executives make data-driven decisions

      CIOs naturally gravitate toward data and data analysis. This is their strength. They lean into this strength, using data to drive decisions, track performance, and set targets because they know good data drives good decisions.

      However, when it comes to interpreting and communicating this complex information to executives who may be less familiar with data, CIOs struggle, often falling back on showing IT activity level data instead of what the executives care about. This results in missed opportunities to tell IT’s unique story, secure funding, reveal important trends, or highlight key opportunities for the organization.

      Break through these traditional barriers by using Info-Tech’s ready-made IT dashboards. Spend less time agonizing over visuals and layout and more time concentrating on delivering IT information that moves the organization forward.

      Photo of Diana MacPherson
      Diana MacPherson
      Senior Research Analyst, CIO
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      While most CIOs understand the importance of using metrics to measure IT’s accomplishments, needs, and progress, when it comes to creating dashboards to communicate these metrics, they:

      • Concentrate on the data instead of the audience.
      • Display information specific to IT activities instead of showing how IT addresses business goals and problems.
      • Use overly complicated, out of context graphs that crowd the dashboard and confuse the viewer.

      Common Obstacles

      CIOs often experience these challenges because they:

      • Have a natural bias toward data and see it as the whole story instead of a supporting character in a larger narrative.
      • Assume that the IT activity metrics that are easy to get and useful to them are equally interesting to all their stakeholders.
      • Do not have experience communicating visually to an audience unfamiliar with IT operations or lingo.

      Info-Tech’s Approach

      Use Info-Tech’s ready-made dashboards for executives to ensure you:

      • Speak to the right audience
      • About the right things
      • In the right quantity
      • Using the right measures
      • At the right time

      Info-Tech Insight

      The purpose of a dashboard is to drive decision making. A well designed dashboard presents relevant, clear, concise insights that help executives make data-driven decisions.

      Your challenge

      CIOs struggle to select the right metrics and dashboards to communicate IT’s accomplishments, needs, and progress to their executives. CIOs:

      • Fail to tailor metrics to their audience, often presenting graphs that are familiar and useful to them, but not their executives. This results in dashboards full of IT activities that executives neither understand nor find valuable.
      • Do not consider the timeliness of their metrics, which has the same effect as not tailoring their metrics: the executives do not care about the metrics they are shown.
      • Present too many metrics, which not only clutters the board but also dilutes the message the CIO needs to communicate.
      • Do not act on the results of their metrics and show progress, which makes metrics meaningless. Why measure something if you won’t act on the results?

      The bottom line: CIOs often communicate to the wrong audience, about the wrong things, in the wrong amount, using the wrong metrics, at the wrong time.

      In a survey of 500 executives, organizations that struggled with dashboards identified the reasons as:
      61% Inadequate context
      54% Information overload

      — Source: Exasol

      CXOs and CIOs agree that IT performance metrics need improvement

      When asked which performance indicators should be implemented in your business, CXOs and CIOs both agree that IT needs to improve its metrics across several activity areas: technology performance, cost and salary, and risk.

      A diagram that shows performance indicators and metrics from cxo and cio.

      The Info-Tech IT Dashboards center key metrics around these activities ensuring you align your metrics to the needs of your CXO audience.

      Info-Tech CEO/CIO Alignment Survey Benchmark Report n=666

      The Info-Tech IT Dashboards are organized by the top CIO priorities

      The top six areas that a CIO needs to prioritize and measure outcomes, no matter your organization or industry, are:

      • Managing to a budget: Reducing operational costs and increasing strategic IT spend
      • Customer/constituent satisfaction: Directly and indirectly impacting customer experience.
      • Risk management: Actively knowing and mitigating threats to the organization.
      • Delivering on business objectives: Aligning IT initiatives to the vision of the organization.
      • Employee engagement: Creating an IT workforce of engaged and purpose-driven people.
      • Business leadership relations: Establishing a network of influential business leaders.

      Deliver High-Value IT Dashboards to Your Executives

      A diagram that shows Delivering High-Value IT Dashboards to Your Executives

      Info-Tech’s approach

      Deliver High-Value Dashboards to Your Executives

      A diagram that shows High-Value Dashboard Process.

      Executives recognize the benefits of dashboards:
      87% of respondents to an Exasol study agreed that their organization’s leadership team would make more data-driven decisions if insights were presented in a simpler and more understandable way
      (Source: Exasol)

      The Info-Tech difference:

      We created dashboards for you so you don’t have to!

      1. Eliminate 80% of the dashboard design work by selecting from our ready-made Info-Tech IT Dashboards.
      2. Use our IT Dashboard Workbook to adjust the dashboards to your audience and organization.
      3. Follow our blueprint and IT Dashboard Workbook tool to craft, and deliver your dashboard to your CXO team, then action feedback from your audience to continuously improve.

      Info-Tech’s methodology for establishing high-value dashboards

      1. Test Info-Tech’s IT Dashboards Against Your Audience’s Needs

      Phase Steps

      1. Validate Info-Tech’s IT Dashboards for Your Audience
      2. Identify and Document Your Audience’s Needs

      Phase Outcomes

      1. Initial impressions of Info-Tech IT Dashboards
      2. Completed Tabs 2 of the IT Dashboard Workbook

      2. Translate Audience Needs into Metrics

      Phase Steps

      1. Review Info-Tech’s IT Dashboards for Your Audience
      2. Derive Metrics from Audience Needs
      3. Associate metrics to Dashboards

      Phase Outcomes

      1. Completed IT Tab 3 of IT Dashboard Workbook

      3. Ready Your Data for Dashboards

      Phase Steps

      1. Assess Data Inventory
      2. Assess Data Quality
      3. Assess Data Readiness
      4. Assess Data Frequency

      Phase Outcomes

      1. Assessed Info-Tech IT Dashboards for your audience’s needs
      2. Completed Tab 5 of the IT Dashboard Workbook
      3. Finalized dashboards

      4. Build and Deliver Your Dashboards

      Phase Steps

      1. Design Your Dashboard
      2. Update Your Dashboards
      3. Craft Your Story and Deliver Your Dashboards

      Phase Outcomes

      1. Completed IT Tab 5 and 6 of IT Dashboard Workbook and finalized dashboards

      5. Plan, Record, and Action Your Metrics

      Phase Steps

      1. Plan How to Record Metrics
      2. Record and Action Metrics

      Phase Outcomes

      1. Completed IT Dashboards tailored to your organization
      2. Completed IT Dashboard Workbook

      How to Use This Blueprint

      Choose the path that works for you

      A diagram that shows path of using this blueprint.

      The Info-Tech IT Dashboards address several needs:

      1. New to dashboards and metrics and not sure where to begin? Let the phases in the blueprint guide you in using Info-Tech’s IT Dashboards to create your own dashboards.
      2. Already know who your audience is and what you want to show? Augment the Info-Tech’s IT Dashboards framework with your own data and visuals.
      3. Already have a tool you would like to use? Use the Info-Tech’s IT Dashboards as a design document to customize your tool.

      Insight Summary

      The need for easy-to-consume data is on the rise making dashboards a vital data communication tool.

      70%: Of employees will be expected to use data heavily by 2025, an increase from 40% in 2018.
      — Source: Tableau

      Overarching insight

      A dashboard’s primary purpose is to drive action. It may also serve secondary purposes to update, educate, and communicate, but if a dashboard does not drive action, it is not serving its purpose.

      Insight 1

      Start with the audience. Resist the urge to start with the data. Think about who your audience is, what internal and external environmental factors influence them, what problems they need to solve, what goals they need to achieve, then tailor the metrics and dashboards to suit.

      Insight 2

      Avoid showing IT activity-level metrics. Instead use CIO priority-based metrics to report on what matters to the organization. The Info-Tech IT Dashboards are organized by the CIO priorities: risks, financials, talent, and strategic initiatives.

      Insight 3

      Dashboards show the what not the why. Do not assume your audience will draw the same conclusions from your graphs and charts as you do. Provide the why by interpreting the results, adding insights and calls to action, and marking key areas for discussion.

      Insight 4

      A dashboard is a communication tool and should reflect the characteristics of good communication. Be clear, concise, consistent, and relevant.

      Insight 5

      Action your data. Act and report progress on your metrics. Gathering metrics has a cost, so if you do not plan to action a metric, do not measure it.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      Photo of Dashboards

      Key deliverable: Dashboards

      Ready-made risk, financials, talent, and strategic initiatives dashboards that organize your data in a visually appealing way so you can concentrate on the metrics and communication.

      Photo of IT Dashboard Workbook

      IT Dashboard Workbook

      The IT Dashboard Workbook keeps all your metrics, data, and dashboard work in one handy file!

      Photo of IT Dashboard Guide

      IT Dashboard Guide

      The IT Dashboard Guide provides the Info-Tech IT Dashboards and information about how to use them.

      Blueprint benefits

      CIO Benefits

      • Reduces the burden of figuring out what metrics to show executives and how to categorize and arrange the visuals.
      • Increases audience engagement through tools and methods that guide CIOs through tailoring metrics and dashboards to audience needs.
      • Simplifies CIO messages so executives better understand IT needs and value.
      • Provides CIOs with the tools to demonstrate transparency and competency to executive leaders.
      • Provides tools and techniques for regular review and action planning of metrics results, which leads to improved performance, efficiency, and effectiveness.

      Business Benefits

      • Provides a richer understanding of the IT landscape and a clearer connection of how IT needs and issues impact the organization.
      • Increases understanding of the IT team’s contribution to achieving business outcomes.
      • Provides visibility into IT and business trends.
      • Speeds up decision making by providing insights and interpretations to complex situations.

      Measure the value of this blueprint

      Realize measurable benefits after using Info-Tech’s approach:

      Determining what you should measure, what visuals you should use, and how you should organize your visuals, is time consuming. Calculate the time it has taken you to research what metrics you should show, create the visuals, figure out how to categorize the visuals, and layout your visuals. Typically, this takes about 480 hours of time. Use the ready-made Info-Tech IT Dashboards and the IT Dashboard Workbook to quickly put together a set of dashboards to present your CXO. Using these tools will save approximately 480 hours.

      A study at the University of Minnesota shows that visual presentations are 43% more effective at persuading their audiences (Bonsignore). Estimate how persuasive you are now by averaging how often you have convinced your audience to take a specific course of action. After using the Info-Tech IT Dashboards and visual story telling techniques described in this blueprint, average again. You should be 43% more persuasive.

      Further value comes from making decisions faster. Baseline how long it takes, on average, for your executive team to make a decision before using Info-Tech’s IT Dashboards then time how long decisions take when you use your Info-Tech’s IT Dashboards. Your audience should reach decisions 21% faster according to studies at Stanford University and the Wharton School if business (Bonsignore).

      Case Study

      Visuals don’t have to be fancy to communicate clear messages.

      • Industry: Construction
      • Source: Anonymous interview participant

      Challenge

      Year after year, the CIO of a construction company attended business planning with the Board to secure funding for the year. One year, the CEO interrupted and said, “You're asking me for £17 million. You asked me for £14 million last year and you asked me for £12 million the year before that. I don't quite understand what we get for our money.”

      The CEO could not understand how fixing laptops would cost £17 million and for years no one had been able to justify the IT spend.

      Solutions

      The CIO worked with his team to produce a simple one-page bubble diagram representing each IT department. Each bubble included the total costs to deliver the service, along with the number of employees. The larger the bubble, the higher the cost. The CIO brought each bubble to life as he explained to the Board what each department did.

      The Board saw, for example, that IT had architects who thought about the design of a service, where it was going, the life cycle of that service, and the new products that were coming out. They understood what those services cost and knew how many architects IT had to provide for those services.

      Recommendations

      The CEO remarked that he finally understood why the CIO needed £17 million. He even saw that the costs for some IT departments were low for the amount of people and offered to pay IT staff more (something the CIO had requested for years).

      Each year the CIO used the same slide to justify IT costs and when the CIO needed further investment for things like security or new products, an upgrade, or end of life support, the sign-offs came very quickly because the Board understood what IT was doing and that IT wasn't a bottomless pit.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit
      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation
      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      Workshop
      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting
      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      Guided Implementation

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 8 to 12 calls over the course of 4 to 6 months.

      What does a typical GI on this topic look like?

      A diagram that shows Guided Implementation in 5 phases.

      Workshop overview

      Day 1: Test Info-tech’s IT Dashboards Against Your Audience’s Needs and Translate Audience Needs Into Metrics

      Activities
      1.1 Review the info-Tech IT Dashboards and document impressions for your organization.
      1.2 Identify your audience’s attributes.
      1.3 Identify timeline and deadlines for dashboards.
      1.4 Identify and prioritize audience needs and desired outcomes.
      1.5 Associate metrics to each need.
      1.6 Identify a dashboard for each metric.

      Deliverables
      1. Initial impressions of Info-Tech IT Dashboards.
      2. Completed Tabs 2 and 3 of the IT Dashboard Workbook.

      Day 2: Inventory Your Data; Assess Data Quality and Readiness

      Activities
      2.1 Complete a data inventory for each metric on each dashboard: determine how you will measure the metric, the KPI, any observation biases, the location of the data, the type of source, and the owner and security/compliance requirements.
      2.2 Assess data quality for availability, accuracy, and standardization.
      2.3 Assess data readiness and frequency of measurement and reporting.

      Deliverables
      1. Completed Tab 4 of the IT Dashboard Workbook.

      Day 3: Design and Build Your Dashboards

      Activities
      3.1 Revisit the Info-Tech IT Dashboards and use the identified metrics to determine what should change on the dashboards.
      3.2 Build your dashboards by editing the Info-Tech IT Dashboards with your changes as planned in Step 3.1.

      Deliverables
      1. Assessed Info-Tech IT Dashboards for your audience’s needs.
      2. Completed Tab 5 of the IT Dashboard Workbook.
      3. Finalized dashboards.

      Day 4: Deliver Your Dashboard and Plan to Action Metrics

      Activities
      4.1 Craft your story.
      4.2 Practice delivering your story.
      4.3 Plan to action your metrics.
      4.4 Understand how to record and address your results.

      Deliverables
      1. Completed Tabs 6 and 7 of the IT Dashboard Workbook.

      Day 5: Next Steps and Wrap-Up (offsite)

      Activities
      5.1 Complete in-progress deliverables from previous four days
      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Deliverables
      1. Completed IT Dashboards tailored to your organization.
      2. Completed IT Dashboard Workbook.

      Contact your account representative for more information.

      workshops@infotech.com
      1-888-670-8889

      What is an IT dashboard?

      A photo of Risks - Protect the Organization. A photo of Financials: Transparent, fiscal responsibility
      A photo of talent attrat and retain top talent A photo of Strategic Initiatives: Deliver Value to Customers.

      An IT dashboard is…
      a visual representation of data, and its main purpose is to drive actions. Well-designed dashboards use an easy to consume presentation style free of clutter. They present their audience with a curated set of visuals that present meaningful metrics to their audience.

      Dashboards can be both automatically or manually updated and can show information that is dynamic or a snapshot in time.

      Info-Tech IT Dashboards

      Review the Info-Tech IT Dashboards

      We created dashboards so you don’t have to.

      A photo of Risks - Protect the Organization. A photo of Financials: Transparent, fiscal responsibility A photo of talent attrat and retain top talent A photo of Strategic Initiatives: Deliver Value to Customers.

      Use the link below to download the Info-Tech IT Dashboards and consider the following:

      1. What are your initial reactions to the dashboards?
      2. Are the visuals appealing? If so, what makes them appealing?
      3. Can you use these dashboards in your organization? What makes them usable?
      4. How would you use these dashboards to speak your own IT information to your audience?

      Download the Info-Tech IT Dashboards

      Why Use Dashboards When We Have Data?

      How graphics affect us

      Cognitively

      • Engage our imagination
      • Stimulate the brain
      • Heighten creative thinking
      • Enhance or affect emotions

      Emotionally

      • Enhance comprehension
      • Increase recollection
      • Elevate communication
      • Improve retention

      Visual clues

      • Help decode text
      • Attract attention
      • Increase memory

      Persuasion

      • 43% more effective than text alone

      — Source: (Vogel et al.)

      Phase 1

      Test Info-Tech’s IT Dashboards Against Your Audience’s Needs

      A diagram that shows phase 1 to 5.

      This phase will walk you through the following:

      • Documenting impressions for using Info-Tech’s IT Dashboards for your audience.
      • Documenting your audience and their needs and metrics for your IT dashboards

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Info-Tech IT Dashboard organization and audience

      We created a compelling way to organize IT dashboards so you don’t have to. The Info-Tech IT Dashboards are organized by CIO Priorities, and these are consistent irrespective of industry or organization. This is a constant that you can organize your metrics around.

      A photo of Info-Tech IT Dashboards

      Dashboard Customization

      The categories represent a constant around which you can change the order; for example, if your CXO is more focused on Financials, you can switch the Financials dashboard to appear first.

      The Info-Tech IT Dashboards are aimed at a CXO audience so if your audience is the CXO, then you may decide to change very little, but you can customize any visual to appeal to your audience.

      Phase 1 will get you started with your audience.

      Always start with the audience

      …and not the data!

      Reliable, accurate data plays a critical role in dashboards, but data is only worthwhile if it is relevant to the audience who consumes it, and dashboards are only as meaningful as the data and metrics they represent.

      Instead of starting with the data, start with the audience. The more IT understands about the audience, the more relevant the metrics will be to their audience and the more aligned leadership will be with IT.

      Don’t forget yourself and who you are. Your audience will have certain preconceived notions about who you are and what you do. Consider these when you think about what you want your audience to know.

      46% executives identify lack of customization to individual user needs as a reason they struggle with dashboards.
      — Source: (Exasol)

      Resist the Data-First Temptation

      If you find yourself thinking about data and you haven’t thought about your audience, pull yourself back to the audience.

      Ask first Ask later
      Who is this dashboard for? What data should I show?
      How will the audience use the dashboard to make decisions? Where do I get the data?
      How can I show what matters to the audience? How much effort is required to get the data?

      Meaningful measures rely on understanding your audience and their needs

      It is crucial to think about who your audience is so that you can translate their needs into metrics and create meaningful visuals for your dashboards.

      A diagram that highlights step 1-3 of understanding your audience in the high-value dashboard process.

      Step 1.1

      Review and Validate Info-Tech’s IT Dashboards for Your Audience

      Activities:
      1.1.1 Examine Info-Tech’s IT Dashboards.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 1.1 & 1.2 to Test Info-Tech’s IT Dashboards Against Your Audience’s Needs.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Info-Tech dashboards reviewed for your organization’s audience.

      1.1.1 Examine the Info-Tech IT Dashboards

      30 minutes

      1. If you haven’t already downloaded the Info-Tech IT Dashboards, click the link below to download.
      2. Complete a quick review of the dashboards and consider how your audience would receive them.
      3. Document your thoughts, with special emphasis on your audience in the Info-Tech Dashboard Impressions slide.

      A diagram that shows Info-Tech IT Dashboards

      Download Info-Tech IT Dashboards

      Reviewing visuals can help you think about how your audience will respond to them

      Jot down your thoughts below. You can refer to this later as you consider your audience.

      Consider:

      • Who is your dashboard audience?
      • Are their needs different from the Info-Tech IT Dashboard audience’s? If so, how?
      • Will the visuals work for your audience on each dashboard?
      • Will the order of the dashboards work for your audience?
      • What is missing?

      Step 1.2

      Identify and Document Your Audience’s Needs

      Activities:
      1.2.1 Document your audience’s needs in the IT Dashboard Workbook.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 1.1 & 1.2 to Test Info-Tech’s IT Dashboards Against Your Audience’s Needs.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Audience details documented in IT Dashboard Workbook

      Identify Your Audience and dig deeper to understand their needs

      Connect with your audience

      • Who is your audience?
      • What does your audience care about? What matters to them?
      • How is their individual success measured? What are their key performance indicators (KPIs)?
      • Connect the challenges and pain points of your audience to how IT can help alleviate those pain points:
        • For example, poor financial performance could be due to a lack of digitization. Identify areas where IT can help alleviate this issue.
        • Try to uncover the root cause behind the need. Root causes are often tied to broad organizational objectives, so think about how IT can impact those objectives.

      Validate the needs you’ve uncovered with the audience to ensure you have not misinterpreted them and clarify the desired timeline and deadline for the dashboard.

      Document audiences and needs on Tab 2 of the IT Dashboard Workbook

      Typical Audience Needs
      Senior Leadership
      • Inform strategic planning and track progress toward objectives.
      • Understand critical challenges.
      • Ensure risks are managed.
      • Ensure budgets are managed.
      Board of Directors
      • Understand organizational risks.
      • Ensure organization is fiscally healthy.
      Business Partners
      • Support strategic workforce planning.
      • Surface upcoming risks to workforce.
      CFO
      • IT Spend
      • Budget Health and Risks

      Prioritize and select audience needs that your dashboard will address

      Prioritize needs by asking:

      • Which needs represent the largest value to the entire organization (i.e. needs that impact more of the organization than just the audience)?
      • Which needs will have the largest impact on the audience’s success?
      • Which needs are likely to drive action (e.g. if supporting a decision, is the audience likely to be amenable to changing the way they make that decision based on the data)?

      Select three to five of the highest priority needs for each audience to include on a dashboard.

      Prioritize needs on Tab 2 of the IT Dashboard Workbook

      A diagram that shows 3 tiers of high priority, medium priority, and low priority.

      1.2.1 Document Your Audience Needs in the IT Dashboard Workbook

      1 hour

      Click the link below to download the IT Dashboard Workbook and open the file. Select Tab 2. The workbook contains pre-populated text that reflects information about Info-Tech’s IT Dashboards. You may want to keep the pre-populated text as reference as you identify your own audience then remove after you have completed your updates.

      A table of documenting audience, including key attributes, desired timeline, deadline, needs, and priority.

      Download Info-Tech IT Dashboard Workbook

      Phase 2

      Translate Audience Needs Into Metrics

      A diagram that shows phase 1 to 5.

      This phase will walk you through the following:

      • Revisiting the Info-Tech IT Dashboards for your audience.
      • Documenting your prioritized audience’s needs and the desired outcome of each in the IT Dashboard Workbook.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Linking audience needs to metrics has positive outcomes

      When you present metrics that your audience cares about, you:

      • Deliver real value and demonstrate IT’s value as a trusted partner.
      • Improve the relationship between the business and IT.
      • Enlighten the business about what IT does and how it is connected to the organization.

      29% of respondents to The Economist Intelligence Unit survey cited inadequate collaboration between IT and the business as one of the top barriers to the organization’s digital objectives.
      — Source: Watson, Morag W., et al.

      Dashboard Customization

      The Info-Tech IT Dashboards use measures for each dashboard that correspond with what the audience (CXO) cares about. You can find these measures in the IT Dashboard Workbook. If your audience is the CXO, you may have to change a little but you should still validate the needs and metrics in the IT Dashboard Workbook.

      Phase 2 covers the process of translating needs into metrics.

      Once you know what your audience needs, you know what to measure

      A diagram that highlights step 4-5 of knowing your audience needs in the high-value dashboard process.

      Step 2.1

      Document Desired Outcomes for Each Prioritized Audience Need

      Activities:
      2.1.1 Compare the Info-Tech IT Dashboards with your audience’s needs.
      2.1.2 Document prioritized audience needs and the desired outcome of each in the IT Dashboard Workbook.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 2.1 to 2.3 to translate audience needs into metrics.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Understanding of how well Info-Tech IT Dashboards address audience needs.
      • Documented desired outcomes for each audience need.

      2.1.1 Revisit Info-Tech’s IT Dashboards and Review for Your Audience

      30 minutes

      1. If you haven’t already downloaded the Info-Tech IT Dashboards, click the link below to download.
      2. Click the link below to download the Info-Tech IT Dashboard Workbook.
      3. Recall your first impressions of the dashboards that you recorded on earlier in Phase 1 and open up the audience and needs information you documented in Tab 2 of the IT Dashboard Workbook.
      4. Compare the dashboards with your audience’s needs that you documented on Tab 2.
      5. Record any updates to your thoughts or impressions on the next slide. Think about any changes to the dashboards that you would make so that you can reference it when you build the dashboards.

      Download Info-Tech IT Dashboard Workbook

      A photo of Info-Tech IT Dashboards
      The Info-Tech IT Dashboards contain a set of monthly metrics tailored toward a CXO audience.

      Download Info-Tech IT Dashboards

      Knowing what your audience needs, do the metrics the visuals reflect address them?

      Any changes to the Info-Tech IT Dashboards?

      Consider:

      • Are your audience’s needs already reflected in the visuals in each of the dashboards? If so, validate this in the next activity by reviewing the prioritized needs, desired outcomes, and associated metrics already documented in the IT Dashboard Workbook.
      • Are there any visuals your audience would need that you don’t see reflected in the dashboards? Write them here to use in the next exercise.

      Desired outcomes make identifying metrics easier

      When it’s not immediately apparent what the link between needs and metrics is, brainstorm desired outcomes.

      A diagram that shows an example of desired outcomes

      2.1.2 Document your audience’s desired outcome per prioritized need

      Now that you’ve examined the Info-Tech IT Dashboards and considered the needs of your audience, it is time to understand the outcomes and goals of each need so that you can translate your audience’s needs into metrics.

      1 hour

      Click the link below to download the IT Dashboard Workbook and open the file. Select Tab 3. The workbook contains pre-populated text that reflects information about Info-Tech’s IT Dashboards. You may want to keep the pre-populated text as reference as you identify your own audience then remove it after you have completed your updates.

      A diagram that shows desired outcome per prioritized need

      Download Info-Tech IT Dashboard Workbook

      Deriving Meaningful Metrics

      Once you know the desired outcomes, you can identify meaningful metrics

      A diagram of an example of meaningful metrics.

      Common Metrics Mistakes

      Avoid the following oversights when selecting your metrics.

      A diagram that shows 7 metrics mistakes

      Step 2.2

      Derive Metrics From Audience Needs

      Activities:
      2.2.1 Derive metrics using the Info-Tech IT Dashboards and the IT Dashboard Workbook.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 2.1 to 2.3 to translate audience needs into metrics.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Documented metrics for audience needs.

      2.2.1 Derive metrics from desired outcomes

      Now that you have completed the desired outcomes, you can determine if you are meeting those desired outcomes. If you struggle with the metrics, revisit the desired outcomes. It could be that they are not measurable or are not specific enough.

      2 hours

      Click the link below to download the IT Dashboard Workbook and open the file. Select Tab 3. The workbook contains pre-populated text that reflects information about Info-Tech’s IT Dashboards. You may want to keep the pre-populated text as reference as you identify your own audience then remove it after you have completed your updates.

      A diagram that shows derive metrics from desired outcomes

      Download Info-Tech IT Dashboard Workbook

      Download IT Metrics Library

      Download HR Metrics Library

      Step 2.3

      Associate Metrics to Dashboards

      Activities:
      2.3.1 Review the metrics and identify which dashboard they should appear on.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 2.1 to 2.3 to translate audience needs into metrics.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Metrics associated to each dashboard.

      2.3.1 Associate metrics to dashboards

      30 minutes

      Once you have identified all your metrics from Step 2.2, identify which dashboard they should appear on. As with all activities, if the Info-Tech IT Dashboard meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information.

      A diagram that shows associate metrics to dashboards

      Phase 3

      Ready Your Data for Dashboards

      A diagram that shows phase 1 to 5.

      This phase will walk you through the following:

      • Inventorying your data
      • Assessing your data quality
      • Determining data readiness
      • Determining data measurement frequency

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Can you measure your metrics?

      Once appropriate service metrics are derived from business objectives, the next step is to determine how easily you can get your metric.

      A diagram that highlights step 5 of measuring your metrics in the high-value dashboard process.

      Make sure you select data that your audience trusts

      40% of organizations say individuals within the business do not trust data insights.
      — Source: Experian, 2020

      Phase 3 covers the process of identifying data for each metric, creating a data inventory, assessing the readiness of your data, and documenting the frequency of measuring your data. Once complete, you will have a guide to help you add data to your dashboards.

      Step 3.1

      Assess Data Inventory

      Activities:
      3.1.1 Download the IT Dashboard Workbook and complete the data inventory section on Tab 4.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 3.1 to 3.4 to ready your data for dashboards.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Documented data inventory for each metric.

      3.1.1 Data Inventory

      1 hour

      Click the link below to download the IT Dashboard Workbook and open the file. Select Tab 4. The pre-populated text is arranged into the tables according to the dashboard they appear on; you may need to scroll down to see all the dashboard tables.

      Create a data inventory by placing each metric identified on Tab 3 into the corresponding dashboard table. Complete each column as described below.

      A diagram that shows 9 columns of data inventory.

      Metrics Libraries: Use the IT Metrics Library and HR Metrics Library for ideas for metrics to use and how to measure them.

      Download Info-Tech IT Dashboard Workbook

      Step 3.2

      Assess Data Quality

      Activities:
      3.2.1 Use the IT Dashboard Workbook to complete an assessment of data quality on Tab 4.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 3.1 to 3.4 to ready your data for dashboards.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Documented data quality assessment for each metric.

      3.2.1 Assess Data Quality

      1 hour

      Document the data quality on Tab 4 of the IT Dashboard Workbook by filling in the data availability, data accuracy, and data standardization columns as described below.

      A diagram that shows data availability, data accuracy, and data standardization columns.

      Data quality is a struggle for many organizations. Consider how much uncertainty you can tolerate and what would be required to improve your data quality to an acceptable level. Consider cost, technological resources, people resources, and time required.

      Download Info-Tech IT Dashboard Workbook

      Step 3.3

      Assess Data Readiness

      Activities:
      3.3.1 Use the IT Dashboard Workbook to determine the readiness of your data.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 3.1 to 3.4 to ready your data for dashboards.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Documented data readiness for each metric

      3.3.1 Determine Data Readiness

      1 hour

      Once the data quality has been documented and examined, complete the Data Readiness section of Tab 4 in the Info-Tech IT Dashboard Workbook. Select a readiness classification using the definitions below. Use the readiness of your data to determine the level of effort required to obtain the data and consider the constraints and cost/ROI to implement new technology or revise processes and data gathering to produce the data.

      A diagram that shows data readiness section

      Remember: Although in most cases, simple formulas that can be easily understood are the best approach, both because effort is lower and data that is not manipulated is more trustworthy, do not abandon data because it is not perfect but instead plan to make it easier to obtain.

      Download Info-Tech IT Dashboard Workbook

      Step 3.4

      Assess Data Frequency

      Activities:
      3.4.1 Use the IT Dashboard Workbook to determine the readiness of your data and how frequently you will measure your data.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 3.1 to 3.4 to assess data inventory, quality, and readiness.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Documented frequency of measurement for each metric.

      3.4.1 Document Planned Frequency of measurement

      10 minutes

      Document the planned frequency of measurement for all your metrics on Tab 4 of the IT Dashboard Workbook.

      For each metric, determine how often you will need to refresh it on the dashboard and select a frequency from the drop down. The Info-tech IT Dashboards assume a monthly refresh.

      Download Info-Tech IT Dashboard Workbook

      Phase 4

      Build and Deliver Your Dashboards

      A diagram that shows phase 1 to 5.

      This phase will walk you through the following:

      • Designing your dashboards
      • Updating your dashboards
      • Crafting your story
      • Delivering your dashboards

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Using your dashboard to tell your story with visuals

      Now that you have linked metrics to the needs of your audience and you understand how to get your data, it is time to start building your dashboards.

      A diagram that highlights step 6 of creating meaningful visuals in the high-value dashboard process.

      Using visual language

      • Shortens meetings by 24%
      • Increases the ability to reach consensus by 21%
      • Strengthens persuasiveness by 43%

      — Source: American Management Association

      Phase 4 guides you through using the Info-Tech IT Dashboard visuals for your audience’s needs and your story.

      Step 4.1

      Design Your Dashboard

      Activities:
      4.1.1 Plan and validate dashboard metrics, data, level of effort and visuals.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 4.1 to 4.3 to build and deliver your dashboards.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Identified and validated metrics, data, and visuals for your IT dashboards.

      Use clear visuals that avoid distracting the audience

      Which visual is better to present?

      Sample A:
      A photo of Sample A visuals

      Sample B:
      A diagram Sample B visuals

      Select the appropriate visuals

      Identify the purpose of the visualization. Determine which of the four categories below aligns with the story and choose the appropriate visual to display the data.

      Relationship

      A photo of Scatterplots
      Scatterplots

      • Used to show relationships between two variables.
      • Can be difficult to interpret for audiences that are not familiar with them.

      Distribution

      A photo of Histogram
      Histogram

      • Use a histogram to show spread of a given numeric variable.
      • Can be used to organize groups of data points.
      • Requires continuous data.
      • Can make comparisons difficult.

      A photo of Scatterplot
      Scatterplot

      • Can show correlation between variables.
      • Show each data plot, making it easier to compare.

      Composition

      A photo of Pie chart
      Pie chart

      • Use pie charts to show different categories.
      • Avoid pie charts with numerous slices.
      • Provide numbers alongside slices, as it can be difficult to compare slices based on size alone.

      A photo of Table
      Table

      • Use tables when there are a large number of categories.
      • Presents information in a simple way.

      Comparison

      A photo of Bar graph
      Bar graph

      • Use to compare categories.
      • Easy to understand, familiar format.

      A photo of Line chart
      Line chart

      • Use to show trends or changes over time.
      • Clear and easy to analyze.

      (Calzon)

      Examples of data visualization

      To compare categories, use a bar chart:
      2 examples of bar chart
      Conclusion: Visualizing the spend in various areas helps prioritize.


      To show trends, use a line graph:
      An example of line graph.
      Conclusion: Overlaying a trend line on revenue per employee helps justify headcount costs.


      To show simple results, text is sometimes more clear:
      A diagram that shows examples of text and graphics.
      Conclusion: Text with meaningful graphics conveys messages quickly.


      To display relative percentages of values, use a pie chart:
      An example of pie chart.
      Conclusion: Displaying proportions in a pie chart gives an at-a-glance understanding of the amount any area uses.

      Choose effective colors and design

      Select colors that will enhance the story

      • Use color strategically to help draw the audience’s attention and highlight key information.
      • Choose two to three colors to use consistently throughout the dashboard, as too many colors will be distracting to the audience.
      • Use colors that connect with the audience (e.g., organization or department colors).
      • Don’t use colors that are too similar in shade or brightness level, as those with colorblindness might have difficulty discerning them.

      Keep the design simple and clear

      • Leave white space to separate sections and keep the dashboard simple.
      • Don’t measure everything; show just enough to address the audience’s needs.
      • Use blank space between data points to provide natural contrast (e.g., leaving space between each bar on a bar graph). Don’t rely on contrast between colors to separate data (Miller).
      • Label each data point directly instead of using a separate key, so anyone who has difficulty discerning color can still interpret the data (Miller).

      Example

      A example that shows colours and design of a chart.

      Checklist to build compelling visuals in your presentation

      Leverage this checklist to ensure you are creating the perfect visuals and graphs for your presentation.

      Checklist:

      • Do the visuals grab the audience’s attention?
      • Will the visuals mislead the audience/confuse them?
      • Do the visuals facilitate data comparison or highlight trends and differences in a more effective manner than words?
      • Do the visuals present information simply, cleanly, and accurately?
      • Do the visuals illustrate messages and themes from the accompanying text?

      4.1.1 Plan and validate your dashboard visuals

      1 hour

      Click the links below to download the Info-Tech IT Dashboards and the IT Dashboard Workbook. Open the IT Dashboard Workbook and select Tab 5. For each dashboard, represented by its own table, open the corresponding Info-Tech IT Dashboard as reference.

      A diagram of dashboard and its considerations when selecting visuals.

      Download Info-Tech IT Dashboards

      Download Info-Tech IT Dashboard Workbook

      Step 4.2

      Update Your Dashboards

      Activities:
      4.2.1 Update the visuals on the Info-Tech IT Dashboards with data and visuals identified in the IT Dashboard Workbook.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 4.1 to 4.3 to build and deliver your dashboards.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Dashboards updated with your visuals, metrics, and data identified in the IT Dashboard Workbook.

      4.2.1 Update visuals with your own data

      2 hours

      1. Get the data that you identified in Tab 4 and Tab 5 of the IT Dashboard Workbook.
      2. Click the link below to go to the Info-Tech IT Dashboards and follow the instructions to update the visuals.

      Do not worry about the Key Insights or Calls to Action; you will create this in the next step when you plan your story.

      Download Info-Tech IT Dashboards

      Step 4.3

      Craft Your Story and Deliver Your Dashboards

      Activities:
      4.3.1 Craft Your Story
      4.3.2 Finalize Your Dashboards
      4.3.3 Practice Delivering Your Story With Your Dashboards

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 4.1 to 4.3 to build and deliver your dashboards.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Documented situations, key insights, and calls to action for each dashboard/visual.
      • A story to tell for each dashboard.
      • Understanding of how to practice delivering the dashboards using stories.

      Stories are more easily understood and more likely to drive decisions

      IT dashboards are valuable tools to provide insights that drive decision making.

      • Monitor: Track and report on strategic areas IT supports.
      • Provide insights: sPresent important data and information to audiences in a clear and efficient way.

      “Data storytelling is a universal language that everyone can understand – from people in STEM to arts and psychology.” — Peter Jackson, Chief Data and Analytics Officer at Exasol

      Storytelling provides context, helping the audience understand and connect with data and metrics.

      • 93% of respondents (business leaders and data professionals) agreed that decisions made as a result of successful data storytelling have the potential to help increase revenue.
      • 92% of respondents agreed that data storytelling was critical to communicate insights effectively.
      • 87% percent of respondents agreed that leadership teams would make more data-driven decisions if insights gathered from data were presented more simply.

      — Exasol

      For more visual guidance, download the IT Dashboard Guide

      Include all the following pieces in your message for an effective communication

      A diagram of an effective message, including consistent, clearn, relevant, and concise.

      Info-Tech Insight

      Time is a non-renewable resource. The message crafted must be considered a value-adding communication to your audience.

      Enable good communication with these components

      Be Consistent

      • The core message must be consistent regardless of audience, channel, or medium.
      • Test your communication with your team or colleagues to obtain feedback before delivering to a broader audience.
      • A lack of consistency can be interpreted as an attempt at deception. This can hurt credibility and trust.

      Be Clear

      • Say what you mean and mean what you say.
      • Choice of language is important: “Do you think this is a good idea? I think we could really benefit from your insights and experience here.” Or do you mean: “I think we should do this. I need you to do this to make it happen.”
      • Avoid jargon.

      Be Relevant

      • Talk about what matters to the audience.
      • Tailor the details of the message to the audience’s specific concerns.
      • IT thinks in processes but wider audiences focus mostly on results; talk in terms of results.
      • IT wants to be understood, but this does not matter to stakeholders. Think: “What’s in it for them?”
      • Communicate truthfully; do not make false promises or hide bad news.

      Be Concise

      • Keep communication short and to the point so key messages are not lost in the noise.
      • There is a risk of diluting your key message if you include too many other details.
      • If you provide more information than necessary, the clarity and consistency of the message can be lost.

      Draft the core messages to communicate

      1. Hook your audience: Use a compelling introduction that ensures your target audience cares about the message. Start with a story or metaphor and then support with the data on your dashboard. Avoid rushing in with data first.
      2. Demonstrate you can help: Let the audience know that based on the unique problem, you can help. There is value in engaging and working with you further.
      3. Write for the ear: Use concise and clear sentences, avoid technological language, and when you read it aloud ensure it sounds like how you would normally speak.
      4. Interpret visuals for your audience: Do not assume they will reach the same conclusions as you. For example, walk them through what a chart shows even if the axes are labeled, tell them what a trend line indicates or what the comparison between two data points means.
      5. Identify a couple of key insights: Think about one or two key takeaways you want your audience to leave with.
      6. Finish with a call to action: Your concluding statement should not be a thank-you but a call to action that ignites how your audience will behave after the communication. Dashboards exist to drive decisions, so if you have no call to action, you should ask if you need to include the visual.

      4.3.1 Craft Your Story

      1 hour

      Click the link below to download the IT Dashboard Workbook and open the file. Select Tab 6. The workbook contains grey text that reflects a sample story about the Info-Tech IT Dashboards. You may want to keep the sample text as reference, then remove after you have entered your information.

      A diagram of dashboard to craft your story.

      Download Info-Tech IT Dashboard Workbook

      4.3.2 Finalize Your Dashboards

      30 minutes

      1. Take the Key Insights and Calls to Action that you documented in Tab 6 of the IT Dashboard Workbook and place them in their corresponding dashboard.
      2. Add any text to your dashboard as necessary but only if the visual requires more information. You can add explanations more effectively during the presentation.

      A diagram that shows strategic initiatives: deliver value to customers.

      Tip: Aim to be brief and concise with any text. Dashboards simplify information and too much text can clutter the visuals and obscure the message.

      Download Info-Tech IT Dashboard Workbook

      4.3.3 Practice Delivering Your Story With Your Dashboards

      1 hour

      Ideally you can present your dashboard to your audience so that you are available to clarify questions and add a layer of interpretation that would crowd out boards if added as text.

      1. To prepare to tell your story, consult the Situation, Key Insights, and Call to Action sections that you documented for each dashboard in Tab 6 of the Info-Tech IT Dashboard Workbook.
      2. Practice your messages as you walk through your dashboards. The next two slides provide delivery guidance.
      3. Once you deliver your dashboards, update Tab 6 with audience feedback. Often dashboards are iterative and when your audience sees them, they are usually inspired to think about what else they would like to see. This is good and shows your audience is engaged!

      Don’t overwhelm your audience with information and data. You spent time to craft your dashboards so that they are clear and concise, so spend time practicing delivering a message that matches your clear, concise dashboards

      Download Info-Tech IT Dashboard Workbook

      Hone presentation skills before meeting with key stakeholders

      Using voice and body

      Think about the message you are trying to convey and how your body can support that delivery. Hands, stance, and frame all have an impact on what might be conveyed.

      If you want your audience to lean in and be eager about your next point, consider using a pause or softer voice and volume.

      Be professional and confident

      State the main points of your dashboard confidently. While this should be obvious, it needs to be stated explicitly. Your audience should be able to clearly see that you believe the points you are stating.

      Present in a way that is genuine to you and your voice. Whether you have an energetic personality or a calm and composed personality, the presentation should be authentic to you.

      Connect with your audience

      Look each member of the audience in the eye at least once during your presentation or if you are presenting remotely, look into the camera. Avoid looking at the ceiling, the back wall, or the floor. Your audience should feel engaged – this is essential to keeping their attention.

      Avoid reading the text from your dashboard, and instead paraphrase it while maintaining eye/camera contact.

      Info-Tech Insight

      You are responsible for the response of your audience. If they aren’t engaged, it is on you as the communicator.

      Communication Delivery Checklist

      • Have you practiced delivering the communication to team members or coaches?
      • Have you practiced delivering the communication to someone with little to no technology background?
      • Are you making yourself open to feedback and improvement opportunities?
      • If the communication is derailed from your plan, are you prepared to handle that change?
      • Can you deliver the communication without reading your notes word for word?
      • Have you adapted your voice throughout the communication to highlight specific components you want the audience to focus on?
      • Are you presenting in a way that is genuine to you and your personality?
      • Can you communicate the message within the time allotted?
      • Are you moving in an appropriate manner based on your communication (e.g., toward the screen, across the stage, hand gestures)
      • Do you have room for feedback on the dashboards? Solicit feedback with your audience after the meeting and record it in Tab 6 of the IT Dashboard Workbook.

      Phase 5

      Plan, record, and action your metrics

      A diagram that shows phase 1 to 5.

      This phase will walk you through the following:

      • Planning to track your metrics
      • Recording your metrics
      • Actioning your metrics

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Actioning your metrics to drive results

      To deliver real value from your dashboards, you need to do something with the results.

      Don’t fail on execution! The whole reason you labor to create inviting visuals and meaningful metrics is to action those metrics. The metrics results inform your entire story! It’s important to plan and do, but everything is lost if you fail to check and act.

      70%: of survey respondents say that managers do not get insights from performance metrics to improve strategic decision making.
      60%: of survey respondents say that operational teams do not get insights to improve operation decision making.

      (Bernard Marr)

      “Metrics aren’t a passive measure of progress but an active part of an organization’s everyday management….Applying the “plan–do–check–act” feedback loop…helps teams learn from their mistakes and identify good ideas that can be applied elsewhere”

      (McKinsey)

      Step 5.1

      Plan How to Record Metrics

      Activities:
      5.1.1 For each dashboard, add a baseline and target to existing metrics and KPIs.

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 5.1 to 5.2 to plan, record, and action your metrics.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Baselines and targets identified and recorded for each metric.

      5.1.1 Identify Baselines and Targets

      1 hour

      To action your metrics, you must first establish what your baselines and targets are so that you can determine if you are on track.

      To establish baselines:
      If you do not have a baseline. Run your metric to establish one.

      To establish targets:

      • Use historical data and trends of performance.
      • If you do not have historical data, establish an initial target based on stakeholder-identified requirements and expectations.
      • You can also run the metrics report over a defined period of time and use the baseline level of achievement to establish an initial target.
      • The target may not always be a number – it could be a trend. The initial target may be changed after review with stakeholders.

      Actions for Success:
      How will you ensure you can get this metric? For example, if you would like to measure delivered value, to make sure the metric is measurable, you will need to ensure that measures of success are documented for an imitative and then measured once complete.

      • If you need help with Action plans, the IT Metrics Library includes action plans for all of its metrics that may help

      A diagram of identify metrics and to identify baselines and targets.

      Download Info-Tech IT Dashboard Workbook

      Step 5.2

      Record and Action Metrics

      Activities:
      5.2.1 Record and Action Results

      • Note, the Info-Tech IT Dashboards are organized by CIO priorities – Risk, Financials, Talent, and Strategic Initiatives – and address the needs of the CXO audience. The IT Dashboard Workbook is pre-populated with this information.
      • If this meets your audience’s needs, you do not have to edit this content and can instead use the pre-populated information. You may wish to review the information to ensure it is still valid for your audience.

      A diagram that shows step 5.1 to 5.2 to plan, record, and action your metrics.

      This phase involves the following participants:

      • Senior IT leadership
      • Dashboard SMEs

      Outcomes of this step:

      • Understanding of what and where to record metrics once run.

      5.2.1 Record and Action Results

      1 hour

      After analyzing your results, use this information to update your dashboards. Revisit Tab 6 of the IT Dashboard Workbook to update your story. Remember to record any audience feedback about the dashboards in the Audience Feedback section.

      Action your measures as well as your metrics

      What should be measured can change over time as your organization matures and the business environment changes. Understanding what creates business value for your organization is critical. If metrics need to be changed, record metrics actions under Identified Actions on Tab 7. A metric will need to be addressed in one of the following ways:

      • Added: A new metric is required or an existing metric needs large-scale changes (example: calculation method or scope).
      • Changed: A minor change is required to the presentation format or data. Note: a major change in a metric would be performed through the Add option.
      • Removed: The metric is no longer required, and it needs to be removed from reporting and data gathering. A final report date for that metric should be determined.
      • Maintained: The metric is still useful and no changes are required to the metric, its measurement, or how it’s reported.

      A diagram of record results and identify how to address results.

      Don’t be discouraged if you need to update your metrics a few times before you get it right. It can take some trial and error to find the measures that best indicate the health of what you are measuring.

      Download Info-Tech IT Dashboard Workbook

      Tips for actioning results

      Sometimes actioning your metrics results requires more analysis

      If a metric deviates from your target, you may need to analyze how to correct the issue then run the metric again to see if the results have improved.

      Identify Root Cause
      Root Cause Analysis can include problem exploration techniques like The 5 Whys, fishbone diagrams, or affinity mapping.

      Select a Solution
      Once you have identified a possible root cause, use the same technique to brainstorm and select a solution then re-run your metrics.

      Consider Tension Metrics
      Consider tension metrics when selecting a solution. Will improving one area affect another? A car can go faster but it will consume more fuel – a project can be delivered faster but it may affect the quality.

      Summary of Accomplishment

      Problem Solved

      1. Using this blueprint and the IT Dashboard Workbook, you validated and customized the dashboards for your audience and organization, which reduced or eliminated time spent searching for and organizing your own visuals.
      2. You documented your dashboards’ story so you are ready to present them to your audience.
      3. You assessed the data for your dashboards and you built a metrics action-tracking plan to maintain your dashboards’ metrics.

      If you would like additional support, have our analysts guide you through an Info-Tech workshop or Guided Implementation.

      Contact your account representative for more information.
      workshops@infotech.com
      1-888-670-8889

      Additional Support

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

      To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

      Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

      Contact your account representative for more information.

      workshops@infotech.com
      1-888-670-8889

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      A photo of Info-Tech IT Dashboards
      Review the Info-Tech IT Dashboards
      Determine how you can use the Info-Tech IT Dashboards in your organization and the anticipated level of customization.

      A photo of the IT Dashboard Workbook
      Plan your dashboards
      Complete the IT Dashboard Workbook to help plan your dashboards using Info-Tech’s IT Dashboards.

      Research Contributors and Experts

      Photo of John Corrado
      John Corrado
      Head of IT
      X4 Pharmaceuticals

      As head of IT, John is charged with the creation of strategic IT initiatives that align with X4s vision, mission, culture, and long-term goals and is responsible for the organization’s systems, security, and infrastructure. He works closely developing partnerships with X4tizens across the organization to deliver value through innovative programs and services.

      Photo of Grant Frost
      Grant Frost
      Chief Information & Security Officer
      Niagara Catholic School Board

      Grant Frost is an experienced executive, information technologist and security strategist with extensive experience in both the public and private sector. Grant is known for, and has extensive experience in, IT transformation and the ability to increase capability while decreasing cost in IT services.

      Photo of Nick Scozzaro
      Nick Scozzaro
      CEO and Co-Founder of MobiStream and ShadowHQ
      ShadowHQ

      Nick got his start in software development and mobility working at BlackBerry where he developed a deep understanding of the technology landscape and of what is involved in both modernizing legacy systems and integrating new ones. Working with experts across multiple industries, he innovated, learned, strategized, and ultimately helped push the boundaries of what was possible.

      Photo of Joseph Sanders
      Joseph Sanders
      Managing Director of Technology/Cyber Security Services
      Kentucky Housing Corporation

      In his current role Joe oversees all IT Operations/Applications Services that are used to provide services and support to the citizens of Kentucky. Joe has 30+ years of leadership experience and has held several executive roles in the public and private sector. He has been a keynote speaker for various companies including HP, IBM, and Oracle.

      Photo of Jochen Sievert
      Jochen Sievert
      Director Performance Excellence & IT
      Zeon Chemicals

      Jochen moved to the USA from Duesseldorf, Germany in 2010 to join Zeon Chemicals as their IT Manager. Prior to Zeon, Jochen has held various technical positions at Novell, Microsoft, IBM, and Metro Management Systems.

      Info-Tech Contributors

      Ibrahim Abdel-Kader, Research Analyst
      Donna Bales, Principal Research Director
      Shashi Bellamkonda, Principal Research Director
      John Burwash, Executive Counselor
      Tony Denford, Research Lead
      Jody Gunderman, Senior Executive Advisor
      Tom Hawley, Managing Partner
      Mike Higginbotham, Executive Counselor
      Valence Howden, Principal Research Director
      Dave Kish, Practice Lead
      Carlene McCubbin, Practice Lead
      Jennifer Perrier, Principal Research Director
      Gary Rietz, Executive Counselor
      Steve Schmidt, Senior Managing Partner
      Aaron Shum, Vice President, Security & Privacy
      Ian Tyler-Clarke, Executive Counselor

      Plus, an additional four contributors who wish to remain anonymous.

      Related Info-Tech Research

      Photo of Build an IT Risk Taxonomy

      Build an IT Risk Taxonomy

      Use this blueprint as a baseline to build a customized IT risk taxonomy suitable for your organization.

      Photo of Create a Holistic IT Dashboard

      Create a Holistic IT Dashboard

      This blueprint will help you identify the KPIs that matter to your organization.

      Photo of Develop Meaningful Service Metrics

      Develop Meaningful Service Metrics

      This blueprint will help you Identify the appropriate service metrics based on stakeholder needs.

      Photo of IT Spend & Staffing Benchmarking

      IT Spend & Staffing Benchmarking

      Use this benchmarking service to capture, analyze, and communicate your IT spending and staffing.

      Photo of Key Metrics for Every CIO

      Key Metrics for Every CIO

      This short research piece highlights the top metrics for every CIO, how those align to your CIO priorities, and action steps against those metrics.

      Photo of Present Security to Executive Stakeholders

      Present Security to Executive Stakeholders

      This blueprint helps you identify communication drivers and goals and collect data to support your presentation. It provides checklists for building and delivering a captivating security presentation.

      Bibliography

      “10 Signs You Are Sitting on a Pile of Data Debt.” Experian, n.d. Web.

      “From the What to the Why: How Data Storytelling Is Key to Success.” Exasol, 2021. Web.

      Bonsignore, Marian. “Using Visual Language to Create the Case for Change.” Amarican Management Association. Accessed 19 Apr. 2023.

      Calzon, Bernardita. “Top 25 Dashboard Design Principles, Best Practices & How To’s.” Datapine, 5 Apr. 2023.

      “Data Literacy.” Tableau, n.d. Accessed 3 May 2023.

      “KPIs Don’t Improve Decision-Making In Most Organizations.” LinkedIn, n.d. Accessed 2 May 2023.

      Miller, Amanda. “A Comprehensive Guide to Accessible Data Visualization.” Betterment, 2020. Accessed May 2022.

      “Performance Management: Why Keeping Score Is so Important, and so Hard.” McKinsey. Accessed 2 May 2023.

      Vogel, Douglas, et al. Persuasion and the Role of Visual Presentation Support: The UM/3M Study. Management Information Systems Research Center School of Management University of Minnesota, 1986.

      Watson, Morag W., et al. ”IT’s Changing Mandate in an Age of Disruption.” The Economist Intelligence Unit Limited, 2021.

      Succeed With Digital Strategy Execution

      • Buy Link or Shortcode: {j2store}527|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Customer Relationship Management
      • Parent Category Link: /customer-relationship-management
      • Rising customer expectations and competitive pressures have accelerated the pace at which organizations are turning to digital transformation to drive revenue or cut costs.
      • Many digital strategies are not put into action, and instead sit on the shelf. A digital strategy that is not translated into specific projects and initiatives will provide no value to the organization.
      • Executing a digital strategy is easier said than done: IT often lacks the necessary framework to create a roadmap, or fails to understand how new applications can enable the vision outlined in the strategy.

      Our Advice

      Critical Insight

      • A digital strategy needs a clear roadmap to succeed. Too many digital strategies are lofty statements of objective with no clear avenue for actual execution: create a digital strategy application roadmap to avoid this pitfall.
      • Understand the art of execution. Application capabilities are rapidly evolving: IT must stand ready to educate the business on how new applications can be used to pursue the digital strategy.

      Impact and Result

      • IT must work with the business to parse specific technology drivers from the digital strategy, distill strategic requirements, and create a prescriptive roadmap of initiatives that will close the gaps between the current state and the target state outlined in the digital strategy. Doing so well is a path to the CIO’s office.
      • To better serve the organization, IT leaders must stay abreast of key application capabilities and trends. Exciting new developments such as artificial intelligence, IoT, and machine learning have opened up new avenues for process digitization, but IT leaders need to make a concerted effort to understand what modern applications bring to the table for technology enablement of the digital strategy.
      • Taking an agile approach to application roadmap development will help to provide a clear path forward for tackling digital strategy execution, while also allowing for flexibility to update and iterate as the internal and external environment changes.

      Succeed With Digital Strategy Execution Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should have a structured approach to translating your digital strategy to specific application initiatives, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Parse digital strategy drivers

      Parse specific technology drivers out of the formal enterprise digital strategy.

      • Succeed With Digital Strategy Execution – Phase 1: Parse Your Digital Strategy for Critical Technology Drivers

      2. Map drivers to enabling technologies

      Review and understand potential enabling applications.

      • Succeed With Digital Strategy Execution – Phase 2: Map Your Drivers to Enabling Applications

      3. Create the application roadmap to support the digital strategy

      Use the drivers and an understanding of enabling applications to put together an execution roadmap that will support the digital strategy.

      • Succeed With Digital Strategy Execution – Phase 3: Create an Application Roadmap That Supports the Digital Strategy
      • Digital Strategy Roadmap Tool
      • Application Roadmap Presentation Template
      • Digital Strategy Communication and Execution Plan Template
      [infographic]

      Workshop: Succeed With Digital Strategy Execution

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Validate the Digital Strategy

      The Purpose

      Review and validate the formal enterprise digital strategy.

      Key Benefits Achieved

      Confirmation of the goals, objectives, and direction of the organization’s digital strategy.

      Activities

      1.1 Review the initial digital strategy.

      1.2 Determine gaps.

      1.3 Refine digital strategy scope and vision.

      1.4 Finalize digital strategy and validate with stakeholders.

      Outputs

      Validated digital strategy

      2 Parse Critical Technology Drivers

      The Purpose

      Enumerate relevant technology drivers from the digital strategy.

      Key Benefits Achieved

      List of technology drivers to pursue based on goals articulated in the digital strategy.

      Activities

      2.1 Identify affected process domains.

      2.2 Brainstorm impacts of digital strategy on technology enablement.

      2.3 Distill critical technology drivers.

      2.4 Identify KPIs for each driver.

      Outputs

      Affected process domains (based on APQC)

      Critical technology drivers for the digital strategy

      3 Map Drivers to Enabling Applications

      The Purpose

      Relate your digital strategy drivers to specific, actionable application areas.

      Key Benefits Achieved

      Understand the interplay between the digital strategy and impacted application domains.

      Activities

      3.1 Build and review current application inventory for digital.

      3.2 Execute fit-gap analysis between drivers and current state inventory.

      3.3 Pair technology drivers to specific enabling application categories.

      Outputs

      Current-state application inventory

      Fit-gap analysis

      4 Understand Applications

      The Purpose

      Understand how different applications support the digital strategy.

      Understand the art of the possible.

      Key Benefits Achieved

      Knowledge of how applications are evolving from a features and capabilities perspective, and how this pertains to digital strategy enablement.

      Activities

      4.1 Application spotlight: customer experience.

      4.2 Application spotlight: content and collaboration.

      4.3 Application spotlight: business intelligence.

      4.4 Application spotlight: enterprise resource planning.

      Outputs

      Application spotlights

      5 Build the Digital Application Roadmap

      The Purpose

      Create a concrete, actionable roadmap of application and technology initiatives to move the digital strategy forward.

      Key Benefits Achieved

      Clear, concise articulation of application roadmap for supporting digital that can be communicated to the business.

      Activities

      5.1 Build list of enabling projects and applications.

      5.2 Create prioritization criteria.

      5.3 Build the digital strategy application roadmap.

      5.4 Socialize the roadmap.

      5.5 Delineate responsibility for roadmap execution.

      Outputs

      Application roadmap for the digital strategy

      RACI chart for digital strategy roadmap execution

      Data Quality

      • Buy Link or Shortcode: {j2store}19|cart{/j2store}
      • Related Products: {j2store}19|crosssells{/j2store}
      • Teaser Video: Visit Website
      • Teaser Video Title: Big data after pandemic
      • member rating overall impact: 8.3/10
      • member rating average dollars saved: $5,100
      • member rating average days saved: 8
      • Parent Category Name: Data and Business Intelligence
      • Parent Category Link: /data-and-business-intelligence
      Restore trust in your data by aligning your data management approach to the business strategy

      Present Security to Executive Stakeholders

      • Buy Link or Shortcode: {j2store}262|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: $2,000 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: Governance, Risk & Compliance
      • Parent Category Link: /governance-risk-compliance
      • There is a disconnect between security leaders and executive stakeholders on what information is important to present.
      • Security leaders find it challenging to convey the necessary information to obtain support for security objectives.
      • Changes to the threat landscape and shifts in organizational goals exacerbate the issue, as they impact security leaders' ability to prioritize topics to be communicated.
      • Security leaders struggle to communicate the importance of security to a non-technical audience.

      Our Advice

      Critical Insight

      Security presentations are not a one-way street. The key to a successful executive security presentation is having a goal for the presentation and ensuring that you have met your goal.

      Impact and Result

      • Developing a thorough understanding of the security communication goals.
      • Understanding the importance of leveraging highly relevant and understandable data.
      • Developing and delivering presentations that will keep your audience engaged and build trust with your executive stakeholders.

      Present Security to Executive Stakeholders Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Present Security to Executive Stakeholders – A step-by-step guide to communicating security effectively to obtain support from decision makers.

      Use this as a guideline to assist you in presenting security to executive stakeholders.

      • Present Security to Executive Stakeholders Storyboard

      2. Security Presentation Templates – A set of security presentation templates to assist you in communicating security to executive stakeholders.

      The security presentation templates are a set of customizable templates for various types of security presentation including:

      • Present Security to Executive Stakeholders Templates

      Infographic

      Further reading

      Present Security to Executive Stakeholders

      Learn how to communicate security effectively to obtain support from decision makers.

      Analyst Perspective

      Build and deliver an effective security communication to your executive stakeholders.

      Ahmad Jowhar

      As a security leader, you’re tasked with various responsibilities to ensure your organization can achieve its goals while its most important assets are being protected.

      However, when communicating security to executive stakeholders, challenges can arise in determining what topics are pertinent to present. Changes in the security threat landscape coupled with different business goals make identifying how to present security more challenging.

      Having a communication framework for presenting security to executive stakeholders will enable you to effectively identify, develop, and deliver your communication goals while obtaining the support you need to achieve your objectives.

      Ahmad Jowhar
      Research Specialist, Security & Privacy

      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Common Obstacles

      Info-Tech’s Approach

      • Many security leaders struggle to decide what to present and how to present security to executive stakeholders.
      • Constant changes in the security threat landscape impacts a security leader’s ability to prioritize topics to be communicated.
      • There is a disconnect between security leaders and executive stakeholders on what information is important to present.
      • Security leaders struggle to communicate the importance of security to a non-technical audience.
      • Developing a thorough understanding of security communication goals.
      • Understanding the importance of leveraging highly relevant and understandable data.
      • Developing and delivering presentations that will keep your audience engaged and build trust with your executive stakeholders.

      Info-Tech Insight

      Security presentations are not a one-way street. The key to a successful executive security presentation is having a goal for the presentation and verifying that you have met your goal.

      Your challenge

      As a security leader, you need to communicate security effectively to executive stakeholders in order to obtain support for your security objectives.

      • When it comes to presenting security to executive stakeholders, many security leaders find it challenging to convey the necessary information in order to obtain support for security objectives.
      • This is attributed to various factors, such as an increase in the threat landscape, changes to industry regulations and standards, and new organizational goals that security has to align with.
      • Furthermore, with the limited time to communicate with executive stakeholders, both in frequency and duration, identifying the most important information to address can be challenging.

      76% of security leaders struggle in conveying the effectiveness of a cybersecurity program.

      62% find it difficult to balance the risk of too much detail and need-to-know information.

      41% find it challenging to communicate effectively with a mixed technical and non-technical audience.

      Source: Deloitte, 2022

      Common obstacles

      There is a disconnect between security leaders and executive stakeholders when it comes to the security posture of the organization:

      • Executive stakeholders are not confident that their security leaders are doing enough to mitigate security risks.
      • The issue has been amplified, with security threats constantly increasing across all industries.
      • However, security leaders don’t feel that they are in a position to make themselves heard.
      • The lack of organizational security awareness and support from cross-functional departments has made it difficult to achieve security objectives (e.g. education, investments).
      • Defining an approach to remove that disconnect with executive stakeholders is of utmost importance for security leaders, in order to improve their organization’s security posture.

      9% of boards are extremely confident in their organization’s cybersecurity risk mitigation measures.

      77% of organizations have seen an increase in the number of attacks in 2021.

      56% of security leaders claimed their team is not involved when leadership makes urgent security decisions.

      Source: EY, 2021
      The image contains a screenshot of an Info-Tech Thoughtmodel titled: Presenting Security to Executive Stakeholders.

      Info-Tech’s methodology for presenting security to executive stakeholders

      1. Identify communication goals

      2. Collect information to support goals

      3. Develop communication

      4. Deliver communication

      Phase steps

      1. Identify drivers for communicating to executives
      2. Define your goals for communicating to executives
      1. Identify data to collect
      2. Plan how to retrieve data
      1. Plan communication
      2. Build a compelling communication document
      1. Deliver a captivating presentation
      2. Obtain/verify goals

      Phase outcomes

      A defined list of drivers and goals to help you develop your security presentations

      A list of data sources to include in your communication

      A completed communication template

      A solidified understanding of how to effectively communicate security to your stakeholders

      Develop a structured process for communicating security to your stakeholders

      Security presentations are not a one-way street
      The key to a successful executive security presentation is having a goal for the presentation and verifying that you have met your goal.

      Identifying your goals is the foundation of an effective presentation
      Defining your drivers and goals for communicating security will enable you to better prepare and deliver your presentation, which will help you obtain your desired outcome.

      Harness the power of data
      Leveraging data and analytics will help you provide quantitative-based communication, which will result in a more meaningful and effective presentation.

      Take your audience on a journey
      Developing a storytelling approach will help engage with your audience.

      Win your audience by building a rapport
      Establishing credibility and trust with executive stakeholders will enable you to obtain their support for security objectives.

      Tactical insight
      Conduct background research on audience members (i.e. professional background) to help understand how best to communicate with them and overcome potential objections.

      Tactical insight
      Verifying your objectives at the end of the communication is important, as it ensures you have successfully communicated to executive stakeholders.

      Project deliverables

      This blueprint is accompanied by a supporting deliverable which includes five security presentation templates.

      Report on Security Initiatives
      Template showing how to inform executive stakeholders of security initiatives.

      Report on Security Initiatives.

      Security Metrics
      Template showing how to inform executive stakeholders of current security metrics that would help drive future initiatives.

      Security Metrics.

      Security Incident Response & Recovery
      Template showing how to inform executive stakeholders of security incidents, their impact, and the response plan.

      Security Incident Response & Recovery

      Security Funding Request
      Template showing how to inform executive stakeholders of security incidents, their impact, and the response plan.

      Security Funding Request

      Key template:

      Security and Risk Update

      Template showing how to inform executive stakeholders of proactive security and risk initiatives.

      Blueprint benefits

      IT/InfoSec benefits

      Business benefits

      • Reduce effort and time spent preparing cybersecurity presentations for executive stakeholders by having templates to use.
      • Enable security leaders to better prepare what to present and how to present it to their executive stakeholders, as well as driving the required outcomes from those presentations.
      • Establish a best practice for communicating security and IT to executive stakeholders.
      • Gain increased awareness of cybersecurity and the impact executive stakeholders can have on improving an organization’s security posture.
      • Understand how security’s alignment with the business will enable the strategic growth of the organization.
      • Gain a better understanding of how security and IT objectives are developed and justified.

      Measure the value of this blueprint

      Phase

      Measured Value (Yearly)

      Phase 1: Identify communication goals

      Cost to define drivers and goals for communicating security to executives:

      16 FTE hours @ $233K* =$1,940

      Phase 2: Collect information to support goals

      Cost to collect and synthesize necessary data to support communication goals:

      16 FTE hours @ $233K = $1,940

      Phase 3: Develop communication

      Cost to develop communication material that will contextualize information being shown:

      16 FTE hours @ $233K = $1,940

      Phase 4: Deliver communication

      Potential Savings:

      Total estimated effort = $5,820

      Our blueprint will help you save $5,820 and over 40 FTE hours

      * The financial figure depicts the annual salary of a CISO in 2022

      Source: Chief Information Security Officer Salary.” Salary.com, 2022

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Phase 1

      Identify communication goals

      Phase 1 Phase 2 Phase 3 Phase 4

      1.1 Identify drivers for communicating to executives

      1.2 Define your goals for communicating to executives

      2.1 Identify data to collect

      2.2 Plan how to retrieve data

      3.1 Plan communication

      3.2 Build a compelling communication document

      4.1 Deliver a captivating presentation

      4.2 Obtain/verify support for security goals

      This phase will walk you through the following activities:

      • Understanding the different drivers for communicating security to executive stakeholders
      • Identifying different communication goals

      This phase involves the following participants:

      • Security leader

      1.1. Identify drivers for communicating to executive stakeholders

      As a security leader, you meet with executives and stakeholders with diverse backgrounds, and you aim to showcase your organization’s security posture along with its alignment with the business’ goals.

      However, with the constant changes in the security threat landscape, demands and drivers for security could change. Thus, understanding potential drivers that will influence your communication will assist you in developing and delivering an effective security presentation.

      39% of organizations had cybersecurity on the agenda of their board’s quarterly meeting.

      Source: EY, 2021.

      Info-Tech Insight

      Not all security presentations are the same. Keep your communication strategy and processes agile.

      Know your drivers for security presentations

      By understanding the influences for your security presentations, you will be able to better plan what to present to executive stakeholders.

      • These meetings, which are usually held once per quarter, provide you with less than one hour of presentation time.
      • Hence, it is crucial to know why you need to present security and whether these drivers are similar across the other presentations.

      Understanding drivers will also help you understand how to present security to executive stakeholders.

      • These drivers will shape the structure of your presentation and help determine your approach to communicating your goals.
      • For example, financial-based presentations that are driven by budget requests might create a sense of urgency or assurance about investment in a security initiative.

      Identify your communication drivers, which can stem from various initiatives and programs, including:

      • Results from internal or external audit reports.
      • Upcoming budget meetings.
      • Briefing newly elected executive stakeholders on security.

      When it comes to identifying your communication drivers, you can collaborate with subject matter experts, like your corporate secretary or steering committees, to ensure the material being communicated will align with some of the organizational goals.

      Examples of drivers for security presentations

      Audit
      Upcoming internal or external audits might require updates on the organization’s compliance

      Organizational restructuring
      Restructuring within an organization could require security updates

      Merger & Acquisition
      An M&A would trigger presentations on organization’s current and future security posture

      Cyber incident
      A cyberattack would require an immediate presentation on its impact and the incident response plan

      Ad hoc
      Provide security information requested by stakeholders

      1.2. Define your goals for communicating to executives

      After identifying drivers for your communication, it’s important to determine what your goals are for the presentation.

      • Communication drivers are mainly triggers for why you want to present security.
      • Communication goals are the potential outcomes you are hoping to obtain from the presentation.
      • Your communication goals would help identify what data and metrics to include in your presentation, the structure of your communication deck, and how you deliver your communication to executive stakeholders.

      Identifying your communication goals could require the participation of the security team, IT leadership, and other business stakeholders.

      • As a group, brainstorm the security goals that align with your business goals for the coming year.
        • Aim to have at least two business goals that align with each security goal.
      • Identify what benefits and value the executive stakeholders will gain from the security goal being presented.
        • E.g. Increased security awareness, updates on organization's security posture.
      • Identify what the ask is for this presentation.
        • E.g. Approval for increasing budget to support security initiatives, executive support to implement internal security programs.

      Info-Tech Insight

      There can be different reasons to communicate security to executive stakeholders. You need to understand what you want to get out of your presentation.

      Examples of security presentation goals

      Educate
      Educate the board on security trends and/or latest risks in the industry

      Update
      Provide updates on security initiatives, relevant security metrics, and compliance posture

      Inform
      Provide an incident response plan due to a security incident or deliver updates on current threats and risks

      Investment
      Request funding for security investments or financial updates on past security initiatives

      Ad hoc
      Provide security information requested by stakeholders

      Phase 2

      Collect information to support goals

      Phase 1Phase 2Phase 3Phase 4

      1.1 Identify drivers for communicating to executives

      1.2 Define your goals for communicating to executives

      2.1 Identify data to collect

      2.2 Plan how to retrieve data

      3.1 Plan communication

      3.2 Build a compelling communication document

      4.1 Deliver a captivating presentation

      4.2 Obtain/verify support for security goals

      This phase will walk you through the following activities:

      • Understanding what types of data to include in your security presentations
      • Defining where and how to retrieve data

      This phase involves the following participants:

      • Security leader
      • Network/security analyst

      2.1 Identify data to collect

      After identifying drivers and goals for your communication, it’s important to include the necessary data to justify the information being communicated.

      • Leveraging data and analytics will assist in providing quantitative-based communication, which will result in a more meaningful and effective presentation.
      • The data presented will showcase the visibility of an organization’s security posture along with potential risks and figures on how to mitigate those risks.
      • Providing analysis of the quantitative data presented will also showcase further insights on the figures, allow the audience to better understand the data, and show its relevance to the communication goals.

      Identifying data to collect doesn’t need to be a rigorous task; you can follow these steps to help you get started:

      • Work with your security team to identify the main type of data applicable to the communication goals.
        • E.g. Financial data would be meaningful to use when communicating a budget presentation.
      • Identify supporting data linked to the main data defined.
        • E.g. If a financial investment is made to implement a security initiative, then metrics on improvements to the security posture will be relevant.
      • Show how both the main and supporting data align with the communication goals.
        • E.g. Improvement in security posture would increase alignment with regulation standards, which would result in additional contracts being awarded and increased revenue.

      Info-Tech Insight

      Understand how to present your information in a way that will be meaningful to your audience, for instance by quantifying security risks in financial terms.

      Examples of data to present

      Educate
      Number of organizations in industry impacted by data breaches during past year; top threats and risks affecting the industries

      Update
      Degree of compliance with standards (e.g. ISO-27001); metrics on improvement of security posture due to security initiatives

      Inform
      Percentage of impacted clients and disrupted business functions; downtime; security risk likelihood and financial impact

      Investment
      Capital and operating expenditure for investment; ROI on past and future security initiatives

      Ad hoc
      Number of security initiatives that went over budget; phishing test campaign results

      2.2 Plan how to retrieve the data

      Once the data that is going to be used for the presentation has been identified, it is important to plan how the data can be retrieved, processed, and shared.

      • Most of the data leveraged for security presentations are structured data, which are highly organized data that are often stored in a relational and easily searchable database.
        • This includes security log reports or expenditures for ongoing and future security investments.
      • Retrieving the data, however, would require collaboration and cooperation from different team members.
      • You would need to work with the security team and other appropriate stakeholders to identify where the data is stored and who the data owner is.

      Once the data source and owner has been identified, you need to plan how the data would be processed and leveraged for your presentation

      • This could include using queries to retrieve the relevant information needed (e.g. SQL, Microsoft Excel).
      • Verify the accuracy and relevance of the data with other stakeholders to ensure it is the most appropriate data to be presented to the executive stakeholders.

      Info-Tech Insight

      Using a data-driven approach to help support your objectives is key to engaging with your audience.

      Plan where to retrieve the data

      Identifying the relevant data sources to retrieve your data and the appropriate data owner enables efficient collaboration between departments collecting, processing, and communicating the data and graphics to the audience.

      Examples of where to retrieve your data

      Data Source

      Data

      Data Owner

      Communication Goal

      Audit & Compliance Reports

      Percentage of controls completed to be certified with ISO 27001; Number of security threats & risks identified.

      Audit Manager;

      Compliance Manager;

      Security Leader

      Ad hoc, Educate, Inform

      Identity & Access Management (IAM) Applications

      Number of privileged accounts/department; Percentage of user accounts with MFA applied

      Network/Security Analyst

      Ad hoc, Inform, Update

      Security Information & Event Management (SIEM)

      Number of attacks detected and blocked before & after implementing endpoint security; Percentage of firewall rules that triggered a false positive

      Network/Security Analyst

      Ad hoc, Inform, Update

      Vulnerability Management Applications

      Percentage of critical vulnerabilities patched; Number of endpoints encrypted

      Network/Security Analyst

      Ad hoc, Inform, Update

      Financial & Accounting Software

      Capital & operating expenditure for future security investments; Return on investment (ROI) on past and current security investments

      Financial and/or Accounting Manager

      Ad hoc, Educate, Investments

      Phase 3

      Develop communication

      Phase 1Phase 2Phase 3Phase 4

      1.1 Identify drivers for communicating to executives

      1.2 Define your goals for communicating to executives

      2.1 Identify data to collect

      2.2 Plan how to retrieve data

      3.1 Plan communication

      3.2 Build a compelling communication document

      4.1 Deliver a captivating presentation

      4.2 Obtain/verify support for security goals

      This phase will walk you through the following activities:

      • Identifying a communication strategy for presenting security
      • Identifying security templates that are applicable to your presentation

      This phase involves the following participants:

      • Security leader

      3.1 Plan communication: Know who your audience is

      • When preparing your communication, it's important to understand who your target audience is and to conduct background research on them.
      • This will help develop your communication style and ensure your presentation caters to the expected audience in the room.

      Examples of two profiles in a boardroom

      Formal board of directors

      The executive team

      • In the private sector, this will include an appointed board of shareholders and subcommittees external to the organization.
      • In the public sector, this can include councils, commissions, or the executive team itself.
      • In government, this can include mayors, ministers, and governors.
      • The board’s overall responsibility is governance.
      • This audience will include your boss and your peers internal to the organization.
      • This category is primarily involved in the day-to-day operations of the organization and is responsible for carrying out the strategic direction set by the board.
      • The executive team’s overall responsibility is operations.

      3.1.1 Know what your audience cares about

      • Understanding what your executive stakeholders value will equip you with the right information to include in your presentations.
      • Ensure you conduct background research on your audience to assist you in knowing what their potential interests are.
      • Your background research could include:
        • Researching the audience’s professional background through LinkedIn.
        • Reviewing their comments from past executive meetings.
        • Researching current security trends that align with organizational goals.
      • Once the values and risks have been identified, you can document them in notes and share the notes with subject matter experts to verify if these values and risks should be shared in the coming meetings.

      A board’s purpose can include the following:

      • Sustaining and expanding the organization’s purpose and ability to execute in a competitive market.
      • Determining and funding the organization’s future and direction.
      • Protecting and increasing shareholder value.
      • Protecting the company’s exposure to risks.

      Examples of potential values and risks

      • Business impact
      • Financial impact
      • Security and incidents

      Info-Tech Insight
      Conduct background research on audience members (e.g. professional background on LinkedIn) to help understand how best to communicate to them and overcome potential objections.

      Understand your audience’s concerns

      • Along with knowing what your audience values and cares about, understanding their main concerns will allow you to address those items or align them with your communication.
      • By treating your executive stakeholders as your project sponsors, you would build a level of trust and confidence with your peers as the first step to tackling their concerns.
      • These concerns can be derived from past stakeholder meetings, recent trends in the industry, or strategic business alignments.
      • After capturing their concerns, you’ll be equipped with the necessary understanding on what material to include and prioritize during your presentations.

      Examples of potential concerns for each profile of executive stakeholders

      Formal board of directors

      The executive team

      • Business impact (What is the impact of IT in solving business challenges?)
      • Investments (How will it impact organization’s finances and efficiency?)
      • Cybersecurity and risk (What are the top cybersecurity risks, and how is IT mitigating those risks to the business?)
      • Business alignment (How do IT priorities align to the business strategy and goals?)
      • IT operational efficiency (How is IT set up for success with foundational elements of IT’s operational strategy?)
      • Innovation & transformation priorities (How is IT enabling the organization’s competitive advantage and supporting transformation efforts as a strategic business partner?)

      Build your presentation to tackle their main concerns

      Your presentation should be well-rounded and compelling when it addresses the board’s main concerns about security.

      Checklist:

      • Research your target audience (their backgrounds, board composition, dynamics, executive team vs. external group).
      • Include value and risk language in your presentation to appeal to your audience.
      • Ensure your content focuses on one or more of the board’s main concerns with security (e.g. business impact, investments, or risk).
      • Include information about what is in it for them and the organization.
      • Research your board’s composition and skillsets to determine their level of technical knowledge and expertise. This helps craft your presentation with the right amount of technology vs. business-facing information.

      Info-Tech Insight
      The executive stakeholder’s main concerns will always boil down to one important outcome: providing a level of confidence to do business through IT products, services, and systems – including security.

      3.1.2 Take your audience through a security journey

      • Once you have defined your intended target and their potential concerns, developing the communication through a storytelling approach will be the next step to help build a compelling presentation.
      • You need to help your executive stakeholders make sense of the information being conveyed and allow them to understand the importance of cybersecurity.
      • Taking your audience through a story will allow them to see the value of the information being presented and better resonate with its message.
      • You can derive insights for your storytelling presentation by doing the following:
        • Provide a business case scenario on the topic you are presenting.
        • Identify and communicate the business problem up front and answer the three questions (why, what, how).
        • Quantify the problems in terms of business impact (money, risk, value).

      Info-Tech Insight
      Developing a storytelling approach will help keep your audience engaged and allow the information to resonate with them, which will add further value to the communication.

      Identify the purpose of your presentation

      You should be clear about your bottom line and the intent behind your presentation. However, regardless of your bottom line, your presentation must focus on what business problems you are solving and why security can assist in solving the problem.

      Examples of communication goals

      To inform or educate

      To reach a decision

      • In this presentation type, it is easy for IT leaders to overwhelm a board with excessive or irrelevant information.
      • Focus your content on the business problem and the solution proposed.
      • Refrain from too much detail about the technology – focus on business impact and risk mitigated. Ask for feedback if applicable.
      • In this presentation type, there is a clear ask and an action required from the board of directors.
      • Be clear about what this decision is. Once again, don’t lead with the technology solution: Start with the business problem you are solving, and only talk about technology as the solution if time permits.
      • Ensure you know who votes and how to garner their support.

      Info-Tech Insight
      Nobody likes surprises. Communicate early and often. The board should be pre-briefed, especially if it is a difficult subject. This also ensures you have support when you deliver a difficult message.

      Gather the right information to include in your boardroom presentation

      Once you understand your target audience, it’s important to tailor your presentation material to what they will care about.

      Typical IT boardroom presentations include:

      • Communicating the value of ongoing business technology initiatives.
      • Requesting funds or approval for a business initiative that IT is spearheading.
      • Security incident response/Risk/DRP.
      • Developing a business program or an investment update for an ongoing program.
      • Business technology strategy highlights and impacts.
      • Digital transformation initiatives (value, ROI, risk).

      Info-Tech Insight
      You must always have a clear goal or objective for delivering a presentation in front of your board of directors. What is the purpose of your board presentation? Identify your objective and outcome up front and tailor your presentation’s story and contents to fit this purpose.

      Info-Tech Insight
      Telling a good story is not about the message you want to deliver but the one the executive stakeholders want to hear. Articulate what you want them to think and what you want them to take away, and be explicit about it in your presentation. Make your story logically flow by identifying the business problem, complication, the solution, and how to close the gap. Most importantly, communicate the business impacts the board will care about.

      Structure your presentation to tell a logical story

      To build a strong story for your presentation, ensure you answer these three questions:

      WHY

      Why is this a business issue, or why should the executive stakeholders care?

      WHAT

      What is the impact of solving the problem and driving value for the company?

      HOW

      How will we leverage our resources (technology, finances) to solve the problem?

      Examples:

      Scenario 1: The company has experienced a security incident.

      Intent: To inform/educate the board about the security incident.

      WHY

      The data breach has resulted in a loss of customer confidence, negative brand impact, and a reduction in revenue of 30%.

      WHAT

      Financial, legal, and reputational risks identified, and mitigation strategies implemented. IT is working with the PR team on communications. Incident management playbook executed.

      HOW

      An analysis of vulnerabilities was conducted and steps to address are in effect. Recovery steps are 90% completed. Incident management program reviewed for future incidents.

      Scenario 2: Security is recommending investments based on strategic priorities.

      Intent: To reach a decision with the board – approve investment proposal.

      WHY

      The new security strategy outlines two key initiatives to improve an organization’s security culture and overall risk posture.

      WHAT

      Security proposed an investment to implement a security training & phishing test campaign, which will assist in reducing data breach risks.

      HOW

      Use 5% of security’s budget to implement security training and phishing test campaigns.

      Time plays a key role in delivering an effective presentation

      What you include in your story will often depend on how much time you have available to deliver the message.

      Consider the following:

      • Presenting to executive stakeholders often means you have a short window of time to deliver your message. The average executive stakeholder presentation is 15 minutes, and this could be cut short due to other unexpected factors.
      • If your presentation is too long, you risk overwhelming or losing your audience. You must factor in the time constraints when building your board presentation.
      • Your executive stakeholders have a wealth of experience and knowledge, which means they could jump to conclusions quickly based on their own experiences. Ensure you give them plenty of background information in advance. Provide your presentation material, a brief, or any other supporting documentation before the meeting to show you are well prepared.
      • Be prepared to have deep conversations about the topic, but respect that the executive stakeholders might not be interested in hearing the tactical information. Build an elevator pitch, a one-pager, back-up slides that support your ask and the story, and be prepared to answer questions within your allotted presentation time to dive deeper.

      Navigating through Q&A

      Use the Q&A portion to build credibility with the board.

      • It is always better to say, “I’m not certain about the answer but will follow up,” than to provide false or inaccurate information on the spot.
      • When asked challenging or irrelevant questions, ensure you have an approach to deflect them. Questions can often be out of scope or difficult to answer in a group. Find what works for you to successfully navigate through these questions:
        • “Let’s work with the sub-committee to find you an answer.”
        • “Let’s take that offline to address in more detail.”
        • “I have some follow-up material I can provide you to discuss that further after our meeting.”
      • And ensure you follow up! Make sure to follow through on your promise to provide information or answers after the meeting. This helps build trust and credibility with the board.

      Info-Tech Insight
      The average board presentation is 15 minutes long. Build no more than three or four slides of content to identify the business problem, the business impacts, and the solution. Leave five minutes for questions at the end, and be prepared with back-up slides to support your answers.

      Storytelling checklist

      Checklist:

      • Tailor your presentation based on how much time you have.
      • Find out ahead of time how much time you have.
      • Identify if your presentation is to inform/educate or reach a decision.
      • Identify and communicate the business problem up front and answer the three questions (why, what, how).
      • Express the problem in terms of business impact (risk, value, money).
      • Prepare and send pre-meeting collateral to the members of the board and executive team.
      • Include no more than 5-6 slides for your presentation.
      • Factor in Q&A time at the end of your presentation window.
      • Articulate what you want them to think and what you want them to take away – put it right up front and remind them at the end.
      • Have an elevator speech handy – one or two sentences and a one-pager version of your story.
      • Consider how you will build your relationship with the members outside the boardroom.

      3.1.3 Build a compelling communication document

      Once you’ve identified your communication goals, data, and plan to present to your stakeholders, it’s important to build the compelling communication document that will attract all audiences.

      A good slide design increases the likelihood that the audience will read the content carefully.

      • Bad slide structure (flow) = Audience loses focus
        • You can have great content on a slide, but if a busy audience gets confused, they’ll just close the file or lose focus. Structure encompasses horizontal and vertical logic.
      • Good visual design = Audience might read more
        • Readers will probably skim the slides first. If the slides look ugly, they will already have a negative impression. If the slides are visually appealing, they will be more inclined to read carefully. They may even use some slides to show others.
      • Good content + Good structure + Visual appeal = Good presentation
        • A presentation is like a house. Good content is the foundation of the house. Good structure keeps the house strong. Visual appeal differentiates houses.

      Slide design best practices

      Leverage these slide design best practices to assist you in developing eye-catching presentations.

      • Easy to read: Assume reader is tight on time. If a slide looks overwhelming, the reader will close the document.
      • Concise and clear: Fewer words = more skim-able.
      • Memorable: Use graphics and visuals or pithy quotes whenever you can do so appropriately.
      • Horizontal logic: Good horizontal logic will have slide titles that cascade into a story with no holes or gaps.
      • Vertical logic: People usually read from left to right, top to bottom, or in a Z pattern. Make sure your slide has an intuitive flow of content.
      • Aesthetics: People like looking at visually appealing slides, but make sure your attempts to create visual appeal do not detract from the content.

      Your presentation must have a logical flow

      Horizontal logic

      Vertical logic

      • Horizontal logic should tell a story.
      • When slide titles are read in a cascading manner, they will tell a logical and smooth story.
      • Title & tagline = thesis (best insight).
      • Vertical logic should be intuitive.
      • Each step must support the title.
      • The content you intend to include within each slide is directly applicable to the slide title.
      • One main point per slide.

      Vertical logic should be intuitive

      The image contains a screenshot example of a bad design layout for a slide. The image contains a screenshot example of a good design layout for a slide.

      The audience is unsure where to look and in what order.

      The audience knows to read the heading first. Then look within the pie chart. Then look within the white boxes to the right.

      Horizontal and vertical logic checklists

      Horizontal logic

      Vertical logic

      • List your slide titles in order and read through them.
      • Good horizontal logic should feel like a story. Incomplete horizontal logic will make you pause or frown.
      • After a self-test, get someone else to do the same exercise with you observing them.
      • Note at which points they pause or frown. Discuss how those points can be improved.
      • Now consider each slide title proposed and the content within it.
      • Identify if there is a disconnect in title vs. content.
      • If there is a disconnect, consider changing the title of the slide to appropriately reflect the content within it, or consider changing the content if the slide title is an intended path in the story.

      Make it easy to read

      The image contains a screenshot that demonstrates an uneasy to read slide. The image contains a screenshot that demonstrates an easy to read slide.
      • Unnecessary coloring makes it hard on the eyes
      • Margins for title at top is too small
      • Content is not skim-able (best to break up the slide)

      Increase skim-ability:

      • Emphasize the subheadings
      • Bold important words

      Make it easier on the eyes:

      • Declutter and add sections
      • Have more white space

      Be concise and clear

      1. Write your thoughts down
        • This gets your content documented.
        • Don’t worry about clarity or concision yet.
      2. Edit for clarity
        • Make sure the key message is very clear.
        • Find your thesis statement.
      3. Edit for concision
        • Remove unnecessary words.
        • Use the active voice, not passive voice (see below for examples).

      Passive voice

      Active voice

      “There are three things to look out for” (8 words)

      “Network security was compromised by hackers” (6 words)

      “Look for these three things” (5 words)

      “Hackers compromised network security” (4 words)

      Be memorable

      The image contains a screenshot of an example that demonstrates a bad example of how to be memorable. The image contains a screenshot of an example that demonstrates a good example of how to be memorable.

      Easy to read, but hard to remember the stats.

      The visuals make it easier to see the size of the problem and make it much more memorable.

      Remember to:

      • Have some kind of visual (e.g. graphs, icons, tables).
      • Divide the content into sections.
      • Have a bit of color on the page.

      Aesthetics

      The image contains a screenshot of an example of bad aesthetics. The image contains a screenshot of an example of good aesthetics.

      This draft slide is just content from the outline document on a slide with no design applied yet.

      • Have some kind of visual (e.g. graphs, icons, tables) as long as it’s appropriate.
      • Divide the content into sections.
      • Have a bit of color on the page.
      • Bold or italicize important text.

      Why use visuals?

      How graphics affect us

      Cognitively

      • Engage our imagination
      • Stimulate the brain
      • Heighten creative thinking
      • Enhance or affect emotions

      Emotionally

      • Enhance comprehension
      • Increase recollection
      • Elevate communication
      • Improve retention

      Visual clues

      • Help decode text
      • Attract attention
      • Increase memory

      Persuasion

      • 43% more effective than text alone
      Source: Management Information Systems Research Center

      Presentation format

      Often stakeholders prefer to receive content in a specific format. Make sure you know what you require so that you are not scrambling at the last minute.

      • Is there a standard presentation template?
      • Is a hard-copy handout required?
      • Is there a deadline for draft submission?
      • Is there a deadline for final submission?
      • Will the presentation be circulated ahead of time?
      • Do you know what technology you will be using?
      • Have you done a dry run in the meeting room?
      • Do you know the meeting organizer?

      Checklist to build compelling visuals in your presentation

      Leverage this checklist to ensure you are creating the perfect visuals and graphs for your presentation.

      Checklist:

      • Do the visuals grab the audience’s attention?
      • Will the visuals mislead the audience/confuse them?
      • Do the visuals facilitate data comparison or highlight trends and differences in a more effective manner than words?
      • Do the visuals present information simply, cleanly, and accurately?
      • Do the visuals display the information/data in a concentrated way?
      • Do the visuals illustrate messages and themes from the accompanying text?

      3.2 Security communication templates

      Once you have identified your communication goals and plans for building your communication document, you can start building your presentation deck.

      These presentation templates highlight different security topics depending on your communication drivers, goals, and available data.

      Info-Tech has created five security templates to assist you in building a compelling presentation.

      These templates provide support for presentations on the following five topics:

      • Security Initiatives
      • Security & Risk Update
      • Security Metrics
      • Security Incident Response & Recovery
      • Security Funding Request

      Each template provides instructions on how to use it and tips on ensuring the right information is being presented.

      All the templates are customizable, which enables you to leverage the sections you need while also editing any sections to your liking.

      The image contains screenshots of the Security Presentation Templates.

      Download the Security Presentation Templates

      Security template example

      It’s important to know that not all security presentations for an organization are alike. However, these templates would provide a guideline on what the best practices are when communicating security to executive stakeholders.

      Below is an example of instructions to complete the “Security Risk & Update” template. Please note that the security template will have instructions to complete each of its sections.

      The image contains a screenshot of the Executive Summary slide. The image contains a screenshot of the Security Goals & Objectives slide.

      The first slide following the title slide includes a brief executive summary on what would be discussed in the presentation. This includes the main security threats that would be addressed and the associated risk mitigation strategies.

      This slide depicts a holistic overview of the organization’s security posture in different areas along with the main business goals that security is aligning with. Ensure visualizations you include align with the goals highlighted.

      Security template example (continued)

      The image contains a screenshot example of the Top Threats & Risks. The image contains a screenshot example of the Top Threats & Risks.

      This slide displays any top threats and risks an organization is facing. Each threat consists of 2-3 risks and is prioritized based on the negative impact it could have on the organization (i.e. red bar = high priority; green bar = low priority). Include risks that have been addressed in the past quarter, and showcase any prioritization changes to those risks.

      This slide follows the “Top Threats & Risks” slide and focuses on the risks that had medium or high priority. You will need to work with subject matter experts to identify risk figures (likelihood, financial impact) that will enable you to quantify the risks (Likelihood x Financial Impact). Develop a threshold for each of the three columns to identify which risks require further prioritization, and apply color coding to group the risks.

      Security template example (continued)

      The image contains a screenshot example of the slide, Risk Analysis. The image contains a screenshot example of the slide, Risk Mitigation Strategies & Roadmap.

      This slide showcases further details on the top risks along with their business impact. Be sure to include recommendations for the risks and indicate whether further action is required from the executive stakeholders.

      The last slide of the “Security Risk & Update” template presents a timeline of when the different initiatives to mitigate security risks would begin. It depicts what initiatives will be completed within each fiscal year and the total number of months required. As there could be many factors to a project’s timeline, ensure you communicate to your executive stakeholders any changes to the project.

      Phase 4

      Deliver communication

      Phase 1Phase 2Phase 3Phase 4

      1.1 Identify drivers for communicating to executives

      1.2 Define your goals for communicating to executives

      2.1 Identify data to collect

      2.2 Plan how to retrieve data

      3.1 Plan communication

      3.2 Build a compelling communication document

      4.1 Deliver a captivating presentation

      4.2 Obtain/verify support for security goals

      This phase will walk you through the following activities:

      • Identifying a strategy to deliver compelling presentations
      • Ensuring you follow best practices for communicating and obtaining your security goals

      This phase involves the following participants:

      • Security leader

      4.1 Deliver a captivating presentation

      You’ve gathered all your data, you understand what your audience is expecting, and you are clear on the outcomes you require. Now, it’s time to deliver a presentation that both engages and builds confidence.

      Follow these tips to assist you in developing an engaging presentation:

      • Start strong: Give your audience confidence that this will be a good investment of their time. Establish a clear direction for what’s going to be covered and what the desired outcome is.
      • Use your time wisely: Odds are, your audience is busy, and they have many other things on their minds. Be prepared to cover your content in the time allotted and leave sufficient time for discussion and questions.
      • Be flexible while presenting: Do not expect that your presentation will follow the path you have laid out. Anticipate jumping around and spending more or less time than you had planned on a given slide.

      Keep your audience engaged with these steps

      • Be ready with supporting data. Don’t make the mistake of not knowing your content intimately. Be prepared to answer questions on any part of it. Senior executives are experts at finding holes in your data.
      • Know your audience. Who are you presenting to? What are their specific expectations? Are there sensitive topics to be avoided? You can’t be too prepared when it comes to understanding your audience.
      • Keep it simple. Don’t assume that your audience wants to learn the details of your content. Most just want to understand the bottom line, the impact on them, and how they can help. More is not always better.
      • Focus on solving issues. Your audience members have many of their own problems and issues to worry about. If you show them how you can help make their lives easier, you’ll win them over.

      Info-Tech Insight
      Establishing credibility and trust with executive stakeholders is important to obtaining their support for security objectives.

      Be honest and straightforward with your communication

      • Be prepared. Being properly prepared means not only that your update will deliver the value that you expect, but also that you will have confidence and the flexibility you require when you’re taken off track.
      • Don’t sugarcoat it. These are smart, driven people that you are presenting to. It is neither beneficial nor wise to try to fool them. Be open and transparent about problems and issues. Ask for help.
      • No surprises. An executive stakeholder presentation is not the time or the place for a surprise. Issues seen as unexpected or contentious should always be dealt with prior to the meeting with those most impacted.

      Hone presentation skills before meeting with the executive stakeholders

      Know your environment

      Be professional but not boring

      Connect with your audience

      • Your organization has standards for how people are expected to dress at work. Make sure that your attire meets this standard – don’t be underdressed.
      • Think about your audience – would they appreciate you starting with a joke, or do they want you to get to the point as quickly as possible?
      • State the main points of your presentation confidently. While this should be obvious, it is essential. Your audience should be able to clearly see that you believe the points you are stating.
      • Present with lots of energy, smile, and use hand gestures to support your speech.
      • Look each member of the audience in the eye at least once during your presentation. Avoid looking at the ceiling, the back wall, or the floor. Your audience should feel engaged – this is essential to keeping their attention on you.
      • Never read from your slides. If there is text on a slide, paraphrase it while maintaining eye contact.

      Checklist for presentation logistics

      Optimize the timing of your presentation:

      • Less is more: Long presentations are detrimental to your cause – they lead to your main points being diluted. Keep your presentation short and concise.
      • Keep information relevant: Only present information that is important to your audience. This includes the information that they are expecting to see and information that connects to the business.
      • Expect delays: Your audience will likely have questions. While it is important to answer each question fully, it will take away from the precious time given to you for your presentation. Expect that you will not get through all the information you have to present.

      Script your presentation:

      • Use a script to stay on track: Script your presentation before the meeting. A script will help you present your information in a concise and structured manner.
      • Develop a second script: Create a script that is about half the length of the first script but still contains the most important points. This will help you prepare for any delays that may arise during the presentation.
      • Prepare for questions: Consider questions that may be asked and script clear and concise answers to each.
      • Practice, practice, practice: Practice your presentation until you no longer need the script in front of you.

      Checklist for presentation logistics (continued)

      Other considerations:

      • After the introduction of your presentation, clearly state the objective – don’t keep people guessing and consequently lose focus on your message.
      • After the presentation is over, document important information that came up. Write it down or you may forget it soon after.
      • Rather than create a long presentation deck full of detailed slides that you plan to skip over during the presentation, create a second, compact deck that contains only the slides you plan to present. Send out the longer deck after the presentation.

      Checklist for delivering a captivating presentation

      Leverage this checklist to ensure you are prepared to develop and deliver an engaging presentation.

      Checklist:

      • Start with a story or something memorable to break the ice.
      • Go in with the end state in mind (focus on the outcome/end goal and work back from there) – What’s your call to action?
      • Content must compliment your end goal, filter out any content that doesn’t compliment the end goal.
      • Be prepared to have less time to speak. Be prepared with shorter versions of your presentation.
      • Include an appendix with supporting data, but don’t be data heavy in your presentation. Integrate the data into a story. The story should be your focus.

      Checklist for delivering a captivating presentation (continued)

      • Be deliberate in what you want to show your audience.
      • Ensure you have clean slides so the audience can focus on what you’re saying.
      • Practice delivering your content multiple times alone and in front of team members or your Info-Tech counselor, who can provide feedback.
      • How will you handle being derailed? Be prepared with a way to get back on track if you are derailed.
      • Ask for feedback.
      • Record yourself presenting.

      4.2 Obtain and verify support on security goals

      Once you’ve delivered your captivating presentation, it’s imperative to communicate with your executive stakeholders.

      • This is your opportunity to open the floor for questions and clarify any information that was conveyed to your audience.
      • Leverage your appendix and other supporting documents to justify your goals.
      • Different approaches to obtaining and verifying your goals could include:
        • Acknowledgment from the audience that information communicated aligns with the business’s goals.
        • Approval of funding requests for security initiatives.
        • Written and verbal support for implementation of security initiatives.
        • Identifying next steps for information to communicate at the next executive stakeholder meeting.

      Info-Tech Insight
      Verifying your objectives at the end of the presentation is important, as it ensures you have successfully communicated to executive stakeholders.

      Checklist for obtaining and verify support on security goals

      Follow this checklist to assist you in obtaining and verifying your communication goals.

      Checklist:

      • Be clear about follow-up and next steps if applicable.
      • Present before you present: Meet with your executive stakeholders before the meeting to review and discuss your presentation and other supporting material and ensure you have executive/CEO buy-in.
      • “Be humble, but don’t crumble” – demonstrate to the executive stakeholders that you are an expert while admitting you don’t know everything. However, don’t be afraid to provide your POV and defend it if need be. Strike the right balance to ensure the board has confidence in you while building a strong relationship.
      • Prioritize a discussion over a formal presentation. Create an environment where they feel like they are part of the solution.

      Summary of Accomplishment

      Problem Solved

      A better understanding of security communication drivers and goals

      • Understanding the difference between communication drivers and goals
      • Identifying your drivers and goals for security presentation

      A developed a plan for how and where to retrieve data for communication

      • Insights on what type of data can be leveraged to support your communication goals
      • Understanding who you can collaborate with and potential data sources to retrieve data from

      A solidified communication plan with security templates to assist in better presenting to your audience

      • A guideline on how to prepare security presentations to executive stakeholders
      • A list of security templates that can be customized and used for various security presentations

      A defined guideline on how to deliver a captivating presentation to achieve your desired objectives

      • Clear message on best practices for delivering security presentations to executive stakeholders
      • Understanding how to verify your communication goals have been obtained

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information.

      workshops@infotech.com

      1-888-670-8889

      Related Info-Tech Research

      Build an Information Security Strategy
      This blueprint will walk you through the steps of tailoring best practices to effectively manage information security.

      Build a Security Metrics Program to Drive Maturity
      This blueprint will assist you in identifying security metrics that can tie to your organizational goals and build those metrics to achieve your desired maturity level.

      Bibliography

      Bhadauriya, Amit S. “Communicating Cybersecurity Effectively to the Board.” Metricstream. Web.
      Booth, Steven, et al. “The Biggest Mistakes Made When Presenting Cyber Security to Senior Leadership or the Board, and How to Fix Them.” Mandiant, May 2019. Web.
      Bradford, Nate. “6 Slides Every CISO Should Use in Their Board Presentation.” Security Boulevard, 9 July 2020. Web.
      Buckalew, Lauren, et al. “Get the Board on Board: Leading Cybersecurity from the Top Down.” Newsroom, 2 Dec. 2019. Web.
      Burg, Dave, et al. “Cybersecurity: How Do You Rise above the Waves of a Perfect Storm?” EY US - Home, EY, 22 July 2021. Web.
      Carnegie Endowment for International Peace. Web.
      “Chief Information Security Officer Salary.” Salary.com, 2022. Web.
      “CISO's Guide to Reporting to the Board - Apex Assembly.” CISO's Guide To Reporting to the Board. Web.
      “Cyber Security Oversight in the Boardroom” KPMG, Jan. 2016. Web.
      “Cybersecurity CEO: My 3 Tips for Presenting in the Boardroom.” Cybercrime Magazine, 31 Mar. 2020. Web.
      Dacri , Bryana. Do's & Don'ts for Security Professionals Presenting to Executives. Feb. 2018. Web.
      Froehlich, Andrew. “7 Cybersecurity Metrics for the Board and How to Present Them: TechTarget.” Security, TechTarget, 19 Aug. 2022. Web.
      “Global Board Risk Survey.” EY. Web.
      “Guidance for CISOs Presenting to the C-Suite.” IANS, June 2021. Web.
      “How to Communicate Cybersecurity to the Board of Directors.” Cybersecurity Conferences & News, Seguro Group, 12 Mar. 2020. Web.
      Ide, R. William, and Amanda Leech. “A Cybersecurity Guide for Directors” Dentons. Web.
      Lindberg, Randy. “3 Tips for Communicating Cybersecurity to the Board.” Cybersecurity Software, Rivial Data Security, 8 Mar. 2022. Web.
      McLeod, Scott, et al. “How to Present Cybersecurity to Your Board of Directors.” Cybersecurity & Compliance Simplified, Apptega Inc, 9 Aug. 2021. Web.
      Mickle, Jirah. “A Recipe for Success: CISOs Share Top Tips for Successful Board Presentations.” Tenable®, 28 Nov. 2022. Web.
      Middlesworth, Jeff. “Top-down: Mitigating Cybersecurity Risks Starts with the Board.” Spiceworks, 13 Sept. 2022. Web.
      Mishra, Ruchika. “4 Things Every CISO Must Include in Their Board Presentation.” Security Boulevard, 17 Nov. 2020. Web.
      O’Donnell-Welch, Lindsey. “CISOs, Board Members and the Search for Cybersecurity Common Ground.” Decipher, 20 Oct. 2022. Web.

      Bibliography

      “Overseeing Cyber Risk: The Board's Role.” PwC, Jan. 2022. Web.
      Pearlson, Keri, and Nelson Novaes Neto. “7 Pressing Cybersecurity Questions Boards Need to Ask.” Harvard Business Review, 7 Mar. 2022. Web.
      “Reporting Cybersecurity Risk to the Board of Directors.” Web.
      “Reporting Cybersecurity to Your Board - Steps to Prepare.” Pondurance ,12 July 2022. Web.
      Staynings, Richard. “Presenting Cybersecurity to the Board.” Resource Library. Web.
      “The Future of Cyber Survey.” Deloitte, 29 Aug. 2022. Web.
      “Top Cybersecurity Metrics to Share with Your Board.” Packetlabs, 10 May 2022. Web.
      Unni, Ajay. “Reporting Cyber Security to the Board? How to Get It Right.” Cybersecurity Services Company in Australia & NZ, 10 Nov. 2022. Web.
      Vogel, Douglas, et al. “Persuasion and the Role of Visual Presentation Support.” Management Information Systems Research Center, 1986.
      “Welcome to the Cyber Security Toolkit for Boards.” NCSC. Web.

      Research Contributors

      • Fred Donatucci, New-Indy Containerboard, VP, Information Technology
      • Christian Rasmussen, St John Ambulance, Chief Information Officer
      • Stephen Rondeau, ZimVie, SVP, Chief Information Officer

      IT Service Management Selection Guide

      • Buy Link or Shortcode: {j2store}488|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $29,187 Average $ Saved
      • member rating average days saved: 6 Average Days Saved
      • Parent Category Name: Service Desk
      • Parent Category Link: /service-desk
      • Your ITSM solution that was once good enough is no longer adequate for a rapidly evolving services culture.
      • Processes and data are disconnected with multiple workarounds and don’t allow the operations team to mature processes.
      • The workarounds, disparate systems, and integrations you’ve implemented to solve IT operations issues are no longer adequate.

      Our Advice

      Critical Insight

      • Accessing funding for IT solutions can be challenging when the solution isn’t obviously aligned to the business need.
      • To maximize value and stakeholder satisfaction, determine use cases early, engage the right stakeholders, and define success.
      • Choosing a solution for a single purpose and then expanding it to cover other use cases can be a very effective use of technology dollars. However, spending the time up front to determine which use cases should be included and which will need a separate best-of-breed solution will make the best use of your investment.

      Impact and Result

      • Create a business case that defines use cases and requirements.
      • Shorten the list of viable vendors by matching vendors to use cases.
      • Determine which features are most important to reach your goals and select the best-matched vendor.

      IT Service Management Selection Guide Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out how Info-Tech’s methodology will provide a quick solution to selecting ITSM vendors and understand the ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Build a business case

      Create a light business case to gain buy-in and define goals, milestones, and use cases.

      • IT Service Management Business Case Template

      2. Define requirements

      Create your list of requirements and shortlist vendors.

      • The ITSM Vendor Evaluation Workbook
      [infographic]

      Key Metrics for Every CIO

      • Buy Link or Shortcode: {j2store}119|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Performance Measurement
      • Parent Category Link: /performance-measurement
      • As a CIO, you are inundated with data and information about how your IT organization is performing based on the various IT metrics that exist.
      • The information we receive from metrics is often just that – information. Rarely is it used as a tool to drive the organization forward.
      • CIO metrics need to consider the goals of key stakeholders in the organization.

      Our Advice

      Critical Insight

      • The top metrics for CIOs don’t have anything to do with IT.
      • CIOs should measure and monitor metrics that have a direct impact on the business.
      • Be intentional with the metric and number of metrics that you monitor on a regular basis.
      • Be transparent with your stakeholders on what and why you are measuring those specific metrics.

      Impact and Result

      • Measure fewer metrics, but measure those that will have a significant impact on how your deliver value to your organization.
      • Focus on the metrics that you can take action against, rather than simply monitor.
      • Ensure your metrics tie to your top priorities as a CIO.

      Key Metrics for Every CIO Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Key Metrics for Every CIO deck – The top metrics every CIO should measure and act on

      Leverage the top metrics for every CIO to help focus your attention and provide insight into actionable steps.

      • Key Metrics for Every CIO Storyboard
      [infographic]

      Further reading

      Key Metrics for Every CIO

      The top six metrics for CIOs – and they have very little to do with IT

      Analyst Perspective

      Measure with intention

      Be the strategic CIO who monitors the right metrics relevant to their priorities – regardless of industry or organization. When CIOs provide a laundry list of metrics they are consistently measuring and monitoring, it demonstrates a few things.

      First, they are probably measuring more metrics than they truly care about or could action. These “standardized” metrics become something measured out of expectation, not intention; therefore, they lose their meaning and value to you as a CIO. Stop spending time on these metrics you will be unable or unwilling to address.

      Secondly, it indicates a lack of trust in the IT leadership team, who can and should be monitoring these commonplace operational measures. An empowered IT leader will understand the responsibility they have to inform the CIO should a metric be derailing from the desired outcome.

      Photo of Brittany Lutes, Senior Research Analyst, Organizational Transformation Practice, Info-Tech Research Group. Brittany Lutes
      Senior Research Analyst
      Organizational Transformation Practice
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      CIOs need to measure a set of specific metrics that:

      • Will support the organization’s vision, their career, and the IT function all in one.
      • Can be used as a tool to make informed decisions and take appropriate actions that will improve the IT function’s ability to deliver value.
      • Consider the influence of critical stakeholders, especially the end customer.
      • Are easily measured at any point in time.
      Common Obstacles

      CIOs often cannot define these metrics because:

      • We confuse the operational metrics IT leaders need to monitor with strategic metrics CIOs need to monitor.
      • Previously monitored metrics did not deliver value.
      • It is hard to decide on a metric that will prove both insightful and easily measurable.
      • We measure metrics without any method or insight on how to take actionable steps forward.
      Info-Tech’s Approach

      For every CIO, there are six areas that should be a focus, no matter your organization or industry. These six priorities will inform the metrics worth measuring:

      • Risk management
      • Delivering on business objectives
      • Customer satisfaction
      • Employee engagement
      • Business leadership relations
      • Managing to a budget

      Info-Tech Insight

      The top metrics for a CIO to measure and monitor have very little to do with IT and everything to do with ensuring the success of the business.

      Your challenge

      CIOs are not using metrics as a personal tool to advance the organization:
      • Metrics should be used as a tool by the CIO to help inform the future actions that will be taken to reach the organization’s strategic vision.
      • As a CIO, you need to have a defined set of metrics that will support your career, the organization, and the IT function you are accountable for.
      • CIO metrics must consider the most important stakeholders across the entire ecosystem of the organization – especially the end customer.
      • The metrics for a CIO are distinctly different from the metrics you use to measure the operational effectiveness of the different IT functions.
      “CIOs are businesspeople first and technology people second.” (Myles Suer, Source: CIO, 2019.)

      Common obstacles

      These barriers make this challenge difficult to address for many CIOs:
      • CIOs often do not measure metrics because they are not aware of what should or needs to be measured.
      • As a result of not wanting to measure the wrong thing, CIOs can often choose to measure nothing at all.
      • Or they get too focused on the operational metrics of their IT organization, leaving the strategic business metrics forgotten.
      • Moreover, narrowing the number of metrics that are being measured down to an actionable number is very difficult.
      • We rely only on physical data sets to help inform the measurements, not considering the qualitative feedback received.
      CIO priorities are business priorities

      46% of CIOs are transforming operations, focused on customer experiences and employee productivity. (Source: Foundry, 2022.)

      Finances (41.3%) and customers (28.1%) remain the top two focuses for CIOs when measuring IT effectiveness. All other focuses combine for the remaining 30.6%. (Source: Journal of Informational Technology Management, 2018.)

      Info-Tech’s approach

      Organizational goals inform CIO metrics

      Diagram with 'CIO Metrics' at the center surrounded by 'Directive Goals', 'Product/Service Goals', 'IT Goals', and 'Operations Goals', each of which are connected to eachother by 'Customers'.

      The Info-Tech difference:
      1. Every CIO has the same set of priorities regardless of their organization or industry given that these metrics are influenced by similar goals of organizations.
      2. CIO metrics are a tool to help inform the actions that will support each core area in reaching their desired goals.
      3. Be mindful of the goals different business units are using to reach the organization’s strategic vision – this includes your own IT goals.
      4. Directly or indirectly, you will always influence the ability to acquire and retain customers for the organization.

      CIO priorities

      MANAGING TO A BUDGET
      Reducing operational costs and increasing strategic IT spend.
      Table centerpiece for CIO Priorities. DELIVERING ON BUSINESS OBJECTIVES
      Aligning IT initiatives to the vision of the organization.
      CUSTOMER SATISFACTION
      Directly and indirectly impacting customer experience.
      EMPLOYEE ENGAGEMENT
      Creating an IT workforce of engaged and purpose-driven people.
      RISK MANAGEMENT
      Actively knowing and mitigating threats to the organization.
      BUSINESS LEADERSHIP RELATONS
      Establishing a network of influential business leaders.

      High-level process flow

      How do we use the CIO metrics?
      Process flow that starts at 'Consider - Identify and analyze CIO priorities', and is followed by 'Select priorities - Identify the top priorities for CIOs (see previous slide)', 'Create a measure - Determine a measure that aligns to each priority', 'Make changes & improvements - Take action to improve the measure and reach the goal you are trying to achieve', 'Demonstrate progress - Use the metrics to demonstrate progress against priorities'. Using priority-based metrics allows you to make incremental improvements that can be measured and reported on, which makes program maturation a natural process.

      Example CIO dashboard

      Example CIO dashboard.
      * Arrow indicates month-over-month trend

      Harness the value of metric data

      Metrics are rarely used accurately as a tool
      • When you have good metrics, you can:
        • Ensure employees are focused on the priorities of the organization
        • Have insight to make better decisions
        • Communicate with the business using language that resonates with each stakeholder
        • Increase the performance of your IT function
        • Continually adapt to meet changing business demands
      • Metrics are tools that quantifiably indicate whether a goal is on track to being achieved (proactive) or if the goal was successfully achieved (retroactive)
      • This is often reflected through two metric types:
        • Leading Metrics: The metric indicates if there are actions that should be taken in the process of achieving a desired outcome.
        • Lagging Metrics: Based on the desired outcome, the metric can indicate where there were successes or failures that supported or prevented the outcome from being achieved.
      • Use the data from the metrics to inform your actions. Do not collect this data if your intent is simply to know the data point. You must be willing to act.
      "The way to make a metric successful is by understanding why you are measuring it." (Jeff Neyland CIO)

      CIOs measure strategic business metrics

      Keep the IT leadership accountable for operational metrics
      • Leveraging the IT leadership team, empower and hold each leader accountable for the operational metrics specific to their functional area
      • As a CIO, focus on the metrics that are going to impact the business. These are often tied to people or stakeholders:
        • The customers who will purchase the product or service
        • The decision makers who will fund IT initiatives
        • The champions of IT value
        • The IT employees who will be driven to succeed
        • The owner of an IT risk event
      • By focusing on these priority areas, you can regularly monitor aspects that will have major business impacts – and be able to address those impacts.
      As a CIO, avoid spending time on operational metrics such as:
      • Time to deliver
      • Time to resolve
      • Project delivery (scope, time, money)
      • Application usage
      • User experiences
      • SLAs
      • Uptime/downtime
      • Resource costs
      • Ticket resolution
      • Number of phishing attempts
      Info-Tech Insight

      While operational metrics are important to your organization, IT leaders should be empowered and responsible for their management.

      SECTION 1

      Actively Managing IT Risks

      Actively manage IT risks

      The impact of IT risks to your organization cannot be ignored any further
      • Few individuals in an organization understand IT risks and can proactively plan for the prevention of those threats, making the CIO the responsible and accountable individual when it comes to IT risks – especially the components that tie into cybersecurity.
      • When the negative impacts of an IT threat event are translated into terms that can be understood and actioned by all in the organization, it increases the likelihood of receiving the sponsorship and funding support necessary.
      • Moreover, risk management can be used as a tool to drive the organization toward its vision state, enabling informed risk decisions.

      Risk management metric:

      Number of critical IT threats that were detected and prevented before impact to the organization.

      Beyond risk prevention
      Organizations that have a clear risk tolerance can use their risk assessments to better inform their decisions.
      Specifically, taking risks that could lead to a high return on investment or other key organizational drivers.

      Protect the organization from more than just cyber threats

      Other risk-related metrics:
      • Percentage of IT risks integrated into the organization’s risk management approach.
      • Number of risk management incidents that were not identified by your organization (and the potential financial impact of those risks).
      • Business satisfaction with IT actions to reduce impact of negative IT risk events.
      • Number of redundant systems removed from the organizations portfolio.
      Action steps to take:
      • Create a risk-aware culture, not just with IT folks. The entire organization needs to understand how IT risks are preventable.
      • Clearly demonstrate the financial and reputational impact of potential IT risks and ensure that this is communicated with decision-makers in the organization.
      • Have a single source of truth to document possible risk events and report prevention tactics to minimize the impact of risks.
      • Use this information to recommend budget changes and help make risk-informed decisions.

      49%

      Investing in Risk

      Heads of IT “cited increasing cybersecurity protections as the top business initiative driving IT investments this year” (Source: Foundry, 2022.)

      SECTION 2

      Delivering on Business Objectives

      Delivering on business objectives

      Deliver on initiatives that bring value to your organization and stop benchmarking
      • CIOs often want to know how they are performing in comparison to their competitors (aka where do you compare in the benchmarking?)
      • While this is a nice to know, it adds zero value in demonstrating that you understand your business, let alone the goals of your business
      • Every organization will have a different set of goals it is striving toward, despite being in the same industry, sector, or market.
      • Measuring your performance against the objectives of the organization prevents CIOs from being more technical than it would do them good.

      Business Objective Alignment Metric:

      Percentage of IT metrics have a direct line of impact to the business goals

      Stop using benchmarks to validate yourself against other organizations. Benchmarking does not provide:
      • Insight into how well that organization performed against their goals.
      • That other organizations goals are likely very different from your own organization's goals.
      • It often aggregates the scores so much; good and bad performers stop being clearly identified.

      Provide a clear line of sight from IT metrics to business goals

      Other business alignment metrics:
      • Number of IT initiatives that have a significant impact on the success of the organization's goals.
      • Number of IT initiatives that exceed the expected value.
      • Positive impact ($) of IT initiatives on driving business innovation.
      Action steps to take:
      • Establish a library or dashboard of all the metrics you are currently measuring as an IT organization, and align each of them to one or more of the business objectives your organization has.
      • Leverage the members of the organization’s executive team to validate they understand how your metric ties to the business objective.
      • Any metric that does not have a clear line of sight should be reconsidered.
      • IT metrics should continue to speak in business terms, not IT terms.

      50%

      CIOs drive the business

      The percentage of CEOs that recognize the CIO as the main driver of the business strategy in the next 2-3 years. (Source: Deloitte, 2020.)

      SECTION 3

      Impact on Customer Satisfaction

      Influencing end-customer satisfaction

      Directly or indirectly, IT influences how satisfied the customer is with their product or service
      • Now more than ever before, IT can positively influence the end-customer’s satisfaction with the product or service they purchase.
      • From operational redundancies to the customer’s interaction with the organization, IT can and should be positively impacting the customer experience.
      • IT leaders who take an interest in the customer demonstrate that they are business-focused individuals and understand the intention of what the organization is seeking to achieve.
      • With the CIO role becoming a strategic one, understanding why a customer would or would not purchase your organization’s product or service stops being a “nice to have.”

      Customer satisfaction metric:

      What is the positive impact ($ or %) of IT initiatives on customer satisfaction?

      Info-Tech Insight

      Be the one to suggest new IT initiatives that will impact the customer experience – stop waiting for other business leaders to make the recommendation.

      Enhance the end-customer experience with I&T

      Other customer satisfaction metrics:
      • Amount of time CIO spends interacting directly with customers.
      • Customer retention rate.
      • Customer attraction rate.
      Action steps to take:
      • Identify the core IT capabilities that support customer experience. Automation? Mobile application? Personal information secured?
      • Suggest an IT-supported or-led initiative that will enhance the customer experience and meet the business goals. Retention? Acquisition? Growth in spend?
      • This is where operational metrics or dashboards can have a real influence on the customer experience. Be mindful of how IT impacts the customer journey.

      41%

      Direct CX interaction

      In 2022, 41% of IT heads were directly interacting with the end customer. (Source: Foundry, 2022.)

      SECTION 4

      Keeping Employees Engaged

      Keeping employees engaged

      This is about more than just an annual engagement survey
      • As a leader, you should always have a finger on the pulse of how engaged your employees are
      • Employee engagement is high when:
        • Employees have a positive disposition to their place of work
        • Employees are committed and willing to contribute to the organization's success
      • Employee engagement comprises three types of drivers: organizational, job, and retention. As CIO, you have a direct impact on all three drivers.
      • Providing employees with a positive work environment where they are empowered to complete activities in line with their desired skillset and tied to a clear purpose can significantly increase employee engagement.

      Employee engagement metric:

      Number of employees who feel empowered to complete purposeful activities related to their job each day

      Engagement leads to increases in:
      • Innovation
      • Productivity
      • Performance
      • Teamwork
      While reducing costs associated with high turnover.

      Employees daily tasks need to have purpose

      Other employee engagement metrics:
      • Tenure of IT employees at the organization.
      • Number of employees who seek out or use a training budget to enhance their knowledge/skills.
      • Degree of autonomy employees feel they have in their work on a daily basis.
      • Number of collaboration tools provided to enable cross-organizational work.
      Action steps to take:
      • If you are not willing to take actionable steps to address engagement, don’t bother asking employees about it.
      • Identify the blockers to empowerment. Common blockers include insufficient team collaboration, bureaucracy, inflexibility, and feeling unsupported and judged.
      • Ensure there is a consistent understanding of what “purposeful” means. Are you talking about “purposeful” to the organization or the individual?
      • Provide more clarity on what the organization’s purpose is and the vision it is driving toward. Just because you understand does not mean the employees do.

      26%

      Act on engagement

      Only 26% of leaders actually think about and act on engagement every single day. (Source: SHRM, 2022.)

      SECTION 5

      Establishing Trusted Business Relationships

      Establishing trusted business partnerships

      Leverage your relationships with other C-suite executives to demonstrate IT’s value
      • Your relationship with other business peers is critical – and, funny enough, it is impacted by the use of good metrics and data.
      • The performance of your IT team will be recognized by other members of the executive leadership team (ELT) and is a direct reflection of you as a leader.
      • A good relationship with the ELT can alleviate issues if concerns about IT staff surface.
        • Of the 85% of IT leaders working on transformational initiatives, only 30% are trying to cultivate an IT/business partnership (Foundry, 2022).
      • Don’t let other members of the organizations ELT overlook you or the value IT has. Build the key relationships that will drive trust and partnerships.

      Business leadership relationship metric:

      Ability to influence business decisions with trusted partners.

      Some key relationships that are worth forming with other C-suite executives right now include:
      • Chief Sustainability Officer
      • Chief Revenue Officer
      • Chief Marketing Officer
      • Chief Data Officer

      Influence business decisions with trusted partners

      Other business relations metrics:
      • The frequency with which peers on the ELT complain about the IT organization to other ELT peers.
      • Percentage of business leaders who trust IT to make the right choices for their accountable areas.
      • Number of projects that are initiated with a desired solution versus problems with no desired solution.
      Action steps to take:
      • From lunch to the boardroom, it is important you make an effort to cultivate relationships with the other members of the ELT.
      • Identify who the most influential members of the ELT are and what their primary goals or objectives are.
      • Follow through on what you promise you will deliver – if you do not know, do not promise it!
      • What will work for one member of the ELT will not work for another – personalize your approach.

      60%

      Enterprise-wide collaboration

      “By 2023, 60% of CIOs will be primarily measured for their ability to co-create new business models and outcomes through extensive enterprise and ecosystem-wide collaboration.” (Source: IDC, 2021.)

      SECTION 6

      Managing to a Budget

      Managing to a budget

      Every CIO needs to be able to spend within budget while increasing their strategic impact
      • From security, to cloud, to innovating the organization's products and services, IT has a lot of initiatives that demand funds and improve the organization.
      • Continuing to demonstrate good use of the budget and driving value for the organization will ensure ongoing recognition in the form of increased money.
      • 29% of CIOs indicated that controlling costs and expense management was a key duty of a functional CIO (Foundry, 2022).
      • Demonstrating the ability to spend within a defined budget is a key way to ensure the business trusts you.
      • Demonstrating an ability to spend within a defined budget and reducing the cost of operational expenses while increasing spend on strategic initiatives ensures the business sees the value in IT.

      Budget management metric:

      Proportion of IT budget that is strategic versus operational.

      Info-Tech Insight

      CIOs need to see their IT function as its own business – budget and spend like a CEO.

      Demonstrate IT’s ability to spend strategically

      Other budget management metrics:
      • Cost required to lead the organization through a digital transformation.
      • Reduction in operational spend due to retiring legacy solutions.
      • Percentage of budget in the run, grow, and transform categories.
      • Amount of money spent keeping the lights on versus investing in new capabilities.

      Action steps to take:

      • Consider opportunities to automate processes and reduce the time/talent required to spend.
      • Identify opportunities and create the time for resources to modernize or even digitize the organization to enable a better delivery of the products or services to the end customer.
      • Review the previous metrics and tie it back to running the business. If customer satisfaction will increase or risk-related threats decrease through an initiative IT is suggesting, you can make the case for increased strategic spend.

      90%

      Direct CX interaction

      Ninety percent of CIOs expect their budget to increase or remain the same in their next fiscal year. (Source: Foundry, 2022.)

      Research contributors and experts

      Photo of Jeff Neyland. Jeff Neyland
      Chief Information Officer – University of Texas at Arlington
      Photo of Brett Trelfa. Brett Trelfa
      SVP and CIO – Arkansas Blue Cross Blue Shield
      Blank photo template. Lynn Fyhrlund
      Chief Information Officer – Milwaukee County Department of Administrative Services

      Info-Tech Research Group

      Vicki Van Alphen Executive Counselor Ibrahim Abdel-Kader Research Analyst
      Mary Van Leer Executive Counselor Graham Price Executive Counselor
      Jack Hakimian Vice President Research Valence Howden Principal Research Director
      Mike Tweedie CIO Practice Lead Tony Denford Organization Transformation Practice Lead

      Related Info-Tech Research

      Sample of the 'IT Metrics Library'. IT Metrics Library
      • Use this tool to review commonly used KPIs for each practice area
      • Identify KPI owners, data sources, baselines, and targets. It also suggests action and research for low-performing KPIs.
      • Use the "Action Plan" tab to keep track of progress on actions that were identified as part of your KPI review.
      Sample of 'Define Service Desk Metrics That Matter'. Define Service Desk Metrics That Matter
      • Consolidate your metrics and assign context and actions to those currently tracked.
      • Establish tension metrics to see and tell the whole story.
      • Split your metrics for each stakeholder group. Assign proper cadences for measurements as a first step to building an effective dashboard.
      Sample of 'CIO Priorities 2022'. CIO Priorities 2022
      • Understand how to respond to trends affecting your organization.
      • Determine your priorities based on current state and relevant internal factors.
      • Assign the right resources to accomplish your vision.
      • Consider what new challenges outside of your control will demand a response.

      Bibliography

      “Developing and Sustaining Employee Engagement.” SHRM, 2022.

      Dopson, Elise. “KPIs Vs. Metrics: What’s the Difference & How Do You Measure Both?” Databox, 23 Jun. 2021.

      Shirer, Michael, and Sarah Murray. “IDC Unveils Worldwide CIO Agenda 2022 Predictions.” IDC, 27 Oct. 2021.

      Suer, Myles. “The Most Important Metrics to Drive IT as a Business.” CIO, 19 Mar. 2019.

      “The new CIO: Business Savvy.” Deloitte Insights. Deloitte, 2020.

      “2022 State of the CIO: Rebalancing Act: CIO’s Operational Pandemic-Era Innovation.” Foundry, 2022.

      “Why Employee Engagement Matters for Leadership at all Levels.” Walden University, 20 Dec. 2019.

      Zhang, Xihui, et al. “How to Measure IT Effectiveness: The CIO’s Perspective.” Journal of Informational Technology Management, 29(4). 2018.

      Beyond Survival

      • Buy Link or Shortcode: {j2store}204|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Big Data
      • Parent Category Link: /big-data
      • Consumer, customer, employee, and partner behavior has changed; new needs have arisen as a result of COVID-19. Entire business models had to be rethought and revised – in real time with no warning.
      • And worse, no one knows when (or even if) the pandemic will end. The world and the economy will continue to be highly uncertain, unpredictable, and vulnerable for some time.
      • Business leaders need to continue experimenting to stay in business, protect employees and supply chains, manage financial obligations, allay consumer and employee fears, rebuild confidence, and protect trust.
      • How do organizations know whether their new business tactics are working?

      Our Advice

      Critical Insight

      • We can learn many lessons from those who have survived and are succeeding.
      • They have one thing in common though – they rely on data and analytics to help people think and know how to respond, evaluate effectiveness of new business tactics, uncover emerging trends to feed innovation, and minimize uncertainty and risk.
      • This mini-blueprint highlights organizations and use cases where data, analytics, and AI deliver tangible business and human value now and in the future.

      Impact and Result

      • Learn from the pandemic survivors and super-achievers so that you too can hit the ground running in the new normal. Even better – go beyond survival, like many of them have done. Create your future by leveraging and scaling up your data and analytics investments. It is not (yet) too late, and Info-Tech can help.

      Beyond Survival Research & Tools

      Beyond Survival

      Use data, analytics, and AI to reimagine the future and thrive in the new normal.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Beyond Survival Storyboard
      [infographic]

      Improve Your IT Recruitment Process

      • Buy Link or Shortcode: {j2store}578|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Attract & Select
      • Parent Category Link: /attract-and-select

      Business and IT leaders aiming to recruit and select the best talent need to:

      • Get involved in the talent acquisition process at key moments.
      • Market their organization to top talent through an authentic employer brand.
      • Create engaging and accurate job ads.
      • Leverage purposeful sourcing for anticipated talent needs.
      • Effectively assess candidates with a strong interview process.
      • Set up new employees for success.

      Our Advice

      Critical Insight

      To create a great candidate experience, IT departments must be involved in the process at key points, recruitment and selection is not a job for HR alone!

      Impact and Result

      • Use this how-to guide to articulate an authentic (employee value proposition) EVP and employer brand.
      • Perform an analysis of current sourcing methods and build an action plan to get IT involved.
      • Create an effective and engaging job ad to insure the right people are applying.
      • Train hiring managers to effectively deliver interviews that correctly assess candidate suitability.
      • Get links to in-depth Info-Tech resources and tools.

      Improve Your IT Recruitment Process Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Improve Your IT Recruitment Process – A guide to help you attract and select the best talent.

      Train your IT department to get involved in the recruitment process to attract and select the best talent.

      • Improve Your IT Recruitment Process Capstone Deck

      2. Improve Your IT Recruitment Process Workbook – A tool to document your action plans.

      Use this tool in conjunction with the Improve you IT Recruitment Process to document your action plans

      • Improve Your IT Recruitment Process Workbook

      3. Interview Guide Template – A template to organize interview questions and their rating scales, take notes during the interview, and ensure all interviews follow a similar structure.

      To get useful information from an interview, the interviewer should be focused on what candidates are saying and how they are saying it, not on what the next question will be, what probes to ask, or how they will score the responses. This Interview Guide Template will help interviewers stay focused and collect good information about candidates.

      • Interview Guide Template

      4. IT Behavioral Interview Question Library – A tool that contains a complete list of sample questions aligned with core, leadership, and IT competencies.

      Hiring managers can choose from a comprehensive collection of core, functional, and leadership competency-based behavioral interview questions.

      • IT Behavioral Interview Question Library

      5. Job Ad Template – A template to allow complete documentation of the characteristics, responsibilities, and requirements for a given job posting in IT.

      Use this template to develop a well-written job posting that will attract the star candidates and, in turn, deflect submission of irrelevant applications by those unqualified.

      • Job Ad Template

      6. Idea Catalog – A tool to evaluate virtual TA solutions.

      The most innovative technology isn’t necessarily the right solution. Review talent acquisition (TA) solutions and evaluate the purpose each option serves in addressing critical challenges and replacing critical in-person activities.

      • Idea Catalog: Adapt the Talent Acquisition Process to a Virtual Environment
      [infographic]

      Workshop: Improve Your IT Recruitment Process

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Employee Value Proposition and Employer Branding

      The Purpose

      Establish the employee value proposition (EVP) and employer brand.

      Key Benefits Achieved

      Have a well-defined EVP that you communicate through your employer brand.

      Activities

      1.1 Gather feedback.

      1.2 Build key messages.

      1.3 Assess employer brand.

      Outputs

      Content and themes surrounding the EVP

      Draft EVP and supporting statements

      A clearer understanding of the current employer brand and how it could be improved

      2 Job Ads and Sourcing

      The Purpose

      Develop job postings and build a strong sourcing program.

      Key Benefits Achieved

      Create the framework for an effective job posting and analyze existing sourcing methods.

      Activities

      2.1 Review and update your job ads.

      2.2 Review the effectiveness of existing sourcing programs.

      2.3 Review job ads and sourcing methods for bias.

      Outputs

      Updated job ad

      Low usage sourcing methods identified for development

      Minimize bias present in ads and sourcing methods

      3 Effective Interviewing

      The Purpose

      Create a high-quality interview process to improve candidate assessment.

      Key Benefits Achieved

      Training on being an effective interviewer.

      Activities

      3.1 Create an ideal candidate scorecard.

      3.2 Map out your interview process.

      3.3 Practice behavioral interviews.

      Outputs

      Ideal candidate persona

      Finalized interview and assessment process

      Practice interviews

      4 Onboarding and Action Plan

      The Purpose

      Drive employee engagement and retention with a robust program that acclimates, guides, and develops new hires.

      Key Benefits Achieved

      Evaluation of current onboarding practice.

      Activities

      4.1 Evaluate and redesign the onboarding program.

      Outputs

      Determine new onboarding activities to fill identified gaps.

      Further reading

      Improve Your IT Recruitment Process

      Train your IT department to get involved in the recruitment process to attract and select the best talent.

      Own the IT recruitment process

      Train your IT department to get involved in the recruitment process to attract and select the best talent.

      Follow this blueprint to:

      • Define and communicate the unique benefits of working for your organization to potential candidates through a strong employer brand.
      • Learn best practices around creating effective job postings.
      • Target your job posting efforts on the areas with the greatest ROI.
      • Create and deliver an effective, seamless, and positive interview and offer process for candidates.
      • Acclimate new hires and set them up for success.

      Get involved at key moments of the candidate experience to have the biggest impact


      Employee Value Proposition (EVP) and Employer Brand



      Job Postings and a Strong Sourcing Program

      Effective Interviewing

      Onboarding: Setting up New Hires For Success

      Awareness Research Application Screening Interview and Assessment Follow Up Onboarding

      RECRUIT QUALITY STAFF

      Hiring talent is critical to organizational success

      Talent is a priority for the entire organization:

      Respondents rated “recruitment” as the top issue facing organizations today (McLean & Company 2022 HR Trends Report).

      37% of IT departments are outsourcing roles to fill internal skill shortages (Info-Tech Talent Trends 2022 Survey).

      Yet bad hires are alarmingly common:

      Hiring is one of the least successful business processes, with three-quarters of managers reporting that they have made a bad hire (Robert Half, 2021).

      48% of survey respondents stated improving the quality of hires was the top recruiting priority for 2021 (Jobvite, 2021).

      Workshop overview

      Prework

      Day 1

      Day 2

      Day 3

      Day 4

      Post work

      Current Process and Job Descriptions Documented

      Establish the Employee Value Proposition (EVP) and Employer Brand

      Develop Job Postings and Build a Strong Sourcing Program

      Effective Interviewing

      Onboarding and Action Planning

      Putting the Action Plan Into Action!

      Activities

      • Recruitment Process Mapped Out and Stakeholders Identified
      • Prepare a JD and JP for Four Priority Jobs
      • Collect Information on Where Your Best Candidates Are Coming From

      1.1 Introduce the Concept of an EVP

      1.2 Brainstorm Unique Benefits of Working at Your Organization

      1.2 Employer Brand Introduction

      2.1 What Makes an Attractive Job Posting

      2.2 Create the Framework for Job Posting

      2.3 Improve the Sourcing Process

      2.4 Review Process for Bias

      3.1 Creating an Interview Process

      3.2 Selecting Interview Questions

      3.3 Avoiding Bias During Interviews

      3.4 Practice Interviews

      4.1 Why Onboarding Matters

      4.2 Acclimatize New Hires and Set Them Up for Success

      4.3 Action Plan

      5.1 Review Outputs and Select Priorities

      5.2 Consult With HR and Senior Management to Get Buy-In

      5.3 Plan to Avoid Relapse Behaviors

      Deliverables

      1. EVP draft completed
      2. Employer brand action plan
      1. Organization-specific job posting framework
      2. Sourcing Plan Template for four priority jobs
      3. Sourcing action plan
      1. Completed Interview Guide Template
      2. Managers practice a panel interview
      1. Onboarding best practices
      2. Action plan

      Enhance Your Recruitment Strategies

      The way you position the organization impacts who is likely to apply to posted positions.

      Develop a strong employee value proposition

      What is an employee value proposition?

      And what are the key components?

      The employee value proposition is your opportunity to showcase the unique benefits and opportunities of working at your organization, allowing you to attract a wider pool of candidates.

      AN EMPLOYEE VALUE PROPOSITION IS:

      AN EMPLOYEE VALUE PROPOSITION IS NOT:

      • An authentic representation of the employee experience
      • Aligned with organizational culture
      • Fundamental to all stages of the employee lifecycle
      • A guide to help investment in programs and policies
      • Short and succinct
      • What the employee can do for you
      • A list of programs and policies
      • An annual project

      THE FOUR KEY COMPONENTS OF AN EMPLOYEE VALUE PROPOSITION

      Rewards

      Organizational Elements

      Working Conditions

      Day-to-Day Job Elements

      • Compensation
      • Health Benefits
      • Retirement Benefits
      • Vacation
      • Culture
      • Customer Focus
      • Organization Potential
      • Department Relationships
      • Senior Management Relationships
      • Work/Life Balance
      • Working Environment
      • Employee Empowerment
      • Development
      • Rewards & Recognition
      • Co-Worker Relationships
      • Manager Relationships

      Creating a compelling EVP that presents a picture of your employee experience, with a focus on diversity, will attract a wide pool of diverse candidates to your team. This can lead to many internal and external benefits for your organization.

      How to collect information on your EVP

      Existing Employee Value Proposition: If your organization or IT department has an existing employee value proposition, rather than starting from scratch, we recommend leveraging that and moving to the testing phase to see if the EVP still resonates with staff and external parties.

      Employee Engagement Results: If your organization does an employee engagement survey, review the results to identify the areas in which the IT organization is performing well. Identify and document any key comment themes in the report around why employees enjoy working for the organization or what makes your IT department a great place to work.

      Social Media Sites. Prepare for the good, the bad, and the ugly. Social media websites like Glassdoor and Indeed make it easier for employees to share their experiences at an organization honestly and candidly. While postings on these sites won’t relate exclusively to the IT department, they do invite participants to identify their department in the organization. You can search these to identify any positive things people are saying about working for the organization and potentially opportunities for improvement (which you can use as a starting point in the retention section of this report).

      1.1 Gather feedback

      1. Download the Improve Your IT Recruitment Workbook.
      2. On tab 1.1, brainstorm the top five things you value most about working at the organization. Ask yourself what would fall in each category and identify any key themes. Be sure to take note of any specific quotes you have.
      3. Brainstorm limitations that the organization currently has in each of those areas.

      Download the Recruitment Workbook

      Input

      Output
      • Employee opinions
      • Employee responses to four EVP components
      • Content for EVP

      Materials

      Participants

      • Recruitment Workbook
      • Diverse employees
      • Different departments
      • Different role levels

      1.2 Build key messages

      1. Go to tab 1.2 in your workbook
      2. Identify themes from activity 1.1 that would be considered current strengths of you organization.
      3. Identify themes from activity 1.2 that are aspirational elements of your organization.
      4. Identify up to four key statements to focus on for the EVP, ensuring that your EVP speaks to at least one of the five categories above.
      5. Integrate these into one overall statement.

      Examples below.

      Input

      Output
      • Feedback from focus groups
      • EVP and supporting statements

      Materials

      Participants

      • Workbook handout
      • Pen and paper for documenting responses
      • IT leadership team

      Sample EVPs

      Shopify

      “We’re Shopify. Our mission is to make commerce better for everyone – but we’re not the workplace for everyone. We thrive on change, operate on trust, and leverage the diverse perspectives of people on our team in everything we do. We solve problems at a rapid pace. In short, we get shit done.”

      Bettercloud

      “At Bettercloud, we have a smart, ambitious team dedicated to delighting our customers. Our culture of ownership and transparency empowers our team to achieve goals they didn’t think possible. For all those on board, it’s going to be a challenging and rewarding journey – and we’re just getting started.”

      Ellevest

      “As a team member at Ellevest, you can expect to make a difference through your work, to have a direct impact on the achievement of a very meaningful mission, to significantly advance your career trajectory, and to have room for fun and fulfillment in your daily life. We know that achieving a mission as critical as ours requires incredible talent and teamwork, and team is the most important thing to us.”

      Sources: Built In, 2021; Workology, 2022

      Ensure your EVP resonates with employees and prospects

      Test your EVP with internal and external audiences.

      INTERNAL TEST REVOLVES AROUND THE 3A’s

      EXTERNAL TEST REVOLVES AROUND THE 3C’s

      ALIGNED: The EVP is in line with the organization’s purpose, vision, values, and processes. Ensure policies and programs are aligned with the organization’s EVP.

      CLEAR: The EVP is straightforward, simple, and easy to understand. Without a clear message in the market, even the best intentioned EVPs can be lost in confusion.

      ACCURATE: The EVP is clear and compelling, supported by proof points. It captures the true employee experience, which matches the organization’s communication and message in the market.

      COMPELLING: The EVP emphasizes the value created for employees and is a strong motivator to join this organization. A strong EVP will be effective in drawing in external candidates. The message will resonate with them and attract them to your organization.

      ASPIRATIONAL: The EVP inspires both individuals and the IT organization as a whole. Identify and invest in the areas that are sure to generate the highest returns for employees.

      COMPREHENSIVE: The EVP provides enough information for the potential employee to understand the true employee experience and to self-assess whether they are a good fit for your organization. If the EVP lacks depth, the potential employee may have a hard time understanding the benefits and rewards of working for your organization.

      Want to learn more?

      Recruit IT Talent

      • Improve candidate experience to hire top IT talent.

      Recruit and Retain More Women in IT

      • Gender diversity is directly correlated to IT performance.

      Recruit and Retain People of Color in IT

      • Good business, not just good philanthropy.

      Enhance Your Recruitment Strategies

      The way you position the organization impacts who is likely to apply to posted positions.

      Market your EVP to potential candidates: Employer Brand

      Employer brand includes how you market the EVP internally and externally – consistency is key

      The employer brand is the perception internal and external stakeholders hold of the organization and exists whether it has been curated or not. Curating the employer brand involves marketing the organization and employee experience. Grounding your employer brand in your EVP enables you to communicate and market an accurate portrayal of your organization and employee experience and make you desirable to both current and potential employees.

      The image contains a picture of several shapes. There is a trapezoid that is labelled EVP, and has a an arrow pointing to the text beside it. There is also an arrowing pointing down from it to another trapezoid that is labelled Employer Brand.

      The unique offering an employer provides to employees in return for their effort, motivating them to join or remain at the organization.

      The perception internal and external stakeholders hold of the organization.

      Alignment between the EVP, employer brand, and corporate brand is the ideal branding package. An in-sync marketing strategy ensures stakeholders perceive and experience the brand the same way, creating brand ambassadors.

      The image contains three circles that are connected. The circles are labelled: EVP, Employer Brand, Corporate Brand.

      Ensure your branding material creates a connection

      How you present your employer brand is just as important as the content. Ideally, you want the viewer to connect with and personalize the material for the message to have staying power. Use Marketing’s expertise to help craft impactful promotional materials to engage and excite the viewer.

      Visuals

      Images are often the first thing viewers notice. Use visuals that connect to your employer brand to engage the viewer’s attention and increase the likelihood that your message will resonate. However, if there are too many visuals this may detract from your content – balance is key!

      Language

      Wordsmithing is often the most difficult aspect of marketing. Your message should be accurate, informative, and engaging. Work with Marketing to ensure your wording is clever and succinct – the more concise, the better.

      Composition

      Integrate visuals and language to complete your marketing package. Ensure that the text and images are balanced to draw in the viewer.

      Case Study: Using culture to drive your talent pool

      This case study is happening in real time. Please check back to learn more as Goddard continues to recruit for the position.

      Recruiting at NASA

      Goddard Space Center is the largest of NASA’s space centers with approximately 11,000 employees. It is currently recruiting for a senior technical role for commercial launches. The position requires consulting and working with external partners and vendors.

      NASA is a highly desirable employer due to its strong culture of inclusivity, belonging, teamwork, learning, and growth. Its culture is anchored by a compelling vision, “For the betterment of Humankind,” and amplified by a strong leadership team that actively lives their mission and vision daily.

      Firsthand lists NASA as #1 on the 50 most prestigious internships for 2022.

      Rural location and no flexible work options add to the complexity of recruiting

      The position is in a rural area of Eastern Shore Virginia with a population of approximately 60,000 people, which translates to a small pool of candidates. Any hire from outside the area will be expected to relocate as the senior technician must be onsite to support launches twice a month. Financial relocation support is not offered and the position is a two-year assignment with the option of extension that could eventually become permanent.

      The image contains a picture of Steve Thornton.

      “Looking for a Talent Unicorn: a qualified, experienced candidate with both leadership skills and deep technical expertise that can grow and learn with emerging technologies.”

      Steve Thornton

      Acting Division Chief, Solutions Division, Goddard Space Flight Center, NASA

      Case Study: Using culture to drive your talent pool

      A good brand overcomes challenges.

      Culture takes the lead in NASA's job postings, which attract a high number of candidates. Postings begin with a link to a short video on working at NASA, its history, and how it lives its vision. The video highlights NASA's diversity of perspectives, career development, and learning opportunities.

      NASA's company brand and employer brand are tightly intertwined, providing a consistent view of the organization.

      The employer vision is presented in the best place to reach NASA's ideal candidate: usajobs.gov, the official website of the United States Government and the “go-to” for government job listings. NASA also extends its postings to other generic job sites as well as LinkedIn and professional associations.

      The image contains a picture of Robert Leahy.

      Interview with Robert Leahy

      Chief Information Officer, Goddard Space Flight Center, NASA

      2.1 Assess your organization’s employer brand

      1. Go to tab 2.1 in the Improve Your IT Recruitment Workbook.
      2. Put yourself in the shoes of someone on the outside looking in. If they were to look up your organization, what impression would they be given about what is like to work there?
      3. Run a Google search on your organization with key words “jobs,” “culture,” and “working environment” to see what a potential candidate would see when they begin researching your organization.
      4. You can use sites like:

      • Glassdoor
      • Indeed company pages
      • LinkedIn company pages
      • Social media
      • Your own website
    • Identify what your organization is doing well and record that under the “Continue” box in your workbook.
    • Record anything your organization should stop doing under the “Stop” box.
    • Brainstorm some ideas that your organization should think about implementing to improve the employer brand under the “Start” Box.
    • Input Output
      • Existing branding material on the internet
      • A clearer understanding of the current employer brand and how it could be improved
      Materials Participants
      • Workbook handout
      • Senior IT Leaders

      Want to learn more?

      Recruit IT Talent

      • Improve candidate experience to hire top IT talent.

      Recruit and Retain More Women in IT

      • Gender diversity is directly correlated to IT performance.

      Recruit and Retain People of Color in IT

      • Good business, not just good philanthropy.

      Enhance Your Recruitment Strategies

      The way you position the organization impacts who is likely to apply to posted positions.

      Create engaging job ads to attract talent to the organization

      We have a job description; can I just post that on Indeed?

      A job description is an internal document that includes sections such as general job information, major responsibilities, key relationships, qualifications, and competencies. It communicates job expectations to incumbents and key job data to HR programs.

      A job ad is an externally facing document that advertises a position with the intent of attracting job applicants. It contains key elements from the job description as well as information on the organization and its EVP.

      Write an Effective Job Ad

      • Ensure that your job ad speaks to the audience you are targeting through the language you use.
        • E.g. If you are hiring for a creative role, use creative language and formatting. If you are writing for students, emphasize growth opportunities.
      • Highlight the organization’s EVP.
      • Paint an accurate picture of key aspects of the role but avoid the nitty gritty as it may overwhelm applicants.
      • Link to your organization’s website and social media platforms so applicants can easily find more information.

      A job description informs a job ad, it doesn’t replace it. Don’t be lulled into using a job description as a posting when there’s a time crunch to fill a position. Refer to job postings as job advertisements to reinforce that their purpose is to attract attention and talent.

      An effective job posting contains the following elements:

      Position Title
      • Clearly defined job titles are important for screening applicants as this is one of the first things the candidate will read.
      • Indicating the earnings range that the position pays cuts out time spent on reviewing candidates who may never accept the position and saves them from applying to a job that doesn’t match what they are looking for.
      Company
      • Provide a brief description of the organization including the products or services it offers, the corporate culture, and any training and career development programs.
      Summary Description
      • Describe briefly why the position exists. In other words, what is the position's primary purpose? The statement should include the overall results the job is intended to produce and some of the key means by which the position achieves these results.
      Responsibilities
      • Use bullet points to list the fundamental accountabilities of the position. Candidates want to know what they will be doing on a day-to-day basis.
      • Begin each responsibility or accountability statement with an action word and follow with a brief phrase to describe what is done to accomplish the function.
      Position Characteristics
      • Give examples of key problems and thinking challenges encountered by the position. Describe the type of analysis or creativity required to resolve these problems.
      • Provide examples of final decision-making authority. The examples should reflect the constraints placed on the position by people, policies, and/or procedures.
      Position Requirements
      • List all formal education and certifications required.
      • List all knowledge and experience required.
      • List all personal attributes required.
      Work Conditions
      • List all work conditions that the employee must accommodate. This could include any sensory, physical, or mental requirements of the position or any special conditions of employment, such as hours.
      Process to Apply
      • Include the methods in which the organization wants to receive applications and contact information of who will receive the applications.

      Bottom Line: A truly successful job posting ferrets out those hidden stars that may be over cautious and filters out hundreds of applications from the woefully under qualified.

      The do’s and don’ts of an inclusive job ad

      DON’T overlook the power of words. Avoid phrases like “strong English language skills” as this may deter non-native English speakers from applying and a “clean-shaven” requirement can exclude candidates whose faith requires them to maintain facial hair.

      DON’T post a long requirements list. A study showed that the average jobseeker spends only 49.7 seconds reviewing a listing before deciding it's not a fit.*

      DON’T present a toxic work culture; phrases such as “work hard, play hard” can put off many candidates and play into the “bro- culture” stereotype in tech.

      Position Title: Senior Lorem Ipsum

      Salary Band: $XXX to $XXX

      Diversity is a core value at ACME Inc. We believe that diversity and inclusion is our strength, and we’re passionate about building an environment where all employees are valued and can perform at their best.

      As a … you will …

      Our ideal candidate ….

      Required Education and Experience

      • Bachelor’s degree in …
      • Minimum five (5) years …

      Required Skills

      Preferred Skills

      At ACME Inc. you will find …

      DO promote pay equity by being up front and honest about salary expectations.

      DO emphasize your organization’s commitment to diversity and an inclusive workplace by adding an equity statement.

      DO limit your requirements to “must haves” or at least showcase them first before the “nice-to-haves.”

      DO involve current employees or members of your employee resource groups when creating job descriptions to ensure that they ask for what you really need.

      DO focus on company values and criteria that are important to the job, not just what’s always been done.

      *Source: Ladders, 2013

      Before posting the job ad complete the DEI job posting validation checklist

      Does the job posting highlight your organization’s EVP

      Does the job posting avoid words that might discourage women, people of color, and other members of underrepresented groups from applying?

      Has the position description been carefully reviewed and revised to reflect current and future expectations for the position, rather than expectations informed by the persons who have previously held the job?

      Has the hiring committee eliminated any unnecessary job skills or requirements (college degree, years or type of previous experience, etc.) that might negatively impact recruitment of underrepresented groups?

      Has the hiring committee posted the job in places (job boards, websites, colleges, etc.) where applicants from underrepresented groups will be able to easily view or access it?

      Have members of the hiring committee attended job fairs or other events hosted by underrepresented groups?

      Has the hiring committee asked current employees from underrepresented groups to spread the word about the position?

      Has the hiring committee worked with the marketing team to ensure that people from diverse groups are featured in the organization’s website, publications, and social media?

      es the job description clearly demonstrate the organization’s and leadership’s commitment to DEI?

      *Source: Recruit and Retain People of Color in IT

      3.1 Review and update your job ads

      1. Download the Job Ad Template.
      2. Look online or ask HR for an example of a current job advertisement you are using.
      • If you don’t have one, you can use a job description as a starting point.
    • Review all the elements of the job ad and make sure they align with the list on the previous slide, adding or changing, as necessary. Your job ad should be no more than two pages long.
    • Using the tools on the previous two slides, review your first draft to ensure the job posting is free of language or elements that will discourage diverse candidates from applying.
    • Review your job advertisement with HR to get feedback or to use as a template going forward.
    • Input Output
      • Existing job ad or job description
      • Updated job ad
      Materials Participants
      • Job ad or job description
      • Job Ad Template
      • Hiring Managers

      Want to learn more?

      Recruit IT Talent

      • Improve candidate experience to hire top IT talent.

      Recruit and Retain More Women in IT

      • Gender diversity is directly correlated to IT performance.

      Recruit and Retain People of Color in IT

      • Good business, not just good philanthropy.

      Enhance Your Recruitment Strategies

      Focus on key programs and tactics to improve the effectiveness of your sourcing approach.

      Get involved with sourcing to get your job ad seen

      To meet growing expectations, organizations need to change the way they source

      Social Media

      Social media has trained candidates to expect:

      • Organizations to stay in touch and keep track of them.
      • A personalized candidate experience.
      • To understand organizational culture and a day in the life.

      While the focus on the candidate experience is important throughout the talent acquisition process, social media, technology, and values have made it a critical component of sourcing.

      Technology

      Candidates expect to be able to access job ads from all platforms.

      • Today, close to 90% of candidates use a mobile platform to job hunt (SmartRecruiters, 2022).
      • However, only 36% of organizations are optimizing their job postings for mobile. (The Undercover Recruiter, 2021)

      Job ads must be clear, concise, and easily viewed on a mobile device.

      Candidate Values

      Job candidate’s values are changing.

      • There is a growing focus on work/life balance, purpose, innovation, and career development. Organizations need to understand candidate values and highlight how the EVP aligns with these interests.

      Authenticity remains important.

      • Clearly and accurately represent your organization and its culture.

      Focus on key programs and tactics to improve the effectiveness of your sourcing approach

      Internal Talent Mobility (ITM) Program

      Social Media Program

      Employee Referral Program

      Alumni Program

      Campus Recruiting Program

      Other Sourcing Tactics

      Take advantage of your current talent with an internal talent mobility program

      What is it?

      Positioning the right talent in the right place, at the right time, for the right reasons, and supporting them appropriately.

      Internal Talent Mobility (ITM) Program

      Social Media Program

      Employee Referral Program

      Alumni Program

      Campus Recruiting Program

      Other Sourcing Tactics

      ITM program benefits:

      1. Retention
      2. Provide opportunities to develop professionally, whether in the current role or through promotions/lateral moves. Keep strong performers and high-potential employees committed to the organization.

      3. Close Skills Gap
      4. Address rapid change, knowledge drain due to retiring Baby Boomers, and frustration associated with time to hire or time to productivity.

      5. Cost/Time Savings
      6. Reduce spend on talent acquisition, severance, time to productivity, and onboarding.

      7. Employee Engagement
      8. Increase motivation and productivity by providing increased growth and development opportunities.

      9. EVP
      10. Align with the organization’s offering and what is important to the employees from a development perspective.

      11. Employee & Leadership Development
      12. Support and develop employees from all levels and job functions.

      Leverage social media to identify and connect with talent

      Internal Talent Mobility (ITM) Program

      Social Media Program

      Employee Referral Program

      Alumni Program

      Campus Recruiting Program

      Other Sourcing Tactics

      What is it? The widely accessible electronic tools that enable anyone to publish and access information, collaborate on common efforts, and build relationships.

      Learning to use social media effectively is key to sourcing the right talent.

      • Today, 92% of organizations leverage social media for talent acquisition.
      • 80% of employers find passive candidates through social media – second only to referrals.
      • 86% percent of job seekers used social media for their most recent job search.
      (Ku, 2021)

      Benefits of social media:

      • Provides access to candidates who may not know the organization.
      • Taps extended networks.
      • Facilitates consistent communication with candidates and talent in pipelines.
      • Personalizes the candidate experience.
      • Provides access to extensive data.

      Challenges of social media:

      With the proliferation of social media and use by most organizations, social media platforms have become overcrowded. As a result:

      • Organizations are directly and very apparently competing for talent with competitors.
      • Users are bombarded with information and are tuning out.

      “It is all about how we can get someone’s attention and get them to respond. People are becoming jaded.”

      – Katrina Collier, Social Recruiting Expert, The Searchologist

      Reap the rewards of an employee referral program

      Internal Talent Mobility (ITM) Program

      Social Media Program

      Employee Referral Program

      Alumni Program

      Campus Recruiting Program

      Other Sourcing Tactics

      What is it? Employees recommend qualified candidates. If the referral is hired, the referring employee typically receives some sort of reward.

      Benefits of an employee referral program:

      1. Lower Recruiting Costs
      2. 55% of organizations report that hiring a referral is less expensive that a non-referred candidate (Clutch, 2020).

      3. Decreased time to fill
      4. The average recruiting lifecycle for an employee referral is 29 days, compared with 55 days for a non referral (Betterup, 2022).

      5. Decreased turnover
      6. 46% percent of employees who were referred stay at their organization for a least one year, compared to 33% of career site hires (Betterup, 2022).

      7. Increased quality of hire
      8. High performers are more likely to refer other high performers to an organization (The University of Chicago Press, 2019).

      Avoid the Like Me Bias: Continually evaluate the diversity of candidates sourced from the employee referral program. Unless your workforce is already diverse, referrals can hinder diversity because employees tend to recommend people like themselves.

      Tap into your network of former employees

      Internal Talent Mobility (ITM) Program

      Social Media Program

      Employee Referral Program

      Alumni Program

      Campus Recruiting Program

      Other Sourcing Tactics

      What is it? An alumni referral program is a formalized way to maintain ongoing relationships with former employees of the organization.

      Successful organizations use an alumni program:

      • 98% of the F500 have some sort of Alumni program (LinkedIn, 2019).

      Benefits of an alumni program:

      1. Branding
      • Alumni are regarded as credible sources of information. They can be a valuable resource for disseminating and promoting the employer brand.
    • Source of talent
      • Boomerang employees are doubly valuable as they understand the organization and also have developed skills and industry experience.
        • Recover some of the cost of turnover and cost per hire with a pool of prequalified candidates who will more quickly reach full productivity.
    • Referral potential
      • Developing a robust alumni network provides access to a larger network through referrals.
      • Alumni already know what is required to be successful in the organization so they can refer more suitable candidates.

      Make use of a campus recruiting program

      Internal Talent Mobility (ITM) Program

      Social Media Program

      Employee Referral Program

      Alumni Program

      Campus Recruiting Program

      Other Sourcing Tactics

      What is it? A formalized means of attracting and hiring individuals who are about to graduate from schools, colleges, or universities.

      Almost 70% of companies are looking to employ new college graduates every year (HR Shelf, 2022).

      Campus recruitment benefits:

      • Increases employer brand awareness among talent entering the workforce.
      • Provides the opportunity to interact with large groups of potential candidates at one time.
      • Presents the opportunity to identify and connect with high-quality talent before they graduate and are actively looking for positions.
      • Offers access to a highly diverse audience.

      Info-Tech Insight

      Target schools that align with your culture and needs. Do not just focus on the most prestigious schools: they are likely more costly, have more intense competition, and may not actually provide the right talent.

      Identify opportunities to integrate non-traditional techniques

      Internal Talent Mobility (ITM) Program

      Social Media Program

      Employee Referral Program

      Alumni Program

      Campus Recruiting Program

      Other Sourcing Tactics

      1. Professional industry associations
      • Tap into candidates who have the necessary competencies.

      5. Not-for-profit intermediaries

      • Partner with not-for-profits to tap into candidates in training or mentorship programs.
      • Example:
        • Year Up (General)
        • Bankwork$ (Banking)
        • Youth Build (Construction)
        • iFoster (Grocery)

      American Expresscreated a boot camp for software engineers in partnership with Year Up and Gateway Community College to increase entry-level IT hires.

      Results:

      • Annually hire 80-100 interns from Year Up.
      • Improved conversion rates: 72% of Year Up interns versus 60% of traditional interns.
      • Increased retention: 44 (Year Up) versus 18 months (traditional).
      (HBR, 2016)

      2. Special interest groups

      • Use for niche role sourcing.
      • Find highly specialized talent.
      • Drive diversity (Women in Project Management).

      6. Gamification

      • Attract curiosity and reaffirm innovation at your organization.
      • Communicate the EVP.
      3. Customers
      • Access those engaged with the organization.
      • Add the employer brand to existing messaging.

      PwC (Hungary) created Multiploy, a two-day game that allows students to virtually experience working in accounting or consulting at the organization.

      Results:

      • 78% of students said they wanted to work for PwC.
      • 92% indicated they had a more positive view of the firm.
      • Increase in the number of job applicants.
      (Zielinski, 2015)

      4. Exit interviews

      • Ask exiting employees “where should we recruit someone to replace you?”
      • Leverage their knowledge to glean insight into where to find talent.

      Partner with other organizational functions to build skills and leverage existing knowledge

      Use knowledge that already exists in the organization to improve talent sourcing capabilities.

      Marketing

      HR

      Marketing knows how to:

      • Build attention-grabbing content.
      • Use social media platforms effectively.
      • Effectively promote a brand.
      • Use creative methods to connect with people.

      HR knows how to:

      • Organize recruitment activities.
      • Identify the capabilities of various technologies available to support sourcing.
      • Solve issues that may arise along the way

      To successfully partner with other departments in your organization:

      • Acknowledge that they are busy. Like IT, they have multiple competing priorities.
      • Present your needs and prioritize them. Create a list of what you are looking for and then be willing to just pick your top need. Work with the other department to decide what needs can and cannot be met.
      • Present the business case. Emphasize how partnering is mutually beneficial. For example, illustrate to Marketing that promoting a strong brand with candidates will improve the organization’s overall reputation because often, candidates are customers.
      • Be reasonable and patient. You are asking for help, so be moderate in your expectations and flexible in working with your partner.

      Info-Tech Insight

      Encourage your team to seek out, and learn from, employees in different divisions. Training sessions with the teams may not always be possible but one-on-one chats can be just as effective and may be better received.

      5.1 Review the effectiveness of existing sourcing programs

      1. As a group review the description of each program as defined on previous slides. Ensure that everyone understands the definitions.
      2. In your workbook, look for the cell Internal Talent Mobility under the title; you will find five rows with the following
      • This program is formally structured and documented.
      • This program is consistently applied across the organization.
      • Talent is sourced this way on an ad hoc basis.
      • Our organization currently does not source talent this way.
      • There are metrics in place to assess the effectiveness of this program.
    • Ask everyone in the group if they agree with the statement for each column; once everyone has had a chance to answer each of the questions, discuss any discrepancies which exist.
    • After coming to a consensus, record the answers.
    • Repeat this process for the other four sourcing programs (social media, employee referral program, alumni network program, and campus recruiting program).
    • InputOutput
      • Existing knowledge on sourcing approach
      • Low usage sourcing methods identified for development
      MaterialsParticipants
      • Workbook
      • Hiring Managers

      Want to learn more?

      Recruit IT Talent

      • Improve candidate experience to hire top IT talent.

      Recruit and Retain More Women in IT

      • Gender diversity is directly correlated to IT performance.

      Recruit and Retain People of Color in IT

      • Good business, not just good philanthropy.

      Enhance Your Recruitment Strategies

      Interviews are the most often used yet poorly executed hiring tool.

      Create a high-quality interview process to improve candidate assessment

      Everyone believes they’re a great interviewer; self-assess your techniques, and “get real” to get better

      If you…

      • Believe everything the candidate says.
      • Ask mostly hypothetical questions: "What would you do in a situation where…"
      • Ask gimmicky questions: "If you were a vegetable, what vegetable would you be?"
      • Ask only traditional interview questions: "What are your top three strengths?”
      • Submit to a first impression bias.
      • Have not defined what you are looking for before the interview.
      • Ignore your gut feeling in an attempt to be objective.
      • Find yourself loving a candidate because they are just like you.
      • Use too few or too many interviewers in the process.
      • Do not ask questions to determine the motivational fit of the candidate.
      • Talk more than the interviewee.
      • Only plan and prepare for the interview immediately before it starts.

      …then stop. Use this research!

      Most interviewers are not effective, resulting in many poor hiring decisions, which is costly and counter-productive

      Most interviewers are not effective…

      • 82% of organizations don’t believe they hire highly talented people (Trost, 2022).
      • Approximately 76% of managers and HR representatives that McLean & Company interviewed agreed that the majority of interviewers are not very effective.
      • 66% of hiring managers come to regret their interview-based hiring decisions (DDI, 2021).

      …because, although everyone knows interviewing is a priority, most don’t make it one.

      • Interviewing is often considered an extra task in addition to an employee’s day-to-day responsibilities, and these other responsibilities take precedence.
      • It takes time to effectively design, prepare for, and conduct an interview.
      • Employees would rather spend this time on tasks they consider to be an immediate priority.

      Even those interviewers who are good at interviewing, may not be good enough.

      • Even a good interviewer can be fooled by a great interviewee.
      • Some interviewees talk the talk, but don’t walk the walk. They have great interviewing abilities but not the skills required to be successful in the specific position for which they are interviewing.
      • Even if the interviewer is well trained and prepared to conduct a strong interview, they can get caught up with an interviewee that seems very impressive on the surface, and end up making a bad hire.

      Preparing the Perfect Interview

      Step 5: Define decision rights

      Establish decision-making authority and veto power to mitigate post-interview conflicts over who has final say over a candidate’s status.

      Follow these steps to create a positive interview experience for all involved.

      Step 1: Define the ideal candidate profile; determine the attributes of the ideal candidate and their relative importance

      Define the attributes of the ideal candidate…

      Ideal candidate = Ability to do the job + Motivation to do the job + Fit

      Competencies

      • Education
      • Credentials
      • Technical skills
      • Career path
      • Salary expectations
      • Passion
      • Potential
      • Personality
      • Managerial style/preference

      Experiences

      • Years of service
      • Specific projects
      • Industry

      Data for these come from:

      • Interviews
      • Personality tests
      • Gut instinct or intuition

      Data for these come from:

      • Resumes
      • Interviews
      • Exercises and tests
      • References

      Caution: Evaluating for “organizational or cultural fit” can lead to interviewers falling into the trap of the “like me” bias, and excluding diverse candidates.

      …then determine the importance of the attributes.

      Non-negotiable = absolutely required for the job!

      Usually attributes that are hard to train, such as writing skills, or expensive to acquire after hire, such as higher education or specific technical skills.

      An Asset

      Usually attributes that can be trained, such as computer skills. It’s a bonus if the new hire has it.

      Nice-to-have

      Attributes that aren’t necessary for the job but beneficial. These could help in breaking final decision ties.

      Deal Breakers: Also discuss and decide on any deal breakers that would automatically exclude a candidate.

      The job description is not enough; meet with stakeholders to define and come to a consensus on the ideal candidate profile

      Definition of the Ideal Candidate

      • The Hiring Manager has a plan for the new hire and knows the criteria that will best fulfill that mandate.
      • The Executive team may have specific directives for what the ideal candidate should look like, depending on the level and critical nature of the position.
      • Industry standards, which are defined by regulatory bodies, are available for some positions. Use these to identify skills and abilities needed for the job.
      • Competitor information such as job descriptions and job reviews could provide useful data about a similar role in other organizations.
      • Exit interviews can offer insight into the most challenging aspects of the job and identify skills or abilities needed for success.
      • Current employees who hold the same or a similar position can explain the nuances of the day-to-day job and what attributes are most needed on the team.

      “The hardest work is accurately defining what kind of person is going to best perform this job. What are their virtues? If you’ve all that defined, the rest is not so tough.”

      – VP, Financial Services

      Use a scorecard to document the ideal candidate profile and help you select a superstar

      1. Download the Workbook and go to tab 6.1.
      2. Document the desired attributes for each category of assessment: Competencies, Experiences, Fit, and Motivation. You can find an Attribute Library on the next tab.
      3. Rank each attribute by level of priority: Required, Asset, or Nice-to-Have.
      4. Identify deal breakers that would automatically disqualify a candidate from moving forward.
      InputOutput
      • Job description
      • Stakeholder input
      • Ideal candidate persona
      MaterialsParticipants
      • Workbook
      • Hiring Managers

      To identify questions for screening interviews, use the Screening Interview Template

      A screening interview conducted by phone should have a set of common questions to identify qualified candidates for in-person interviews.

      The Screening Interview Template will help you develop a screening interview by providing:

      • Common screening questions that can be modified based on organizational needs and interview length.
      • Establishing an interview team.
      • A questionnaire format so that the same questions are asked of all candidates and responses can be recorded.

      Once completed, this template will help you or HR staff conduct candidate screening interviews with ease and consistency. Always do screening interviews over the phone or via video to save time and money.

      Info-Tech Insight

      Determine the goal of the screening interview – do you want to evaluate technical skills, communication skills, attitude, etc.? – and create questions based on this goal. If evaluating technical skill, have someone with technical competency conduct the interview.

      The image contains screenshots of the Screening Interview Template.

      Step 2: Choose interview types and techniques that best assess the ideal candidate attributes listed on the position scorecard

      There is no best interview type or technique for assessing candidates, but there could be a wrong one depending on the organization and job opening.

      • Understanding common interviewing techniques and types will help inform your own interviewing strategy and interview development.
      • Each interview technique and type has its own strengths and weakness and can be better suited for a particular organizational environment, type of job, or characteristic being assessed.
      The image contains a diagram to demonstrate the similarities and differences of Interview Technique and Interview Type. There is a Venn Diagram, the right circle is labelled: Interview Technique, and the right is: Interview Type. There is a double sided arrow below that has the following text: Unstructure, Semi-Structured, and Structured.

      Unstructured: A traditional method of interviewing that involves no constraints on the questions asked, no requirements for standardization, and a subjective assessment of the candidate. This format is the most prone to bias.

      Semi-Structured: A blend of structured and unstructured, where the interviewer will ask a small list of similar questions to all candidates along with some questions pertaining to the resume.

      Structured: An interview consisting of a standardized set of job-relevant questions and a scoring guide. The goal is to reduce interviewer bias and to help make an objective and valid decision about the best candidate.

      No matter which interview types or techniques you use, aim for it to be as structured as possible to increase its validity

      The validity of the interview increases as the degree of interview structure increases.

      Components of a highly structured interview include:

      1. Interview questions are derived from a job analysis (they are job related).
      2. Interview questions are standardized (all applicants are asked the same questions).
      3. Prompting, follow-up questioning, probing, and/or elaboration on questions are limited. Try to identify all prompts, follow-ups, and probes beforehand and include them in the interview guide so that all candidates get the same level of prompting and probing.
      4. Interview questions focus on behaviors or work samples rather than opinions or self-evaluations.
      5. Interviewer access to ancillary information (e.g. resumes, letters of reference, test scores, transcripts) is controlled. Sometimes limiting access to these documents can limit interviewer biases.
      6. Questions from the candidate are not allowed until after the interview. This allows the interviewer to stay on track and not go off the protocol.
      7. Each answer is rated during the interview using a rating scale tailored to the question (this is preferable to rating dimensions at the end of the interview and certainly preferable to just making an overall rating or ranking at the end).
      8. Rating scales are “anchored” with behavioral examples to illustrate scale points (e.g. examples of a “1,” “3,” or “5” answer).
      9. Total interview score is obtained by summing across scores for each of the questions.

      The more of these components your interview has, the more structured it is, and the more valid it will be.

      Step 3: Prepare interview questions to assess the attributes you are looking for in a candidate

      The purpose of interviewing is to assess, not just listen. Questions are what help you do this.

      Preparing questions in advance allows you to:

      • Match each question to a position requirement (included in your scorecard) to ensure that you assess all required attributes. Everything assessed should be job relevant!
      • Determine each question’s weighting, if applicable.
      • Give each candidate a chance to speak to all their job-relevant attributes.
      • Keep records should an unselected candidate decide to contest the decision.

      If you don’t prepare in advance:

      • You’ll be distracted thinking about what you are going to ask next and not be fully listening.
      • You likely won’t ask the same questions of all candidates, which impacts the ability to compare across candidates and doesn’t provide a fair process for everyone.
      • You likely won’t ask the questions you need to elicit the information needed to make the right decision.
      • You could ask illegal questions (see Acquire the Right Hires with Effective Interviewing for a list of questions not to ask in an interview).

      Use the Interview Question Planning Guide tab in the Candidate Interview Strategy and Planning Guide to prepare your interview questions.

      Use these tips to draft interview questions:

      • Use job analysis output, in particular the critical incident technique, to develop structured interview questions.
      • Search online or in books for example interview questions for the target position to inform interview question development. Just remember that candidates access these too, so be sure to ask for specific examples, include probing questions, and adapt or modify questions to change them.
      • Situational questions: The situation should be described in sufficient detail to allow an applicant to visualize it accurately and be followed by “what would you do?” Scoring anchors should reflect effective, typical, and ineffective behaviors.
      • Behavioral questions: Should assess a behavioral dimension (e.g. meeting deadlines) and apply to a variety of situations that share the underlying dimension (e.g. at work or school). Scoring anchors should be applicable to a variety of situations and reflect effective, typical, and ineffective behavior.

      Conduct an effective screening interview by listening to non-verbal cues and probing

      Follow these steps to conduct an effective screening interview:

      Introduce yourself and ask if now is a good time to talk. (Before calling, prepare your sales pitch on the organization and the position.)

      You want to catch candidates off guard so that they don’t have time to prepare scripted answers; however, you must be courteous to their schedule.

      Provide an overview of the position, then start asking pre-set questions. Take a lot of notes.

      It is important to provide candidates with as much information as possible about the position – they are deciding whether they are interested in the role as much as you are deciding whether they are suitable.

      Listen to how the questions are answered. Ask follow-up questions when appropriate and especially if the candidate seems to be holding something back.

      If there are long pauses or the candidate’s voice changes, there may be something they aren’t telling you that you should know.

      Be alert to inconsistencies between the resume and answers to the questions and address them.

      It’s important to get to the bottom of issues before the in-person interview. If dates, titles, responsibilities, etc. seem to be inconsistent, ask more questions.

      Ask candidates about their salary expectations.

      It’s important to ensure alignment of the salary expectations early on. If the expectations are much higher than the range, and the candidate doesn’t seem to be open to the lower range, there is no point interviewing them. This would be a waste of everyone’s time.

      Answer the applicant’s questions and conclude the interview.

      Wait until after the interview to rate the applicant.

      Don’t allow yourself to judge throughout the interview, or it could skew questions. Rate the applicant once the interview is complete.

      When you have a shortlist of candidates to invite to an in-person interview, use the Candidate Communication Template to guide you through proper phone and email communications.

      Don’t just prepare top-level interview questions; also prepare probing questions to probe to gain depth and clarity

      Use probing to drill down on what candidates say as much as possible and go beyond textbook answers.

      Question (traditional): “What would you identify as your greatest strength?”

      Answer: Ability to work on a team.

      Top-level interview questions set the stage for probing.

      Your interview script should contain the top two levels of questions in the pyramid and a few probes that you will likely need to ask. You can then drill down further depending on the candidate’s answers.

      Follow-Up Question:

      “Can you outline a particular example when you were able to exercise your teamwork skills to reach a team goal?”

      Probing questions start with asking what, when, who, why, and how, and gain insight into a candidate’s thought process, experiences, and successes.

      Probing Level 1:

      Probe around the what, how, who, when, and where. “How did you accomplish that?”

      How to develop probes? By anticipating the kinds of responses that candidates from different backgrounds or with different levels of experience are likely to give as a response to an interview question. Probes should provide a clear understanding of the situation, the behavior, and the outcome so that the response can be accurately scored. Common probes include:

      • What did you do? What was the outcome?
      • When did this take place (and how long did it take)?
      • Who was involved?
      • Were you leading or being led?
      • How did you accomplish what you did?
      • Why did you take those steps?

      Tailor probes to the candidate’s answers to evoke meaningful and insightful responses.

      Probing Level 2:

      Allow for some creativity.

      “What would you do differently if you were to do it again?”

      Conduct effective interviews and assessments

      Mitigate inherent biases of assessors by integrating formal assessments with objective anchors and clear criteria to create a more inclusive process.

      Consider leveraging behavioral interview questions in your interview to reduce bias.

      • In the past, companies were pushing the boundaries of the conventional interview, using unconventional questions to find top talent, e.g. “what color is your personality?” The logic was that the best people are the ones who don’t necessarily show perfectly on a resume, and they were intent on finding the best.
      • However, many companies have stopped using these questions after extensive statistical analysis revealed there was no correlation between candidates’ ability to answer them and their future performance on the job.
      • Asking behavioral interview questions based on the competency needs of the role is the best way to uncover if the candidates will be able to execute on the job.

      Assessments are created by people that have biases. This often means that assessments can be biased, especially with preferences towards a Western perspective. Even if the same assessments are administered, the questions will be interpreted differently by candidates with varying cultural backgrounds and lived experiences. If assessments do not account for this, it ultimately leads to favoring the answers of certain demographic groups, often ones similar to those who developed the assessment.

      Creating an interview question scorecard

      Attribute you are evaluating

      Probing questions prepared

      Area to take notes

      The image contains a screenshot of an Interview question scorecard.

      Exact question you will ask

      Place to record score

      Anchored scale with definitions of a poor, ok and great answer

      Step 4: Assemble an interview team

      HR and the direct reporting supervisor should always be part of the interview. Make a good impression with a good interview team.

      The must-haves:

      • The Future Manager should always be involved in the process. They should be comfortable with the new hire’s competencies and fit.
      • Human Resources should always be involved in the process – they maintain consistency, legality, and standardization. It’s their job to know the rules and follow them. HR may coordinate and maintain policy standards and/or join in assessing the candidate.
      • There should always be more than just one interviewer, even if it is not at the same time. This helps keep the process objective, allows for different opinions, and gives the interviewee exposure to multiple individuals in the company. But, try to limit the number of panel members to four or less.

      “At the end of the day, it’s the supervisor that has to live with the person, so any decision that does not involve the supervisor is a very flawed process.” – VP, Financial Services

      The nice-to-haves:

      • Future colleagues can offer benefits to both the interviewee and the colleague by:
        • Giving the candidate some insight into what their day-to-day job would be.
        • Relaxing the candidate; allowing for a less formal, less intimidating conversation.
        • Introducing potential teammates for a position that is highly collaborative.
        • Offering the interviewer an excellent professional development opportunity – a chance to present their understanding of what they do.
      • Executives should take part in interviewing for executive hiring, individuals that will report to an executive, or for positions that are extremely important. Executive time is scarce and expensive, so only use it when absolutely necessary.

      Record the interview team details in the Candidate Interview Strategy and Planning Guide template.

      Assign interviewers roles inside and outside the actual interview

      Define Interview Process Roles

      Who Should… Contact candidates to schedule interviews or communicate decisions?

      Who Should… Be responsible for candidate welcomes, walk-outs, and hand-offs between interviews?

      Who Should… Define and communicate each stakeholder’s role?

      Who Should… Chair the preparation and debrief meetings and play the role of the referee when trying to reach a consensus?

      Define Interview Roles

      • Set a role for each interviewer so they know what to focus on and where they fit into the process (e.g. Interviewer A will assess fit). Don’t ad hoc the process and allow everyone to interview based on their own ideas.
      • Consider interviewer qualifications and the impact of the new employee on each interviewer, when deciding the roles of each interviewer (i.e. who will interview for competency and who will interview for fit).
        • For example, managers may be most impacted by technical competencies and should be the interviewer to evaluate the candidate for technical competency.

      “Unless you’ve got roles within the panel really detailed and agreed upon, for example, who is going to take the lead on what area of questions, you end up with a situation where nobody is in charge or accountable for the final interview assessment." – VP, Financial Services

      Info-Tech Insight

      Try a Two Lens Assessment: One interviewer assesses the candidate as a project leader while another assesses them as a people leader for a question such as “Give me an example of when you exercised your leadership skills with a junior team member.”

      Step 5: Set decision rights in stone and communicate them in advance to manage stakeholder expectations and limit conflict

      All interviewers must understand their decision-making authority prior to the interview. Misunderstandings can lead to resentment and conflict.

      It is typical and acceptable that you, as the direct reporting manager, should have veto power, as do some executives.

      Veto Power

      Direct Supervisor or Manager

      Decision Makers: Must Have Consensus

      Other Stakeholders

      Direct Supervisor’s Boss

      Direct Supervisor

      Contributes Opinion

      HR Representative

      Peer

      After the preliminary interview, HR should not be involved in making the decision unless they have a solid understanding of the position.

      Peers can make an unfair assessment due to perceived competition with a candidate. Additionally, if a peer doesn’t want a candidate to be hired and the direct supervisor does hire the candidate, the peer may hold resentment against that candidate and set the team up for conflict.

      The decision should rest on those who will interact with the candidate on a daily basis and who manage the team or department that the candidate will be joining.

      The decisions being made can include whether or not to move a candidate onto the next phase of the hiring process or a final hiring decision. Deciding decision rights in advance defines accountability for an effective interview process.

      Create your interview team, assessments, and objective anchor scale

      1. Download the Behavioral Interview Question Library as a reference.
      2. On tab 9 of your workbook, document all the members of the team and their respective roles in the interview process. Fill in the decision-making authority section to ensure every team member is held accountable to their assigned tasks and understands how their input will be used.
      3. For each required attribute in the Ideal Candidate Scorecard, chose one to two questions from the library that can properly evaluate that attribute.
      4. Copy and paste the questions and probing questions into the Interview Guide Template.
      5. Create an objective anchor scale and clearly define what a poor, ok, and great answer to each question is.

      Download the Behavioral Interview Question Library

      Input Output
      • List of possible team members
      • Ideal Candidate Scorecard
      • Finalized hiring panel
      • Finalized interview and assessment process
      Materials Participants
      • IT Behavioral Interview Question Library
      • Workbook
      • Interview Guide Template
      • IT leadership team
      • IT staff members

      Conduct an effective, professional, and organized in-person interview

      Give candidates a warm, genuine greeting. Introduce them to other interviewers present. Offer a drink. Make small talk.

      “There are some real advantages to creating a comfortable climate for the candidate; the obvious respect for the individual, but people really let their guard down.”

      – HR Director, Financial Services

      Give the candidate an overview of the process, length, and what to expect of the interview. Indicate to the candidate that notes will be taken during the interview.

      If shorter than an hour, you probably aren’t probing enough or even asking the right questions. It also looks bad to candidates if the interview is over quickly.

      Start with the first question in the interview guide and make notes directly on the interview guide (written or typed) for each question.

      Take lots of notes! You think you’ll remember what was said, but you won’t. It also adds transparency and helps with documentation.

      Ask the questions in the order presented for interview consistency. Probe and clarify as needed (see next slide).

      Keep control of the interview by curtailing any irrelevant or long-winded responses.

      After all interview questions are complete, ask candidates if there was anything about their qualifications that was missed that they want to highlight.

      Lets you know they understand the job and gives them the feeling they’ve put everything on the table.

      Ask if the candidate has any questions. Respond to the questions asked.

      Answer candidate questions honestly because fit works both ways. Ensure candidates leave with a better sense of the job, expectations, and organizational culture.

      Review the compensation structure for the position and provide a realistic preview of the job and organization.

      Provide each candidate with a fair chance by maintaining a consistent interview process.

      Tell interviewees what happens next in the process, the expected time frame, and how they will be informed of the outcome. Escort them out and thank them for the interview.

      The subsequent slides provide additional detail on these eight steps to conducting an effective interview.

      Avoid these common biases and mistakes

      Common Biases

      Like-me effect: An often-unconscious preference for, and unfairly positive evaluation of, a candidate based on shared interests, personalities, and experiences, etc.

      Status effect: Overrating candidates based on the prestige of previously held positions, titles, or schools attended.

      Recency bias: Placing greater emphasis on interviews held closer to the decision-making date.

      Contrast effect: Rating candidates relative to those who precede or follow them during the interview process, rather than against previously determined data.

      Solution

      Assess candidates by using existing competency-based criteria.

      Common Mistakes

      Negative tone: Starting the interview on a negative or stressful note may derail an otherwise promising candidate.

      Poor interview management: Letting the candidate digress may leave some questions unanswered and reduce the interview value.

      Reliance of first impressions: Basing decisions on first impressions undermines the objectivity of competency-based selection.

      Failure to ask probing questions: Accepting general answers without asking follow-up questions reduces the evidentiary value of the interview.

      Solution

      Follow the structured interview process you designed and practiced.

      Ask the questions in the order presented in the interview guide, and probe and clarify as needed

      Do...

      Don’t…

      Take control of the interview by politely interrupting to clarify points or keep the interviewee on topic.

      Use probing to drill down on responses and ask for clarification. Ask who, what, when, why, and how.

      Be cognizant of confidentiality issues. Ask for a sample of work from a past position.

      Focus on knowledge or information gaps from previous interviews that need to be addressed in the interview.

      Ensure each member of a panel interview speaks in turn and the lead is given due respect to moderate.

      Be mean when probing. Intimidation actually works against you and is stressful for candidates. When you’re friendly, candidates will actually open up more.

      Interrupt or undermine other panel members. Their comments and questions are just as valid as yours are, and treating others unprofessionally gives a bad impression to the candidate.

      Ask illegal questions. Questions about things like religion, disability, and marital and family status are off limits.

      When listening to candidate responses, watch for tone, body language, and red flags

      Do...

      While listening to responses, also watch out for red and yellow flags.

      Listen to how candidates talk about their previous bosses – you want it to be mainly positive. If their discussion of past bosses reflects a strong sense of self-entitlement or a consistent theme of victimization, this could be a theme in their behavior and make them hard to work with.

      Red Flag

      A concern about something that would keep you from hiring the person.

      Yellow Flag

      A concern that needs to be addressed, but wouldn’t keep you from hiring the person.

      Pay attention to body language and tone. They can tell you a lot about candidate motivation and interest.

      Listen to what candidates want to improve. It’s an opportunity to talk about development and advancement opportunities in the organization.

      Not all candidates have red flags, but it is important to keep them in mind to identify potential issues with the candidate before they are hired.

      Don’t…

      Talk too much! You are there to listen. Candidates should do about 80% of the talking so you can adequately evaluate them. Be friendly, but ensure to spend the time allotted assessing, not chatting.

      If you talk too much, you may end up hiring a weak candidate because you didn’t perceive weaknesses or not hire a strong candidate because you didn’t identify strengths.

      What if you think you sense a red or yellow flag?

      Following the interview, immediately discuss the situation with others involved in the recruitment process or those familiar with the position, such as HR, another hiring manager, or a current employee in the role. They can help evaluate if it’s truly a matter of concern.

      Increase hiring success: Give candidates a positive perception of the organization in the interview

      Great candidates want to work at great organizations.

      When the interviewer makes a positive impression on a candidate and provides a positive impression of the organization it carries forward after they are hired.

      In addition, better candidates can be referred over the course of time due to higher quality networking.

      As much as choosing the right candidate is important to you, make sure the right candidate wants to choose you and work for your organization.

      The image contains a screenshot of a graph to demonstrate the percent of successful hires relates strongly to interviewers giving candidates a positive perception of the organization.

      Interview advice seems like common sense, but it’s often not heeded, resulting in poor interviews

      Don’t…

      Believe everything candidates say. Most candidates embellish and exaggerate to find the answers they think you want. Use probing to drill down to specifics and take them off their game.

      Ask gimmicky questions like “what color is your soul?” Responses to these questions won’t give you any information about the job. Candidates don’t like them either!

      Focus too much on the resume. If the candidate is smart, they’ve tailored it to match the job posting, so of course the person sounds perfect for the job. Read it in advance, highlight specific things you want to ask, then ignore it.

      Oversell the job or organization. Obviously you want to give candidates a positive impression, but don’t go overboard because this could lead to unhappy hires who don’t receive what you sold them. Candidates need to evaluate fit just as much as you.

      Get distracted by a candidate’s qualifications and focus only on their ability to do the job. Just because they are qualified does not mean they have the attitude or personality to fit the job or culture.

      Show emotion at any physical handicap. You can’t discriminate based on physical disability, so protect the organization by not drawing attention to it. Even if you don’t say anything, your facial expression may.

      Bring a bad day or excess baggage into the interview, or be abrupt, rushed, or uninterested in the interview. This is rude behavior and will leave a negative impression with candidates, which could impact your chances of hiring them.

      Submit to first impression bias because you’ll spend the rest of the interview trying to validate your first impression, wasting your time and the candidate’s. Remain as objective as possible and stick to the interview guide to stay focused on the task at hand.

      “To the candidate, if you are meeting person #3 and you’re hearing questions that person #1 and #2 asked, the company doesn’t look too hot or organized.” – President, Recruiting Firm

      Practice behavioral interviews

      1. In groups of at least three:
      • Assign one person to act as the manager conducting the interview, a second person to act as the candidate, and a third to observe.
      • The observer will provide feedback to the manager at the end of the role play based on the information you just learned.
      • Observers – please give feedback on the probing questions and body language.
    • Managers, select an interview question from the list your group put together during the previous exercise. Take a few minutes to think about potential probing questions you could follow up with to dig for more information.
    • Candidates, try to act like a real candidate. Please don’t make it super easy on the managers – but don’t make it impossible either!
    • Once the question has been asked and answered:
      • How did it go?
      • Were you able to get the candidate to speak in specifics rather than generalities? What tips do you have for others?
      • What didn’t go so well? Any surprises?
      • What would you do differently next time?
      • If this was a real hiring situation, would the information you got from just that one question help you make a hiring decision for the role?
    • Now switch roles and select a new interview question to use for this round. Repeat until everyone has had a chance to practice.
    • Input Output
      • Interview questions and scorecard
      • Practice interviews
      Materials Participants
      • IT Behavioral Interview Question Library
      • Workbook
      • Hiring Manager
      • Interview Panel Members

      Download the Behavioral Interview Question Library

      Record best practices, effective questions, and candidate insights for future use and current strategy

      Results and insights gained from evaluations need to be recorded and assessed to gain value from them going forward.

      • To optimize evaluation, all feedback should be forwarded to a central point so that the information can be shared with all stakeholders. HR can serve in this role.
      • Peer evaluations should be shared shortly after the interview. Immediate feedback that represents all the positive and negative responses is instructional for interviewers to consider right away.
      • HR can take a proactive approach to sharing information and analyzing and improving the interview process in order to collaborate with hiring departments for better talent management.
      • Collecting information about effective and ineffective interview questions will guide future interview revision and development efforts.

      Evaluations Can Inform Strategic Planning and Professional Development

      Strategic Planning

      • Survey data can be used to inform strategic planning initiatives in recruiting.
      • Use the information to build a case to the executive team for training, public relations initiatives, or better candidate management systems.

      Professional Development

      • Survey data from all evaluations should be used to inform future professional development initiatives.
      • Interview areas where all team members show weaknesses should be training priorities.
      • Individual weaknesses should be integrated into each professional development plan.

      Want to learn more?

      Recruit IT Talent

      • Improve candidate experience to hire top IT talent.

      Recruit and Retain More Women in IT

      • Gender diversity is directly correlated to IT performance.

      Recruit and Retain People of Color in IT

      • Good business, not just good philanthropy.

      Develop a Comprehensive Onboarding Plan

      Drive employee engagement and retention with a robust program that acclimates, guides, and develops new hires.

      Onboarding should pick up where candidate experience leaves off

      Do not confuse onboarding with orientation

      Onboarding ≠ Orientation

      Onboarding is more than just orientation. Orientation is typically a few days of completing paperwork, reading manuals, and learning about the company’s history, strategic goals, and culture. By contrast, onboarding is three to twelve months dedicated to welcoming, acclimating, guiding, and developing new employees – with the ideal duration reflecting the time to productivity for the role.

      A traditional orientation approach provides insufficient focus on the organizational identification, socialization, and job clarity that a new hire requires. This is a missed opportunity to build engagement, drive productivity, and increase organizational commitment. This can result in early disengagement and premature departure.

      Effective onboarding positively impacts the organization and bottom line

      Over the long term, effective onboarding has a positive impact on revenue and decreases costs.

      The benefits of onboarding:

      • Save money and frustration
        • Shorten processing time, reduce administrative costs, and improve compliance.
      • Boost revenue
        • Help new employees become productive faster – also reduce the strain on existing employees who would normally be overseeing them or covering a performance shortfall.
      • Drive engagement and reduce turnover
        • Quickly acclimate new hires to your organization’s environment, culture, and values.
      • Reinforce culture and employer brand
        • Ensure that new hires feel a connection to the organization’s culture.

      Onboarding drives new hire engagement from day one

      The image contains a graph to demonstrate the increase in overall engagement in relation to onboarding.

      When building an onboarding program, retain the core aims: acclimate, guide, and develop

      The image contains a picture of a circle with a smaller circle inside it, and a smaller circle inside that one. The smallest circle is labelled Acclimate, the medium sized circle is labelled Guide, and the biggest circle is labelled Develop.

      Help new hires feel connected to the organization by clearly articulating the mission, vision, values, and what the company does. Help them understand the business model, the industry, and who their competitors are. Help them feel connected to their new team members by providing opportunities for socialization and a support network.

      Help put new hires on the path to high performance by clearly outlining their role in the organization and how their performance will be evaluated.

      Help new hires receive the experience and training they require to become high performers by helping them build needed competencies.

      We recommend a three-to-twelve-month onboarding program, with the performance management aspect of onboarding extending out to meet the standard organizational performance management cycle.

      Info-Tech Insight

      The length of the onboarding program should align with the average time to productivity for the role(s). Consider the complexity of the role, the industry, and the level of the new hire when determining program length.

      For example, call center workers who are selling a straight-forward product may only require a three-month onboarding, while senior leaders may require a year-long program.

      Watch for signs that you aren’t effectively acclimating, guiding, and developing new hires

      Our primary and secondary research identified the following as the most commonly stated reasons why employees leave organizations prematurely. These issues will be addressed throughout the next section.

      Acclimate

      Guide

      Develop

      • Onboarding experience is misaligned from the employer’s brand.
      • Socialization and/or integration into the existing culture is left to the employee.
      • Key role expectations or role usefulness is not clearly communicated.
      • Company strategy is unclear.
      • Opportunities for advancement are unclear.
      • Coaching, counseling, and/or support from co-workers and/or management is lacking.
      • The organization fails to demonstrate that it cares about the new employee’s needs.

      “Onboarding is often seen as an entry-level HR function. It needs to rise in importance because it’s the first impression of the organization and can be much more powerful than we sometimes give it credit for. It should be a culture building and branding program.” – Doris Sims, SPHR, The Succession Consultant, and Author, Creative Onboarding Programs

      Use the onboarding tabs in the workbook to evaluate and redesign the onboarding program

      1. On tab 10, brainstorm challenges that face the organization's current onboarding program. Identify if they fall into the "acclimate," "guide," or "develop" category. Next, record the potential impact of this challenge on the overall effectiveness of the onboarding program.
      2. On tab 11, record each existing onboarding activity. Then, identify if that activity will be kept or if it should be retired. Next, document if the activity fell into the "acclimate," "guide," or "develop" category.
      3. On tab 12, document gaps that currently exist in the onboarding program. Modify the timeline along the side of the tab to ensure it reflects the timeline you have identified.
      4. On tab 13, document the activities that will occur in the new onboarding program. This should be a combination of current activities that you want to retain and new activities that will be added to address the gaps noted on tab 12. For each activity, identify if it will fall in the acclimate, guide, or develop section. Add any additional notes. Before moving on, make sure that there are no categories that have no activities (e.g. no guide activities).
      Input Output
      • Existing onboarding activities
      • Determine new onboarding activities
      • Map out onboarding responsibilities
      Materials Participants
      • Workbook
      • Hiring Managers
      • HR

      Review the administrative aspects of onboarding and determine how to address the challenges

      The image contains tabs, three main large tabs are labelled: Acclimate, Guide, and Develop. There are smaller tabs in between that are in relation to the three main ones.

      Sample challenges

      Potential solutions

      Some paperwork cannot be completed digitally (e.g. I-9 form in the US).

      Where possible, complete forms with digital signatures (e.g. DocuSign). Where not possible, begin the process earlier and mail required forms to employees to sign and return, or scan and email for the employee to print and return.

      Required compliance training material is not available virtually.

      Seek online training options where possible. Determine the most-critical training needs and prioritize the replication of materials in audio/video format (e.g. recorded lecture) and distribute virtually.

      Employees may not have access to their equipment immediately due to shipping or supply issues.

      Delay employee start dates until you can set them up with the proper equipment and access needed to do their job.

      New hires can’t get answers to their questions about benefits information and setup.

      Schedule a meeting with an HR representative or benefits vendor to explain how benefits will work and how to navigate employee self-service or other tools and resources related to their benefits.

      Info-Tech Insight

      One of the biggest challenges for remote new hires is the inability to casually ask questions or have conversations without feeling like they’re interrupting. Until they have a chance to get settled, providing formal opportunities for questions can help address this.

      Review how company information is shared during onboarding and how to address the challenges

      The image contains tabs, three main large tabs are labelled: Acclimate, Guide, and Develop. There are smaller tabs in between that are in relation to the three main ones.

      Sample challenges

      Potential solutions

      Key company information such as organizational history, charts, or the vision, mission, and values cannot be clearly learned by employees on their own.

      Have the new hire’s manager call to walk through the important company information to provide a personal touch and allow the new hire to ask questions and get to know their new manager.

      Keeping new hires up to date on crisis communications is important, but too much information may overwhelm them or cause unnecessary stress.

      Sharing the future of the organization is a critical part of the company information stage of onboarding and the ever-changing nature of the COVID-19 crisis is informing many organizations’ future right now. Be honest but avoid over-sharing plans that may change.

      New hires can’t get answers to their questions about benefits information and setup.

      Schedule a meeting with an HR representative or benefits vendor to explain how benefits will work and how to navigate employee self-service or other tools and resources related to their benefits.

      Review the socialization aspects of onboarding and determine how to address the challenges

      The image contains tabs, three main large tabs are labelled: Acclimate, Guide, and Develop. There are smaller tabs in between that are in relation to the three main ones.

      Sample challenges

      Potential solutions

      Team introductions via a team lunch or welcome event are typically done in person.

      Provide managers with a calendar of typical socialization events in the first few weeks of onboarding and provide instructions and ideas for how to schedule replacement events over videoconferencing.

      New hires may not have a point of contact for informal questions or needs if their peers aren’t around them to help.

      If it doesn’t already exist, create a virtual buddy program and provide instructions for managers to select a buddy from the new hire’s team. Explain that their role is to field informal questions about the company, team, and anything else and that they should book weekly meetings with the new hire to stay in touch.

      New hires will not have an opportunity to learn or become a part of the informal decision-making networks at the organization.

      Hiring managers should consider key network connections that new hires will need by going through their own internal network and asking other team members for recommendations.

      New hires will not be able to casually meet people around the office.

      Provide the employee with a list of key contacts for them to reach out to and book informal virtual coffee chats to introduce themselves.

      Adapt the Guide phase of onboarding to a virtual environment

      The image contains tabs, three main large tabs are labelled: Acclimate, Guide, and Develop. There are smaller tabs in between that are in relation to the three main ones.

      Sample challenges

      Potential solutions

      Performance management (PM) processes have been paused given the current crisis.

      Communicate to managers that new hires still need to be onboarded to the organization’s performance management process and that goals and feedback need to be introduced and the review process outlined even if it’s not currently happening.

      Goals and expectations differ or have been reprioritized during the crisis.

      Ask managers to explain the current situation at the organization and any temporary changes to goals and expectations as a result of new hires.

      Remote workers often require more-frequent feedback than is mandated in current PM processes.

      Revamp PM processes to include daily or bi-weekly touchpoints for managers to provide feedback and coaching for new hires for at least their first six months.

      Managers will not be able to monitor new hire work as effectively as usual.

      Ensure there is a formal approach for how employees will keep their managers updated on what they're working on and how it's going, for example, daily scrums or task-tracking software.

      For more information on adapting performance management to a virtual environment, see Info-Tech’s Performance Management for Emergency Work-From-Home research.

      Take an inventory of training and development in the onboarding process and select critical activities

      The image contains tabs, three main large tabs are labelled: Acclimate, Guide, and Develop. There are smaller tabs in between that are in relation to the three main ones.

      Categorize the different types of formal and informal training in the onboarding process into the following three categories. For departmental and individual training, speak to managers to understand what is required on a department and role basis:

      Organizational

      Departmental

      Individual

      For example:

      • Employee self-service overview
      • Health and safety/compliance training
      • Core competencies

      For example:

      • Software training (e.g. Salesforce)
      • Job shadowing to learn how to work equipment or to learn processes

      For example:

      • Mentoring
      • External courses
      • Support to work toward a certification

      In a crisis, not every training can be translated to a virtual environment in the short term. It’s also important to focus on critical learning activities versus the non-critical. Prioritize the training activities by examining the learning outcomes of each and asking:

      • What organizational training does every employee need to be a productive member of the organization?
      • What departmental or individual training do new hires need to be successful in their role?

      Lower priority or non-critical activities can be used to fill gaps in onboarding schedules or as extra activities to be completed if the new hire finds themselves with unexpected downtime to fill.

      Determine how onboarding training will be delivered virtually

      The image contains tabs, three main large tabs are labelled: Acclimate, Guide, and Develop. There are smaller tabs in between that are in relation to the three main ones.

      Who will facilitate virtual training sessions?

      • For large onboarding cohorts, consider live delivery via web conferencing where possible. This will create a more engaging training program and will allow new hires to interact with and ask questions of the presenter.
      • For individual new hires or small cohorts, have senior leaders or key personnel from across the organization record different trainings that are relevant for their role.
        • For example, training sessions about organizational culture can be delivered by the CEO or other senior leader, while sales training could be delivered by a sales executive.

        If there is a lack of resources, expertise, or time, outsource digital training to a content provider or through your LMS.

      What existing or free tools can be leveraged to immediately support digital training?

      • Laptops and PowerPoint to record training sessions that are typically delivered in-person
      • YouTube/Vimeo to host recorded lecture-format training
      • Company intranet to host links and files needed to complete training
      • Web conferencing software to host live training/orientation sessions (e.g. Webex)
      • LMS to host and track completion of learning content

      Want to learn more?

      Recruit IT Talent

      • Improve candidate experience to hire top IT talent.

      Recruit and Retain More Women in IT

      • Gender diversity is directly correlated to IT performance.

      Recruit and Retain People of Color in IT

      • Good business, not just good philanthropy.

      Adapt Your Onboarding Process to a Virtual Environment

      • Develop short-term solutions with a long-term outlook to quickly bring in new talent.

      Bibliography

      2021 Recruiter Nation Report. Survey Analysis, Jobvite, 2021. Web.

      “5 Global Stats Shaping Recruiting Trends.” The Undercover Recruiter, 2022. Web.

      Barr, Tavis, Raicho Bojilov, and Lalith Munasinghe. "Referrals and Search Efficiency: Who Learns What and When?" The University of Chicago Press, Journal of Labor Economics, vol. 37, no. 4, Oct. 2019. Web.

      “How to grow your team better, faster with an employee referral program.” Betterup, 10 Jan. 2022. Web.

      “Employee Value Proposition: How 25 Companies Define Their EVP.” Built In, 2021. Web.

      Global Leadership Forecast 2021. Survey Report, DDI World, 2021. Web.

      “Connecting Unemployed Youth with Organizations That Need Talent.” Harvard Business Review, 3 November 2016. Web.

      Ku, Daniel. “Social Recruiting: Everything You Need To Know for 2022.” PostBeyond, 26 November 2021. Web.

      Ladders Staff. “Shedding light on the job search.” Ladders, 20 May 2013. Web.

      Merin. “Campus Recruitment – Meaning, Benefits & Challenges.” HR Shelf, 1 February 2022. Web.

      Mobile Recruiting. Smart Recruiters, 2020. Accessed March 2022.

      Roddy, Seamus. “5 Employee Referral Program Strategies to Hire Top Talent.” Clutch, 22 April 2020. Web.

      Sinclair, James. “What The F*dge: That's Your Stranger Recruiting Budget?” LinkedIn, 11 November 2019. Web.

      “Ten Employer Examples of EVPs.” Workology, 2022. Web

      “The Higher Cost of a Bad Hire.” Robert Half, 15 March 2021. Accessed March 2022.

      Trost, Katy. “Hiring with a 90% Success Rate.” Katy Trost, Medium, 8 August 2022. Web.

      “Using Social Media for Talent Acquisition.” SHRM, 20 Sept. 2017. Web.

      Accelerate Your Automation Processes

      • Buy Link or Shortcode: {j2store}485|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Service Desk
      • Parent Category Link: /service-desk

      Your organization needs to:

      • Define an automation suite for the business.
      • Specify the business goals for your automation suite.
      • Roadmap your automation modules to continually grow your automation platform.
      • Identify how an automation suite can help the organization improve.

      Our Advice

      Critical Insight

      Start small and do it right:

      • Assess if a particular solution works for your organization and continually invest in it if it does before moving onto the next solution.
      • Overwhelming your organization with a plethora of automation solutions can lead to a lack of management for each solution and decrease your overall return on investment.

      Impact and Result

      • Define your automation suite in terms of your business goals.
      • Take stock of what you have now: RPA, AIOps, chatbots.
      • Think about how to integrate and optimize what you have now, as well as roadmap your continual improvement.

      Accelerate Your Automation Processes Research & Tools

      Start here – read the Executive Brief

      Read this Executive Brief to find out why your organization should accelerate your automation processes, review Info-Tech’s methodology, and understand the ways Info-Tech can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Discover automation suite possibilities

      Take hold of your current state and assess where you would like to improve. See if adding a new automation module or investing in your current modules is the right decision.

      • Automation Suite Maturity Assessment Tool

      2. Chart your automation suite roadmap

      Build a high-level roadmap of where you want to bring your organization's automation suite in the future.

      • Automation Suite Roadmap Tool
      [infographic]

      Maximize Value From Your Value-Added Reseller (VAR)

      • Buy Link or Shortcode: {j2store}215|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
      • member rating average days saved: Read what our members are saying
      • Parent Category Name: Vendor Management
      • Parent Category Link: /vendor-management

      Organizations need to understand their value-added reseller (VAR) portfolio and the greater VAR landscape to better:

      • Manage the VAR portfolio.
      • Understand additional value each VAR can provide.
      • Maximize existing VAR commitments.
      • Evaluate the VARs’ performance.

      Our Advice

      Critical Insight

      VARs typically charge more for products because they are in some way adding value. If you’re not leveraging any of the provided value, you’re likely wasting money and should use a basic commodity-type reseller for procurement.

      Impact and Result

      This project will provide several benefits to Vendor Management and Procurement:

      • Defined VAR value and performance tracking.
      • Manageable portfolio of VARs that fully benefit the organization.
      • Added training, licensing advice, faster quoting, and invoicing resolution.
      • Reduced deployment and logistics costs.

      Maximize Value From Your Value-Added Reseller (VAR) Research & Tools

      Start here – read the Executive Brief

      Read our informative Executive Brief to find out why you should maximize value from your value-added reseller, review Info-Tech’s methodology, and understand the three ways to better manage your VARs improve performance and reduce costs.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Organize and prioritize

      Organize all your VARs and create a manageable portfolio detailing their value, specific, product, services, and certifications.

      • Maximize Value From Your Value-Added Reseller – Phase 1: Organize and Prioritize
      • VAR Listing and Prioritization Tool

      2. “EvaluRate” your VARs

      Create an in-depth evaluation of the VARs’ capabilities.

      • Maximize Value From Your Value-Added Reseller – Phase 2: EvaluRate Your VARs
      • VAR Features Checklist Tool
      • VAR Profile and EvaluRation Tool

      3. Consolidate and reduce

      Assess each VAR for low performance and opportunity to increase value or consolidate to another VAR and reduce redundancy.

      • Maximize Value From Your Value-Added Reseller – Phase 3: Consolidate and Reduce

      4. Maximize their value

      Micro-manage your primary VARs to ensure performance to commitments and maximize their value.

      • Maximize Value From Your Value-Added Reseller – Phase 4: Maximize Their Value
      • VAR Information and Scorecard Workbook
      [infographic]

      Develop a Use Case for Smart Contracts

      • Buy Link or Shortcode: {j2store}92|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Innovation
      • Parent Category Link: /innovation
      • Organizations today continue to use traditional and often archaic methods of manual processing with physical paper documents.
      • These error-prone methods introduce cumbersome administrative work, causing businesses to struggle with payments and contract disputes.
      • The increasing scale and complexity of business processes has led to many third parties, middlemen, and paper hand-offs.
      • Companies remain bogged down by expensive and inefficient processes while losing sight of their ultimate stakeholder: the customer. A failure to focus on the customer is a failure to do business.

      Our Advice

      Critical Insight

      • Simplify, automate, secure. Smart contracts enable businesses to simplify, automate, and secure traditionally complex transactions.
      • Focus on the customer. Smart contracts provide a frictionless experience for customers by removing unnecessary middlemen and increasing the speed of transactions.
      • New business models. Smart contracts enable the redesign of your organization and business-to-business relationships and transactions.

      Impact and Result

      • Simplify and optimize your business processes by using Info-Tech’s methodology to select processes with inefficient transactions, unnecessary middlemen, and excessive manual paperwork.
      • Use Info-Tech’s template to generate a smart contract use case customized for your business.
      • Customize Info-Tech’s stakeholder presentation template to articulate the goals and benefits of the project and get buy-in from business executives.

      Develop a Use Case for Smart Contracts Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should leverage smart contracts in your business, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Develop a Use Case for Smart Contracts – Phases 1-2

      1. Understand smart contracts

      Understand the fundamental concepts of smart contract technology and get buy-in from stakeholders.

      • Develop a Use Case for Smart Contracts – Phase 1: Understand Smart Contracts
      • Smart Contracts Executive Buy-in Presentation Template

      2. Develop a smart contract use case

      Select a business process, create a smart contract logic diagram, and complete a smart contract use-case deliverable.

      • Develop a Use Case for Smart Contracts – Phase 2: Develop the Smart Contract Use Case
      • Smart Contracts Use-Case Template

      [infographic]

      Workshop: Develop a Use Case for Smart Contracts

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Understand Smart Contracts

      The Purpose

      Review blockchain basics.

      Understand the fundamental concepts of smart contracts.

      Develop smart contract use-case executive buy-in presentation.

      Key Benefits Achieved

      Understanding of blockchain basics.

      Understanding the fundamentals of smart contracts.

      Development of an executive buy-in presentation.

      Activities

      1.1 Review blockchain basics.

      1.2 Understand smart contract fundamentals.

      1.3 Identify business challenges and smart contract benefits.

      1.4 Create executive buy-in presentation.

      Outputs

      Executive buy-in presentation

      2 Smart Contract Logic Diagram

      The Purpose

      Brainstorm and select a business process to develop a smart contract use case around.

      Generate a smart contract logic diagram.

      Key Benefits Achieved

      Selected a business process.

      Developed a smart contract logic diagram for the selected business process.

      Activities

      2.1 Brainstorm candidate business processes.

      2.2 Select a business process.

      2.3 Identify phases, actors, events, and transactions.

      2.4 Create the smart contract logic diagram.

      Outputs

      Smart contract logic diagram

      3 Smart Contract Use Case

      The Purpose

      Develop smart contract use-case diagrams for each business process phase.

      Complete a smart contract use-case deliverable.

      Key Benefits Achieved

      Smart contract use-case diagrams.

      Smart contract use-case deliverable.

      Activities

      3.1 Build smart contract use-case diagrams for each phase of the business process.

      3.2 Create a smart contract use-case summary diagram.

      3.3 Complete smart contract use-case deliverable.

      Outputs

      Smart contract use case

      4 Next Steps and Action Plan

      The Purpose

      Review workshop week and lessons learned.

      Develop an action plan to follow through with next steps for the project.

      Key Benefits Achieved

      Reviewed workshop week with common understanding of lessons learned.

      Completed an action plan for the project.

      Activities

      4.1 Review workshop deliverables.

      4.2 Create action plan.

      Outputs

      Smart contract action plan

       

      Security Priorities 2022

      • Buy Link or Shortcode: {j2store}244|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Security Strategy & Budgeting
      • Parent Category Link: /security-strategy-and-budgeting
      • Ransomware activities and the cost of breaches are on the rise.
      • Cybersecurity talent is hard to find, and an increasing number of cybersecurity professionals are considering leaving their jobs.
      • Moving to the digital world increases the risk of a breach.

      Our Advice

      Critical Insight

      • The pandemic has fundamentally changed the technology landscape. Security programs must understand how their threat surface is now different and adapt their controls to meet the challenge.
      • The upside to the upheaval in 2021 is new opportunities to modernize your security program.

      Impact and Result

      • Use the report to ensure your plan in 2022 addresses what’s important in cybersecurity.
      • Understand the current situation in the cybersecurity space.

      Security Priorities 2022 Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Security Priorities 2022 – A report that describes priorities and recommendations for CISOs in 2022.

      Use this report to understand the current situation in the cybersecurity space and inform your plan for 2022. This report includes sections on protecting against and responding to ransomware, acquiring and retaining talent, securing a remote workforce, securing digital transformation, and adopting zero trust.

      • Security Priorities for 2022 Report

      Infographic

      Further reading

      Security Priorities 2022

      The pandemic has changed how we work

      disruptions to the way we work caused by the pandemic are here to stay.

      The pandemic has introduced a lot of changes to our lives over the past two years, and this is also true for various aspects of how we work. In particular, a large workforce moved online overnight, which shifted the work environment rapidly.

      People changed how they communicate, how they access company information, and how they connect to the company network. These changes make cybersecurity a more important focus than ever.

      Although changes like the shift to remote work occurred in response to the pandemic, they are largely expected to remain, regardless of the progression of the pandemic itself. This report will look into important security trends and the priorities that stemmed from these trends.

      30% more professionals expect transformative permanent change compared to one year ago.

      47% of professionals expect a lot of permanent change; this remains the same as last year. (Source: Info-Tech Tech Trends 2022 Survey; N=475)

      The cost of a security breach is rising steeply

      The shift to remote work exposes organizations to more costly cyber incidents than ever before.

      $4.24 million

      Average cost of a data breach in 2021
      The cost of a data breach rose by nearly 10% in the past year, the highest rate in over seven years.

      $1.07 million

      More costly when remote work involved in the breach

      The average cost of breaches where remote work is involved is $1.07 million higher than breaches where remote work is not involved.

      The ubiquitous remote work that we saw in 2021 and continue to see in 2022 can lead to more costly security events. (Source: IBM, 2021)

      Remote work is here to stay, and the cost of a breach is higher when remote work is involved.

      The cost comes not only directly from payments but also indirectly from reputational loss. (Source: IBM, 2021)

      Security teams can participate in the solution

      The numbers are clear: in 2022, when we face a threat environment like WE’VE never EXPERIENCED before, good security is worth the investment

      $1.76 million

      Saved when zero trust is deployed facing a breach

      Zero trust controls are realistic and effective controls.

      Organizations that implement zero trust dramatically reduce the cost of an adverse security event.

      35%

      More costly if it takes more than 200 days to identify and contain a breach

      With increased BYOD and remote work, detection and response is more challenging than ever before – but it is also highly effective.

      Organizations that detect and respond to incidents quickly will significantly reduce the impact. (Source: IBM, 2021)

      Breaches are 34% less costly when mature zero trust is implemented.

      A fully staffed and well-prepared security team could save the cost through quick responses. (Source: IBM, 2021)

      Top security priorities and constraints in 2022

      Survey results

      As part of its research process for the 2022 Security Priorities Report, Info-Tech Research Group surveyed security and IT leaders (N=97) to ask their top security priorities as well as their main obstacles to security success in 2022:

      Top Priorities
      A list of the top three priorities identified in the survey with their respective percentages, 'Acquiring and retaining talent, 30%', 'Protecting against and responding to ransomware, 23%', and 'Securing a remote workforce, 23%'.

      Survey respondents were asked to force-rank their security priorities.

      Among the priorities chosen most frequently as #1 were talent management, addressing ransomware threats, and securing hybrid/remote work.

      Top Obstacles
      A list of the top three obstacles identified in the survey with their respective percentages, 'Staffing constraints, 31%', 'Demand of ever-changing business environment, 23%', and 'Budget constraints, 15%'.

      Talent management is both the #1 priority and the top obstacle facing security leaders in 2022.

      Unsurprisingly, the ever-changing environment in a world emerging from a pandemic and budget constraints are also top obstacles.

      We know the priorities…

      But what are security leaders actually working on?

      This report details what we see the world demanding of security leaders in the coming year.

      Setting aside the demands – what are security leaders actually working on?

      A list of 'Top security topics among Info-Tech members' with accompanying bars, 'Security Strategy', 'Security Policies', 'Security Operations', 'Security Governance', and 'Security Incident Response'.

      Many organizations are still mastering the foundations of a mature cybersecurity program.

      This is a good idea!

      Most breaches are still due to gaps in foundational security, not lack of advanced controls.

      We know the priorities…

      But what are security leaders actually working on?

      A list of industries with accompanying bars representing their demand for security. The only industry with a significant positive percentage is 'Government'. Security projects included in annual plan relative to industry.

      One industry plainly stands out from the rest. Government organizations are proportionally much more active in security than other industries, and for good reason: they are common targets.

      Manufacturing and professional services are proportionally less interested in security. This is concerning, given the recent targeting of supply chain and personal data holders by ransomware gangs.

      5 Security Priorities for 2022 Logo for Info-Tech. Logo for ITRG.

      People

      1. Acquiring and Retaining Talent
        Create a good working environment for existing and potential employees. Invest time and effort into talent issues to avoid being understaffed.
      2. Securing a Remote Workforce
        Create a secure environment for users and help your people build safe habits while working remotely.

      Process

      1. Securing Digital Transformation
        Build in security from the start and check in frequently to create agile and secure user experiences.

      Technology

      1. Adopting Zero Trust
        Manage access of sensitive information based on the principle of least privilege.
      2. Protecting Against and Responding to Ransomware
        Put in your best effort to build defenses but also prepare for a breach and know how to recover.

      Main Influencing Factors

      COVID-19 Pandemic
      The pandemic has changed the way we interact with technology. Organizations are universally adapting their business and technology processes to fit the post-pandemic paradigm.
      Rampant Cybercrime Activity
      By nearly every conceivable metric, cybercrime is way up in the past two years. Cybercriminals smell blood and pose a more salient threat than before. Higher standards of cybersecurity capability are required to respond to this higher level of threat.
      Remote Work and Workforce Reallocation
      Talented IT staff across the globe enabled an extraordinarily fast shift to remote and distance work. We must now reckon with the security and human resourcing implications of this huge shift.

      Acquire and Retain Talent

      Priority 01

      Security talent was in short supply before the pandemic, and it's even worse now.

      Executive summary

      Background

      Cybersecurity talent has been in short supply for years, but this shortage has inflected upward since the pandemic.

      The Great Resignation contributed to the existing talent gap. The pandemic has changed how people work as well as how and where they choose work. More and more senior workers are retiring early or opting for remote working opportunities.

      The cost to acquire cybersecurity talent is huge, and the challenge doesn’t end there. Retaining top talent can be equally difficult.

      Current situation

      • A 2021 survey by ESG shows that 76% of security professional agree it’s difficult to recruit talent, and 57% said their organization is affected by this talent shortage.
      • (ISC)2 reports there are 2.72 million unfilled job openings and an increasing workforce gap (2021).

      2.72 million unfilled cybersecurity openings (Source: (ISC)2, 2021)

      IT leaders must do more to attract and retain talent in 2022

      • Over 70% of IT professionals are considering quitting their jobs (TalentLMS, 2021). Meanwhile, 51% of surveyed cybersecurity professionals report extreme burnout during the last 12 months and many of them have considered quitting because of it (VMWare, 2021).
      • Working remotely makes it easier for people to look elsewhere, lowering the barrier to leaving.
      • This is a big problem for security leaders, as cybersecurity talent is in very short supply. The cost of acquiring and retaining quality cybersecurity staff in 2022 is significant, and many organizations are unwilling or unable to pay the premium.
      • Top talent will demand flexible working conditions – even though remote work comes with security risk.
      • Most smart, talented new hires in 2022 are demanding to work remotely most of the time.
      Top reasons for resignations in 2021
      Burnout 30%
      Other remote opportunities 20%
      Lack of growth opportunities 20%
      Poor culture 20%
      Acquisition concerns 10%
      (Source: Survey of West Coast US cybersecurity professionals; TechBeacon, 2021)

      Talent will be 2022’s #1 strength and #1 weakness

      Staffing obstacles in 2022:

      “Attracting and retaining talent is always challenging. We don’t pay as well and my org wants staff in the office at least half of the time. Most young, smart, talented new hires want to work remotely 100 percent of the time.“

      “Trying to grow internal resources into security roles.”

      “Remote work expectations by employees and refusal by business to accommodate.”

      “Biggest obstacle: payscales that are out of touch with cybersecurity market.”

      “Request additional staff. Obtaining funding for additional position is most significant obstacle.”

      (Info-Tech Tech Security Priorities Survey 2022)
      Top obstacles in 2022:

      As you can see, respondents to our security priorities survey have strong feelings on the challenges of staffing a cybersecurity team.

      The growth of remote work means local talent can now be hired by anybody, vastly increasing your competition as an employer.

      Hiring local will get tougher – but so will hiring abroad. People who don’t want to relocate for a new job now have plenty of alternatives. Without a compelling remote work option, you will find non-local prospects unwilling to move for a new job.

      Lastly, many organizations are still reeling at the cost of experienced cybersecurity talent. Focused internal training and development will be the answer for many organizations.

      Recommended Actions

      Provide career development opportunities

      Many security professionals are dissatisfied with their unclear career development paths. To improve retention, organizations should provide their staff with opportunities and clear paths for career and skills advancement.

      Be open-minded when hiring

      To broaden the candidate pool, organizations should be open-minded when considering who to hire.

      • Enable remote work.
      • Do not fixate on certificates and years of experience; rather, be open to developing those who have the right interest and ability.
      • Consider using freelance workers.
      Facilitate work-life balance

      Many security professionals say they experience burnout. Promoting work-life balance in your organization can help retain critical skills.

      Create inclusive environment

      Hire a diverse team and create an inclusive environment where they can thrive.

      Talent acquisition and retention plan

      Use this template to explain the priorities you need your stakeholders to know about.

      Provide a brief value statement for the initiative.

      Address a top priority and a top obstacle with a plan to attract and retain top organizational and cybersecurity talent.

      Initiative Description:

      • Provide secure remote work capabilities for staff.
      • Work with HR to refine a hiring plan that addresses geographical and compensation gaps with cybersecurity and general staff.
      • Survey staff engagement to identify points of friction and remediate where needed.
      • Define a career path and growth plan for staff.
      Description must include what IT will undertake to complete the initiative.

      Primary Business Benefits:

      Arrow pointing down.
      Reduction in costs due to turnover and talent loss

      Other Expected Business Benefits:

      Arrow pointing up.
      Productivity due to good morale/ engagement
      Arrow pointing up.
      Improved corporate culture
      Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.

      Risks:

      • Big organizational and cultural changes
      • Increased attack surface of remote/hybrid workforce

      Related Info-Tech Research:

      Secure a Remote Workforce

      Priority 02

      Trends suggest remote work is here to stay. Addressing the risk of insecure endpoints can no longer be deferred.

      Executive summary

      Remote work poses unique challenges to cybersecurity teams. The personal home environment may introduce unauthorized people and unknown network vulnerabilities, and the organization loses nearly all power and influence over the daily cyber hygiene of its users.

      In addition, the software used for enabling remote work itself can be a target of cybersecurity criminals.

      Current situation

      • 70% of workers in technical services work from home.
      • Employees of larger firms and highly paid individuals are more likely to be working outside the office.
      • 80% of security and business leaders find that remote work has increased the risk of a breach.
      • (Source: StatCan, 2021)

      70% of tech workers work from home (Source: Statcan, 2021)

      Remote work demands new security solutions

      The security perimeter is finally gone

      The data is outside the datacenter.
      The users are outside the office.
      The endpoints are … anywhere and everywhere.

      Organizations that did not implement digital transformation changes following COVID-19 experience higher costs following a breach, likely because it is taking nearly two months longer, on average, to detect and contain a breach when more than 50% of staff are working remotely (IBM, 2021).

      In 2022 the cumulative risk of so many remote connections means we need to rethink how we secure the remote/hybrid workforce.

      Security
      • Distributed denial of service
      • DNS hijacking
      • Weak VPN protocols
      Identity
      • One-time verification allowing lateral movement
      Colorful tiles representing the surrounding security solutions. Network
      • Risk perimeter stops at corporate network edge
      • Split tunneling
      Authentication
      • Weak authentication
      • Weak password
      Access
      • Man-in-the-middle attack
      • Cross-site scripting
      • Session hijacking

      Recommended Actions

      Mature your identity management

      Compromised identity is the main vector to breaches in recent years. Stale accounts, contractor accounts, misalignment between HR and IT – the lack of foundational practices leads to headline-making breaches every week.
      Tighten up identity control to keep your organization out of the newspaper.

      Get a handle on your endpoints

      Work-from-home (WFH) often means unknown endpoints on unknown networks full of other unknown devices…and others in the home potentially using the workstation for non-work purposes. Gaining visibility into your endpoints can help to keep detection and resolution times short.

      Educate users

      Educate everyone on security best practices when working remotely:

      • Apply secure settings (not just defaults) to the home network.
      • Use strong passwords.
      • Identify suspicious email.
      Ease of use

      Many workers complain that the corporate technology solution makes it difficult to get their work done.

      Employees will take productivity over security if we force them to choose, so IT needs to listen to end users’ needs and provide a solution that is nimble and secure.

      Roadmap to securing remote/hybrid workforce

      Use this template to explain the priorities you need your stakeholders to know about.

      Provide a brief value statement for the initiative.

      The corporate network now extends to the internet – ensure your security plan has you covered.

      Initiative Description:

      • Reassess enterprise security strategy to include the WFH attack surface (especially endpoint visibility).
      • Ensure authentication requirements for remote workers are sufficient (e.g. MFA, strong passwords, hardware tokens for high-risk users/connections).
      • Assess the value of zero trust networking to minimize the blast radius in the case of a breach.
      • Perform penetration testing annually.
      Description must include what IT will undertake to complete the initiative.

      Primary Business Benefits:

      Arrow pointing down.


      Reduced cost of security incidents/reputational damage

      Other Expected Business Benefits:

      Arrow pointing up.
      Improved ability to attract and retain talent
      Arrow pointing up.
      Increased business adaptability
      Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.

      Risks:

      • Potential disruption to traditional working patterns
      • Cost of investing in WFH versus risk of BYOD

      Related Info-Tech Research:

      Secure Digital Transformation

      Priority 03

      Digital transformation could be a competitive advantage…or the cause of your next data breach.

      Executive summary

      Background

      Digital transformation is occurring at an ever-increasing rate these days. As Microsoft CEO Satya Nadella said early in the pandemic, “We’ve seen two years’ worth of digital transformation in two months.”

      We have heard similar stories from Info-Tech members who deployed rollouts that were scheduled to take months over a weekend instead.

      Microsoft’s own shift to rapidly expand its Teams product is a prime example of how quickly the digital landscape has changed. The global adaption to a digital world has largely been a success story, but rapid change comes with risk, and there is a parallel story of rampant cyberattacks like we have never seen before.

      Insight

      There is an adage that “slow is smooth, and smooth is fast” – the implication being that fast is sloppy. In 2022 we’ll see a pattern of organizations working to catch up their cybersecurity with the transformations we all made in 2020.

      $1.78 trillion expected in digital transformation investments (Source: World Economic Forum, 2021)

      An ounce of security prevention versus a pound of cure

      The journey of digital transformation is a risky one.

      Digital transformations often rely heavily on third-party cloud service providers, which increases exposure of corporate data.

      Further, adoption of new technology creates a new threat surface that must be assessed, mitigations implemented, and visibility established to measure performance.

      However, digital transformations are often run on slim budgets and without expert guidance.

      Survey respondents report as much: rushed deployments, increased cloud migration, and shadow IT are the top vulnerabilities reported by security leaders and executives.

      In a 2020 Ponemon survey, 82% of IT security and C-level executives reported experiencing at least one data breach directly resulting from a digital transformation they had undergone.

      Scope creep is inevitable on any large project like a digital transformation. A small security shortcut early in the project can have dire consequences when it grows to affect personal data and critical systems down the road.

      Recommended Actions

      Engage the business early and often

      Despite the risks, organizations engage in digital transformations because they also have huge business value.

      Security leaders should not be seeking to slow or stop digital transformations; rather, we should be engaging with the business early to get ahead of risks and enable successful transformation.

      Establish a vendor security program

      Data is moving out of datacenters and onto third-party environments. Without security requirements built into agreements, and clear visibility into vendor security capabilities, that data is a major source of risk.

      A robust vendor security program will create assurance early in the process and help to reinforce the responsibility of securing data with other parts of the organization.

      Build/revisit your security strategy

      The threat surface has changed since before your transformation. This is the right time to revisit or rebuild your security strategy to ensure that your control set is present throughout the new environment – and also a great opportunity to show how your current security investments are helping secure your new digital lines of business!

      Educate your key players

      Only 16% of security leaders and executives report alignment between security and business processes during digital transformation.

      If security is too low a priority, then key players in your transformation efforts are likely unaware of how security risks impact their own success. It will be incumbent upon the CISO to start that conversation.

      Securing digital transformation

      Use this template to explain the priorities you need your stakeholders to know about.

      Provide a brief value statement for the initiative.

      Ensure your investment in digital transformation is appropriately secured.

      Initiative Description:

      • Engage security with digital transformation and relevant governance structures (steering committees) to ensure security considerations are built into digital transformation planning.
      • Incorporate security stage gates in project management procedures.
      • Establish a vendor security assessment program.
      Description must include what IT will undertake to complete the initiative.

      Primary Business Benefits:

      Arrow pointing up.


      Increased likelihood of digital transformation success

      Other Expected Business Benefits:

      Arrow pointing up.
      Ability to make informed decisions for the field rep strategy
      Arrow pointing down.
      Reduced long-term cost of digital transformation
      Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.

      Risks:

      • Potential increased up front cost (reduced long-term cost)
      • Potential slowed implementation with security stage gates in project management

      Related Info-Tech Research:

      Adopt Zero Trust

      Priority 04

      Governments are recognizing the importance of zero trust strategies. So should your organization.

      Why now for zero trust?

      John Kindervag modernized the concept of zero trust back in 2010, and in the intervening years there has been enormous interest in cybersecurity circles, yet in 2022 only 30% of organizations report even beginning to roll out zero trust capabilities (Statista, 2022).

      Why such little action on a revolutionary and compelling model?

      Zero trust is not a technology; it is a principle. Zero trust adoption takes concerted planning, effort, and expense, for which the business value has been unclear throughout most of the last 10 years. However, several recent developments are changing that:

      • Securing technology has become very hard! The size, complexity, and attack surface of IT environments has grown significantly – especially since the pandemic.
      • Cyberattacks have become rampant as the cost to deploy harmful ransomware has become lower and the impact has become higher.
      • The shift away from on-premises datacenters and offices created an opening for zero trust investment, and zero trust technology is more mature than ever before.

      The time has come for zero trust adoption to begin in earnest.

      97% will maintain or increase zero trust budget (Source: Statista, 2022)

      Traditional perimeter security is not working

      Zero trust directly addresses the most prevalent attack vectors today

      A hybrid workforce using traditional VPN creates an environment where we are exposed to all the risks in the wild (unknown devices at any location on any network), but at a stripped-down security level that still provides the trust afforded to on-premises workers using known devices.

      What’s more, threats such as ransomware are known to exploit identity and remote access vulnerabilities before moving laterally within a network – vectors that are addressed directly by zero trust identity and networking. Ninety-three percent of surveyed zero trust adopters state that the benefits have matched or exceeded their expectations (iSMG, 2022).

      Top reasons for building a zero trust program in 2022

      (Source: iSMG, 2022)

      44%

      Enforce least privilege access to critical resources

      44%

      Reduce attacker ability to move laterally

      41%

      Reduce enterprise attack surface

      The business case for zero trust is clearer than ever

      Prior obstacles to Zero Trust are disappearing

      A major obstacle to zero trust adoption has been the sheer cost, along with the lack of business case for that investment. Two factors are changing that paradigm in 2022:

      The May 2021 US White House Executive Order for federal agencies to adopt zero trust architecture finally placed zero trust on the radar of many CEOs and board members, creating the business interest and willingness to consider investing in zero trust.

      In addition, the cost of adopting zero trust is quickly being surpassed by the cost of not adopting zero trust, as cyberattacks become rampant and successful zero trust deployments create a case study to support investment.

      Bar chart titled 'Cost to remediate a Ransomware attack' with bars representing the years '2021' and '2020'. 2021's cost sits around $1.8M while 2020's was only $750K The cost to remediate a ransomware attack more than doubled from 2020 to 2021. Widespread adoption of zero trust capabilities could keep that number from doubling again in 2022. (Source: Sophos, 2021)

      The cost of a data breach is on average $1.76 million less for organizations with mature zero trust deployments.

      That is, the cost of a data breach is 35% reduced compared to organizations without zero trust controls. (Source: IBM, 2021)

      Recommended Actions

      Start small

      Don’t put all your eggs in one basket by deploying zero trust in a wide swath. Rather, start as small as possible to allow for growing pains without creating business friction (or sinking your project altogether).

      Build a sensible roadmap

      Zero trust principles can be applied in a myriad of ways, so where should you start? Between identities, devices, networking, and data, decide on a use case to do pilot testing and then refine your approach.

      Beware too-good-to-be-true products

      Zero trust is a powerful buzzword, and vendors know it.

      Be skeptical and do your due diligence to ensure your new security partners in zero trust are delivering what you need.

      Zero trust roadmap

      Use this template to explain the priorities you need your stakeholders to know about.

      Provide a brief value statement for the initiative.

      Develop a practical roadmap that shows the business value of security investment.

      Initiative Description:

      • Define desired business and security outcomes from zero trust adoption.
      • Assess zero trust readiness.
      • Build roadmaps for zero trust:
        1. Identity
        2. Networking
        3. Devices
        4. Data
      Description must include what IT will undertake to complete the initiative.

      Primary Business Benefits:

      Arrow pointing up.


      Increased security posture and business agility

      Other Expected Business Benefits:

      Arrow pointing down.
      Reduced impact of security events
      Arrow pointing down.
      Reduced cost of managing complex control set
      Arrow pointing up.
      More secure business transformation (i.e. cloud/digital)
      Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.

      Risks:

      • Learning curve of implementation (start small and slow)
      • Transition from current control set to zero trust model

      Related Info-Tech Research:

      Protect Against and Respond to Ransomware

      Priority 05

      Ransomware is still the #1 threat to the safety of your data.

      Executive summary

      Background

      • Ransomware attacks have transformed in 2021 and show no sign of slowing in 2022. There is a new major security breach every week, despite organizations spending over $150 billion in a year on cybersecurity (Nasdaq, 2021).
      • Ransomware as a service (RaaS) is commonplace, and attackers are doubling down by holding encrypted data ransom and also demanding payment under threat to disclose exfiltrated data – and they are making good on their threats.
      • The global cost of ransomware is expected to rise to $265 billion by 2031 (Cybersecurity Ventures, 2021).
      • We expect to see an increase in ransomware incidents in 2022, both in severity and volume – multiple attacks and double extortion are now the norm.
      • High staff turnover increases risk because new employees are unfamiliar with security protocols.

      150% increase ransomware attacks in 2020 (Source: ENISA)

      This is a new golden age of ransomware

      What is the same in 2022

      Unbridled ransomware attacks make it seem like attackers must be using complex new techniques, but prevalent ransomware attack vectors are actually well understood.

      Nearly all modern variants are breaching victim systems in one of three ways:

      • Email phishing
      • Software vulnerabilities
      • RDP/Remote access compromise
      What is new in 2022
      The sophistication of victim targeting

      Victims often find themselves asking, “How did the attackers know to phish the most security-oblivious person in my staff?” Bad actors have refined their social engineering and phishing to exploit high-risk individuals, meaning your chain is only as strong as the weakest link.

      Ability of malware to evade detection

      Modern ransomware is getting better at bypassing anti-malware technology, for example, through creative techniques such as those seen in the MedusaLocker variant and in Ghost Control attacks.

      Effective anti-malware is still a must-have control, but a single layer of defense is no longer enough. Any organization that hopes to avoid paying a ransom must prepare to detect, respond, and recover from an attack.

      Many leaders still don’t know what a ransomware recovery would look like

      Do you know what it would take to recover from a ransomware incident?

      …and does your executive leadership know what it would take to recover?

      The organizations that are most likely to pay a ransom are unprepared for the reality of recovering their systems.

      If you have not done a tabletop or live exercise to simulate a true recovery effort, you may be exposed to more risk than you realize.

      Are your defenses sufficiently hardened against ransomware?

      Organizations with effective security prevention are often breached by ransomware – but they are prepared to contain, detect, and eradicate the infection.

      Ask yourself whether you have identified potential points of entry for ransomware. Assume that your security controls will fail.

      How well are your security controls layered, and how difficult would it be for an attacker to move east/west within your systems?

      Recommended Actions

      Be prepared for a breach

      There is no guarantee that an organization will not fall victim to ransomware, so instead of putting all their effort into prevention, organizations should also put effort into planning to respond to a breach.

      Security awareness training/phishing detection

      Phishing continues to be the main point of entry for ransomware. Investing in phishing awareness and detection among your end users may be the most impactful countermeasure you can implement.

      Zero trust adoption

      Always verify at every step of interaction, even when access is requested by internal users. Manage access of sensitive information based on the principle of least privilege access.

      Encrypt and back up your data

      Encrypt your data so that even if there is a breach, the attackers don’t have a copy of your data. Also, keep regular backups of data at a separate location so that you still have data to work with after a breach occurs.

      You never want to pay a ransom. Being prepared to deal with an incident is your best chance to avoid paying!

      Prevent and respond to ransomware

      Use this template to explain the priorities you need your stakeholders to know about.

      Provide a brief value statement for the initiative.

      Determine your current readiness, response plan, and projects to close gaps.

      Initiative Description:

      • Execute a systematic assessment of your current security and ransomware recovery capabilities.
      • Perform tabletop activities and live recoveries to test data recovery capabilities.
      • Train staff to detect suspicious communications and protect their identities.
      Description must include what IT will undertake to complete the initiative.

      Primary Business Benefits:

      Arrow pointing up.


      Improved productivity and brand protection

      Other Expected Business Benefits:

      Arrow pointing down.
      Reduced downtime and disruption
      Arrow pointing down.
      Reduced cost due to incidents (ransom payments, remediation)
      Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.

      Risks:

      • Friction with existing staff

      Related Info-Tech Research:

      Deepfakes: Dark-horse threat for 2022

      Deepfake video

      How long has it been since you’ve gone a full workday without having a videoconference with someone?

      We have become inherently trustful that the face we see on the screen is real, but the technology required to falsify that video is widely available and runs on commercially available hardware, ushering in a genuinely post-truth online era.

      Criminals can use deepfakes to enhance social engineering, to spread misinformation, and to commit fraud and blackmail.

      Deepfake audio

      Many financial institutions have recently deployed voiceprint authentication. TD describes its VoicePrint as “voice recognition technology that allows us to use your voiceprint – as unique to you as your fingerprint – to validate your identity” over the phone.

      However, hackers have been defeating voice recognition for years already. There is ripe potential for voice fakes to fool both modern voice recognition technology and the accounts payable staff.

      Bibliography

      “2021 Ransomware Statistics, Data, & Trends.” PurpleSec, 2021. Web.

      Bayern, Macy. “Why 60% of IT security pros want to quit their jobs right now.” TechRepublic, 10 Oct. 2018. Web.

      Bresnahan, Ethan. “How Digital Transformation Impacts IT And Cyber Risk Programs.” CyberSaint Security, 25 Feb. 2021. Web.

      Clancy, Molly. “The True Cost of Ransomware.” Backblaze, 9 Sept. 2021.Web.

      “Cost of a Data Breach Report 2021.” IBM, 2021. Web.

      Cybersecurity Ventures. “Global Ransomware Damage Costs To Exceed $265 Billion By 2031.” Newswires, 4 June 2021. Web.

      “Digital Transformation & Cyber Risk: What You Need to Know to Stay Safe.” Ponemon Institute, June 2020. Web.

      “Global Incident Response Threat Report: Manipulating Reality.” VMware, 2021.

      Granger, Diana. “Karmen Ransomware Variant Introduced by Russian Hacker.” Recorded Future, 18 April 2017. Web.

      “Is adopting a zero trust model a priority for your organization?” Statista, 2022. Web.

      “(ISC)2 Cybersecurity Workforce Study, 2021: A Resilient Cybersecurity Profession Charts the Path Forward.” (ISC)2, 2021. Web.

      Kobialka, Dan. “What Are the Top Zero Trust Strategies for 2022?” MSSP Alert, 10 Feb. 2022. Web.

      Kost, Edward. “What is Ransomware as a Service (RaaS)? The Dangerous Threat to World Security.” UpGuard, 1 Nov. 2021. Web.

      Lella, Ifigeneia, et al., editors. “ENISA Threat Landscape 2021.” ENISA, Oct. 2021. Web.

      Mello, John P., Jr. “700K more cybersecurity workers, but still a talent shortage.” TechBeacon, 7 Dec. 2021. Web.

      Naraine, Ryan. “Is the ‘Great Resignation’ Impacting Cybersecurity?” SecurityWeek, 11 Jan. 2022. Web.

      Oltsik, Jon. “ESG Research Report: The Life and Times of Cybersecurity Professionals 2021 Volume V.” Enterprise Security Group, 28 July 2021. Web.

      Osborne, Charlie. “Ransomware as a service: Negotiators are now in high demand.” ZDNet, 8 July 2021. Web.

      Osborne, Charlie. “Ransomware in 2022: We’re all screwed.” ZDNet, 22 Dec. 2021. Web.

      “Retaining Tech Employees in the Era of The Great Resignation.” TalentLMS, 19 Oct. 2021. Web.

      Rubin, Andrew. “Ransomware Is the Greatest Business Threat in 2022.” Nasdaq, 7 Dec. 2021. Web.

      Samartsev, Dmitry, and Daniel Dobrygowski. “5 ways Digital Transformation Officers can make cybersecurity a top priority.“ World Economic Forum, 15 Sept. 2021. Web.

      Seymour, John, and Azeem Aqil. “Your Voice is My Passport.” Presented at black hat USA 2018.

      Solomon, Howard. “Ransomware attacks will be more targeted in 2022: Trend Micro.” IT World Canada, 6 Jan. 2022. Web.

      “The State of Ransomware 2021.” Sophos, April 2021. Web.

      Tarun, Renee. “How The Great Resignation Could Benefit Cybersecurity.” Forbes Technology Council, Forbes, 21 Dec. 2021. Web.

      “TD VoicePrint.” TD Bank, n.d. Web.

      “Working from home during the COVID-19 pandemic, April 202 to June 2021.” Statistics Canada, 4 Aug. 2021. Web.

      “Zero Trust Strategies for 2022.” iSMG, Palo Alto Networks, and Optiv, 28 Jan. 2022. Web.

      Secrets of SAP S-4HANA Licensing

      • Buy Link or Shortcode: {j2store}231|cart{/j2store}
      • member rating overall impact: 9.0/10 Overall Impact
      • member rating average dollars saved: $25,000 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: Vendor Management
      • Parent Category Link: /vendor-management
      • With the relatively slow uptake of the S/4HANA platform, the pressure is immense for SAP to maintain revenue growth.
      • SAP’s definitions and licensing rules are complex and vague, making it extremely difficult to purchase with confidence while remaining compliant.
      • Aggressive audit tactics may be used to speed up the move to HANA.

      Our Advice

      Critical Insight

      • Mapping SAP products to HANA can be highly complex, leading to overspending and an inability to reduce future spend.
      • The deployment model chosen will directly impact commercial pathways forward.
      • Beware of digital (indirect) access licensing and compliance concerns.
      • Without having a holistic negotiation strategy, it is easy to hit a common obstacle and land into SAP’s playbook, requiring further spend.

      Impact and Result

      • Build a business case to evaluate S/4HANA.
      • Understand the S/4HANA roadmap and map current functionality to ensure compatibility.
      • Understand negotiating pricing and commercial terms.
      • Learn the “SAP way” of conducting business, which includes a best-in-class sales structure, unique contracts, and license use policies combined with a hyper-aggressive compliance function.

      Secrets of SAP S/4HANA Licensing Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should explore the secrets of SAP S/4HANA licensing, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish requirements

      Determining SAP’s fit within your organization is critical. Start off by building a business case to assess overarching drivers and justification for change, any net new business benefits and long-term sustainability. Oftentimes the ROI is negative, but the investment sets the stage for long-term growth.

      2. Evaluate licensing options

      Your deployment model is more important than you think. Selecting a deployment model will dictate your licensing options followed by your contractual pathways forward.

      • SAP License Summary and Analysis Tool
      • SAP Digital Access Licensing Pricing Tool

      3. Negotiation and license management

      Know what’s in the contract. Each customer agreement is different and there may be existing terms that are beneficial. Depending on how much is spent, anything can be up for negation.

      • SAP S/4HANA Terms and Conditions Evaluator
      [infographic]

      Implement Your Negotiation Strategy More Effectively

      • Buy Link or Shortcode: {j2store}225|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Vendor Management
      • Parent Category Link: /vendor-management
      • Forty-eight percent of CIOs believe their budgets are inadequate.
      • CIOs and IT departments are getting more involved with negotiations to reduce costs and risk.
      • Not all negotiators are created equal, and the gap between a skilled negotiator and an average negotiator is not always easy to identify objectively.
      • Skilled negotiators are in short supply.

      Our Advice

      Critical Insight

      • Preparation is critical for the success of your negotiation, but you cannot prepare for every eventuality.
      • Communication is the heart and soul of negotiations, but what is being “said” is only part of the picture.
      • Skilled negotiators separate themselves based on skillsets, and outcomes alone may not provide an accurate assessment of a negotiator.

      Impact and Result

      Addressing and managing critical negotiation elements helps:

      • Improve negotiation skills.
      • Implement your negotiation strategy more effectively.
      • Improve negotiation results.

      Implement Your Negotiation Strategy More Effectively Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should create and follow a scalable process for preparing to negotiate with vendors, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. During

      Throughout this phase, ten essential negotiation elements are identified and reviewed.

      • Implement Your Negotiation Strategy More Effectively – Phase 1: During
      • During Negotiations Tool
      [infographic]

      Workshop: Implement Your Negotiation Strategy More Effectively

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 12 Steps to Better Negotiation Preparation

      The Purpose

      Improve negotiation skills and outcomes.

      Understand how to use the Info-Tech During Negotiations Tool.

      Key Benefits Achieved

      A better understanding of the subtleties of the negotiation process and an identification of where the negotiation strategy can go awry.

      The During Negotiation Tool will be reviewed and configured for the customer’s environment (as applicable).

      Activities

      1.1 Manage six key items during the negotiation process.

      1.2 Set the right tone and environment for the negotiation.

      1.3 Focus on improving three categories of intangibles.

      1.4 Improve communication skills to improve negotiation skills.

      1.5 Customize your negotiation approach to interact with different personality traits and styles.

      1.6 Maximize the value of your discussions by focusing on seven components.

      1.7 Understand the value of impasses and deadlocks and how to work through them.

      1.8 Use concessions as part of your negotiation strategy.

      1.9 Identify and defeat common vendor negotiation ploys.

      1.10 Review progress and determine next steps.

      Outputs

      Sample negotiation ground rules

      Sample vendor negotiation ploys

      Sample discussion questions and evaluation matrix

      Enable Organization-Wide Collaboration by Scaling Agile

      • Buy Link or Shortcode: {j2store}174|cart{/j2store}
      • member rating overall impact: 8.3/10 Overall Impact
      • member rating average dollars saved: $12,989 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: Architecture & Strategy
      • Parent Category Link: /architecture-and-strategy
      • Your organization is realizing benefits from adopting Agile principles and practices in pockets of your organization.
      • You are starting to investigate opportunities to extend Agile beyond these pilot implementations into other areas of the organization. You are looking for a coordinated approach aligned to business priorities.

      Our Advice

      Critical Insight

      • Not all lessons from a pilot project are transferable. Pilot processes are tailored to a specific project’s scope, team, and tools, and they may not account for the diverse attributes in your organization.
      • Control may be necessary for coordination. More moving parts means enforcing consistent cadences, reporting, and communication is a must if teams are not disciplined or lack good governance.
      • Scale Agile in departments tolerable to change. Incrementally roll Agile out in departments where its principles are accepted (e.g. a culture of continuous improvement, embracing failures as lessons).

      Impact and Result

      • Complete an Agile capability assessment of your pilot functional group to gauge anticipated Agile benefits. Identify the business objectives and the group drivers that are motivating a scaled Agile implementation.
      • Understand the challenges that you may face when scaling Agile. Investigate the root causes of inefficiencies that can derail your scaling initiatives.
      • Brainstorm solutions to your scaling challenges and envision a target state for your growing Agile environment. Your target state will discover new opportunities to drive more business value and eliminate current activities driving down productivity.
      • Coordinate the implementation and execution of scaling Agile initiatives with a Scaling Agile Playbook. This organic and collaborative document will lay out the process, roles, goals, and objectives needed to successfully manage your Agile environment.

      Enable Organization-Wide Collaboration by Scaling Agile Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should scale up Agile, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Gauge readiness to scale up Agile

      Evaluate the readiness of the pilot functional group and Agile development processes to adopt scaled Agile practices.

      • Enable Organization-Wide Collaboration by Scaling Agile – Phase 1: Gauge Readiness to Scale Up Agile
      • Scaling Agile Playbook Template
      • Scrum Development Process Template

      2. Define scaled Agile target state

      Alleviate scaling issues and risks and introduce new opportunities to enhance business value delivery with Agile practices.

      • Enable Organization-Wide Collaboration by Scaling Agile – Phase 2: Define Scaled Agile Target State

      3. Create implementation plan

      Roll out scaling Agile initiatives in a gradual, iterative approach and define the right metrics to demonstrate success.

      • Enable Organization-Wide Collaboration by Scaling Agile – Phase 3: Create Implementation Plan
      [infographic]

      Workshop: Enable Organization-Wide Collaboration by Scaling Agile

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Gauge Your Readiness to Scale Up Agile

      The Purpose

      Identify the business objectives and functional group drivers for adopting Agile practices to gauge the fit of scaling Agile.

      Select the pilot project to demonstrate the value of scaling Agile.

      Review and evaluate your current Agile development process and functional group structure.

      Key Benefits Achieved

      Understanding of the notable business and functional group gaps that can derail the scaling of Agile.

      Selection of a pilot program that will be used to gather metrics to continuously improve implementation and obtain buy-in for wider rollout.

      Realization of the root causes behind functional group and process issues in the current Agile implementation.

      Activities

      1.1 Assess your pilot functional group

      Outputs

      Fit assessment of functional group to pilot Agile scaling

      Selection of pilot program

      List of critical success factors

      2 Define Your Scaled Agile Target State

      The Purpose

      Think of solutions to address the root causes of current communication and process issues that can derail scaling initiatives.

      Brainstorm opportunities to enhance the delivery of business value to customers.

      Generate a target state for your scaled Agile implementation.

      Key Benefits Achieved

      Defined Agile capabilities and services of your functional group.

      Optimized functional group team structure, development process, and program framework to support scaled Agile in your context.

      Identification and accommodation of the risks associated with implementing and executing Agile capabilities.

      Activities

      2.1 Define Agile capabilities at scale

      2.2 Build your scaled Agile target state

      Outputs

      Solutions to scaling issues and opportunities to deliver more business value

      Agile capability map

      Functional group team structure, Agile development process and program framework optimized to support scaled Agile

      Risk assessment of scaling Agile initiatives

      3 Create Your Implementation Plan

      The Purpose

      List metrics to gauge the success of your scaling Agile implementation.

      Define the initiatives to scale Agile in your organization and to prepare for a wider rollout.

      Key Benefits Achieved

      Strategic selection of the right metrics to demonstrate the value of scaling Agile initiatives.

      Scaling Agile implementation roadmap based on current resource capacities, task complexities, and business priorities.

      Activities

      3.1 Create your implementation plan

      Outputs

      List of metrics to gauge scaling Agile success

      Scaling Agile implementation roadmap

      Embrace Business-Managed Applications

      • Buy Link or Shortcode: {j2store}179|cart{/j2store}
      • member rating overall impact: 9.0/10 Overall Impact
      • member rating average dollars saved: $64,999 Average $ Saved
      • member rating average days saved: 18 Average Days Saved
      • Parent Category Name: Architecture & Strategy
      • Parent Category Link: /architecture-and-strategy
      • The traditional model of managing applications does not address the demands of today’s rapidly changing market and digitally minded business, putting stress on scarce IT resources. The business is fed up with slow IT responses and overbearing desktop and system controls.
      • The business wants more control over the tools they use. Software as a service (SaaS), business process management (BPM), robotic process automation (RPA), artificial intelligence (AI), and low-code development platforms are all on their radar.
      • However, your current governance and management structures do not accommodate the risks and shifts in responsibilities to business-managed applications.

      Our Advice

      Critical Insight

      • IT is a business partner, not just an operator. Effective business operations hinge on high-quality, valuable, fit-for-purpose applications. IT provides the critical insights, guidance, and assistance to ensure applications are implemented and leveraged in a way that maximizes return on investment, whether it is being managed by end users or lines of business (LOBs). This can only happen if the organization views IT as a critical asset, not just a supporting player.
      • All applications should be business owned. You have applications because LOBs need them to meet the objectives and key performance indicators defined in the business strategy. Without LOBs, there would be no need for business applications. LOBs define what the application should be and do for it to be successful, so LOBs should own them.
      • Everything boils down to trust. The business is empowered to make their own decisions on how they want to implement and use their applications and, thus, be accountable for the resulting outcomes. Guardrails, role-based access, application monitoring, and other controls can help curb some risk factors, but it should not come at the expense of business innovation and time-sensitive opportunities. IT must trust the business will make rational application decisions, and the business must trust IT to support them in good times and bad.

      Impact and Result

      • Focus on the business units that matter. BMA can provide significant value to LOBs if teams and stakeholders are encouraged and motivated to adopt organizational and operational changes.
      • Reimagine the role of IT. IT is no longer the gatekeeper that blocks application adoption. Rather, IT enables the business to adopt the tools they need to be productive and they guide the business on successful BMA practices.
      • Instill business accountability. With great power comes great responsibility. If the business wants more control of their applications, they must be willing to take ownership of the outcomes of their decisions.

      Embrace Business-Managed Applications Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should embrace business-managed applications, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Embrace Business-Managed Applications – Phases 1-3
      • Business-Managed Applications Communication Template

      1. State your objectives

      Level-set the expectations for your business-managed applications.

      • Embrace Business- Managed Applications – Phase 1: State Your Objectives

      2. Design your framework and governance

      Identify and define your application managers and owners and build a fit-for-purpose governance model.

      • Embrace Business-Managed Applications – Phase 2: Design Your Framework & Governance

      3. Build your roadmap

      Build a roadmap that illustrates the key initiatives to implement your BMA and governance models.

      • Embrace Business-Managed Applications – Phase 3: Build Your Roadmap

      [infographic]

      Workshop: Embrace Business-Managed Applications

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 State Your Objectives

      The Purpose

      Define business-managed applications in your context.

      Identify your business-managed application objectives.

      State the value opportunities with business-managed applications.

      Key Benefits Achieved

      A consensus definition and list of business-managed applications goals

      Understanding of the business value business-managed applications can deliver

      Activities

      1.1 Define business-managed applications.

      1.2 List your objectives and metrics.

      1.3 State the value opportunities.

      Outputs

      Grounded definition of a business-managed application

      Goals and objectives of your business-managed applications

      Business value opportunity with business-managed applications

      2 Design Your Framework & Governance

      The Purpose

      Develop your application management framework.

      Tailor your application delivery and ownership structure to fit business-managed applications.

      Discuss the value of an applications committee.

      Discuss technologies to enable business-managed applications.

      Key Benefits Achieved

      Fit-for-purpose and repeatable application management selection framework

      Enhanced application governance model

      Applications committee design that meets your organization’s needs

      Shortlist of solutions to enable business-managed applications

      Activities

      2.1 Develop your management framework.

      2.2 Tune your delivery and ownership accountabilities.

      2.3 Design your applications committee.

      2.4 Uncover your solution needs.

      Outputs

      Tailored application management selection framework

      Roles definitions of application owners and managers

      Applications committee design

      List of business-managed application solution features and services

      3 Build Your Roadmap

      The Purpose

      Build your roadmap to implement busines-managed applications and build the foundations of your optimized governance model.

      Key Benefits Achieved

      Implementation initiatives

      Adoption roadmap

      Activities

      3.1 Build your roadmap.

      Outputs

      Business-managed application adoption roadmap

       

      AI Governance

      • Buy Link or Shortcode: {j2store}206|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: $389 Average $ Saved
      • member rating average days saved: 3 Average Days Saved
      • Parent Category Name: Business Intelligence Strategy
      • Parent Category Link: /business-intelligence-strategy
      • The use of AI and machine learning (ML) has gained momentum as organizations evaluate the potential applications of AI to enhance the customer experience, improve operational efficiencies, and automate business processes.
      • Growing applications of AI have reinforced concerns about ethical, fair, and responsible use of the technology that assists or replaces human decision making.

      Our Advice

      Critical Insight

      • Implementing AI systems requires careful management of the AI lifecycle, governing data, and machine learning model to prevent unintentional outcomes not only to an organization’s brand reputation but, more importantly, to workers, individuals, and society.
      • When adopting AI, it is important to have a strong ethical and risk management framework surrounding its use.

      Impact and Result

      • AI governance enables management, monitoring, and control of all AI activities within an organization.

      AI Governance Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. AI Governance Deck – A framework for building responsible, ethical, fair, and transparent AI.

      Create the foundation that enables management, monitoring, and control of all AI activities within the organization. The AI governance framework will allow you to define an AI risk management approach and defines methodology for managing and monitoring the AI/ML models in production.

      • AI Governance Storyboard
      [infographic]

      Further reading

      AI Governance

      A Framework for Building Responsible, Ethical, Fair, and Transparent AI

      Are you ready for AI?

      Business leaders must manage the associated risks as they scale their use of AI

      In recent years, following technological breakthroughs and advances in development of machine learning (ML) models and management of large volumes of data, organizations are scaling their use of artificial intelligence (AI) technologies.

      The use of AI and ML has gained momentum as organizations evaluate the potential applications of AI to enhance the customer experience, improve operational efficiencies, and automate business processes.

      Growing applications of AI have reinforced concerns about ethical, fair, and responsible use of the technology that assists or replaces human decision-making.

      Implementing AI systems requires careful management of the AI lifecycle, governing data, and machine learning model to prevent unintentional outcomes not only to an organization’s brand reputation but also, more importantly, to workers, individuals, and society. When adopting AI, it is important to have strong ethical and risk management frameworks surrounding its use.

      “Responsible AI is the practice of designing, building and deploying AI in a manner that empowers people and businesses, and fairly impacts customers and society – allowing companies to engender trust and scale AI with confidence.” (World Economic Forum)

      Regulations and risk assessment tools

      Governments around the world are developing AI assessment methodologies and legislation for AI. Here are a couple of examples:

      • Responsible use of artificial intelligence (AI) guiding principles (Canada):
        1. understand and measure the impact of using AI by developing and sharing tools and approaches
        2. be transparent about how and when we are using AI, starting with a clear user need and public benefit
        3. provide meaningful explanations about AI decision-making, while also offering opportunities to review results and challenge these decisions
        4. be as open as we can by sharing source code, training data, and other relevant information, all while protecting personal information, system integration, and national security and defense
        5. provide sufficient training so that government employees developing and using AI solutions have the responsible design, function, and implementation skills needed to make AI-based public services better
      • The Algorithmic Impact Assessment tool (Canada) is used to determine the impact level of an automated decision-system. It defines 48 risk and 33 mitigation questions. Assessment scores consider factors such as systems design, algorithm, decision type, impact, and data.
      • The National AI Initiative Act of 2020 (DIVISION E, SEC. 5001) (US) became law on January 1, 2021. This is a program across the entire Federal government to accelerate AI research and application.
      • Bill C-27, Artificial Intelligence and Data Act (AIDA) (Canada), when passed, would be the first law in Canada regulating the use of artificial intelligence systems.
      • The EU Artificial Intelligence Act (EU) assigns applications of AI to three risk categories: applications and systems that create an unacceptable risk, such as government-run social scoring; high-risk applications, such as a CV-scanning tool that ranks job applicants; and lastly, applications not explicitly listed as high-risk.
      • The FEAT Principles Assessment Methodology was created by the Monetary Authority of Singapore (MAS) in collaboration with other 27 industry partners for financial institutions to promote fairness, ethics, accountability, and transparency (FEAT) in the use of artificial intelligence and data analytics (AIDA).

      AI policies around the world

      Map of AI policies around the world, marked by circles of varying color and size. The legend on the right indicates '# of AI Policies (2019-2021)' by color.
      Source of data: OECD.AI (2021), powered by EC/OECD (2021), database of national AI policies, accessed on 7/09/2022, https://oecd.ai.

      The need for AI governance

      “To adopt AI, organizations will need to review and enhance their processes and governance frameworks to address new and evolving risks.” (Canadian RegTech Association, Safeguarding AI Use Through Human-Centric Design, 2020)

      To ensure responsible, transparent, and ethical AI systems, organizations will need to review existing risk control frameworks and update them to include AI risk management and impact assessment frameworks and processes.

      As ML and AI technologies are constantly evolving, the AI governance and AI risk management frameworks will need to evolve to ensure the appropriate safeguards and controls are in place.

      This applies not only to the machine learning models and AI system custom built by the organization’s data science and AI team, but it also includes AI-powered vendor tools and technologies. The vendors should be able to explain how AI is used in their products, how the model was trained, and what data was used to train the model.

      AI governance enables management, monitoring, and control of all AI activities within an organization.

      Stock image of a chip o a circuitboard labelled 'AI'.

      Key concepts

      Info-Tech Research Group defines the key terms used in this document as follows:

      Machine learning systems learn from experience and without explicit instructions. They learn patterns from data, then analyze and make predictions based on past behavior and the patterns learned.

      Artificial intelligence is a combination of technologies and can include machine learning. AI systems perform tasks that mimic human intelligence, such as learning from experience and problem solving. Most importantly, AI makes its own decisions without human intervention.

      We use the definition of data ethics by Open Data Institute: “Data ethics is a branch of ethics that considers the impact of data practices on people, society and the environment. The purpose of data ethics is to guide the values and conduct of data practitioners in data collection, sharing and use.”

      Algorithmic or machine bias is systematic and repeatable errors in a computer system that create unfair outcomes, such as privileging one arbitrary group of users over others. Algorithmic bias is not a technical problem. It’s a social and political problem, and in the context of implementing AI for business benefits, it’s a business problem.

      Download the blueprint Mitigate Machine Bias blueprint for detailed discussion on bias, fairness, and transparency in AI systems

      Key concepts – explainable, transparent and trustworthy

      Responsible AI is the practice of designing, building and deploying AI in a manner that empowers people and businesses and fairly impacts customers and society – allowing companies to engender trust and scale AI with confidence” (CIFAR).

      The AI system is considered trustworthy when people understand how the technology works and when we can assess that it’s safe and reliable. We must be able to trust the output of the system and understand how the system was designed, what data was used to train it, and how it was implemented.

      Explainable AI, sometimes abbreviated as XAI, refers to the ability to explain how an AI model makes predictions, its anticipated impact, and its potential biases.

      Transparency means communicating with and empowering users by sharing information internally and with external stakeholders, including beneficiaries and people impacted by the AI-powered product or service.

      68% [of Canadians] are concerned they don’t understand the technology well enough to know the risks.

      77% say they are concerned about the risks AI poses to society (TD, 2019)

      AI Governance Framework

      Monitoring
      Monitoring compliance and risk of AI/ML systems/models in production

      Tools & Technologies
      Tools and technologies to support AI governance framework implementation

      Model Governance
      Ensures accountability and traceability for AI/ML models

      AI Governance Framework with the surrounding 7 headlines and an adjective between each pair: 'Accountable', 'Trustworthy', 'Responsible', 'Ethical', 'Fair', 'Explainable', 'Transparent'. Organization
      Structure, roles, and responsibilities of the AI governance organization

      Operating Model
      How AI governance operates and works with other organizational structures to deliver value

      Risk and Compliance
      Alignment with corporate risk management and ensuring compliance with regulations and assessment frameworks

      Policies/Procedures/ Standards
      Policies and procedures to support implementation of AI governance

      Generative AI: Market Primer

      • Buy Link or Shortcode: {j2store}349|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Data Management
      • Parent Category Link: /data-management
      • Much of the organization remains in the dark for understanding what Gen AI is, complicated by ambiguous branding from vendors claiming to provide Gen AI solutions.
      • Searching the market for a Gen AI platform is nearly impossible, owing to the sheer number of vendors.
      • The evaluative criteria for selecting a Gen AI platform are unclear.

      Our Advice

      Critical Insight

      • You cannot rush Gen AI selection and implementation. Organizations with (1) FTEs devoted to making Gen AI work (including developers and business intelligence analysts), (2) trustworthy and regularly updated data, and (3) AI governance are just now reaching PoC testing.
      • Gen AI is not a software category – it is an umbrella concept. Gen AI platforms will be built on different foundational models, be trained in different ways, and provide varying modalities. Do not expect Gen AI platforms to be compared against the same parameters in a vendor quadrant.
      • Bad data is the tip of the iceberg for Gen AI risks. While Gen AI success will be heavily reliant on the quality of data it is fine-tuned on, there are independent risks organizations must prepare for, from Gen AI hallucinations and output reliability to infrastructure feasibility and handling high-volume events.
      • Prepare for ongoing instability in the Gen AI market. If your organization is unsure about where to start with Gen AI, the secure route is to examine what your enterprise providers are offering. Use this as a learning platform to confidently navigate which specialized Gen AI provider will be viable for meeting your use cases.

      Impact and Result

      • Consensus on Gen AI scope and key Gen AI capabilities
      • Identification of your readiness to leverage Gen AI applications
      • Agreement on Gen AI evaluative criteria
      • Knowledge of vendor viability

      Generative AI: Market Primer Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Generative AI: Market Primer – Contextualize the marketspace and prepare for generative AI selection.

      Use Info-Tech’s best practices for setting out a selection roadmap and evaluative criteria for narrowing down vendors – both enterprise and specialized providers.

      • Generative AI: Market Primer Storyboard
      • Data Governance Policy
      • AI Governance Storyboard
      • AI Architecture Assessment and Project Planning Tool
      • AI Architecture Assessment and Project Planning Tool – Sample
      • AI Architecture Templates
      [infographic]

      Further reading

      Generative AI: Market Primer

      Cut through Gen AI buzzwords to achieve market clarity.

      Analyst Perspective

      The generative AI (Gen AI) marketspace is complex, nascent, and unstable.

      Organizations need to get clear on what Gen AI is, its infrastructural components, and the governance required for successful platform selection.

      Thomas Randall

      The urge to be fast-moving to leverage the potential benefits of Gen AI is understandable. There are plenty of opportunities for Gen AI to enrich an organization’s use cases – from commercial to R&D to entertainment. However, there are requisites an organization needs to get right before Gen AI can be effectively applied. Part of this is ensuring data and AI governance is well established and mature within the organization. The other part is contextualizing Gen AI to know what components of this market the organization needs to invest in.

      Owing to its popularity surge, OpenAI’s ChatGPT has become near synonymous with Gen AI. However, Gen AI is an umbrella concept that encompasses a variety of infrastructural architecture. Organizations need to ask themselves probing questions if they are looking to work with OpenAI: Does ChatGPT rest on the right foundational model for us? Does ChatGPT offer the right modalities to support our organization’s use cases? How much fine-tuning and prompt engineering will we need to perform? Do we require investment in on-premises infrastructure to support significant data processing and high-volume events? And do we require FTEs to enable all this infrastructure?

      Use this market primer to quickly get up to speed on the elements your organization might need to make the most of Gen AI.

      Thomas Randall

      Advisory Director, Info-Tech Research Group

      Executive Summary

      Your Challenge

      • Much of the organization remains in the dark for understanding what Gen AI is, complicated by ambiguous branding from vendors claiming to provide Gen AI solutions.
      • Searching the market for a Gen AI platform is near impossible, owing to the sheer number of vendors.
      • The evaluative criteria for selecting a Gen AI platform is unclear.

      Common Obstacles

      • Data governance is immature within the organization. There is no source of truth or regularly updated organizational process assets.
      • AI functionality is not well understood within the organization; there is little AI governance for monitoring and controlling its use.
      • The extent of effort and resources required to make Gen AI a success remains murky.

      Info-Tech's Solution

      This market primer for Gen AI will help you:

      1. Contextualize the Gen AI market: Learn what components of Gen AI an organization should consider to make Gen AI a success.
      2. Prepare for Gen AI selection: Use Info-Tech’s best practices for setting out a selection roadmap and evaluative criteria for narrowing down vendors – both enterprise and specialized providers.

      “We are entering the era of generative AI.
      This is a unique time in our history where the benefits of AI are easily accessible and becoming pervasive with co-pilots emerging in the major business tools we use today. The disruptive capabilities that can potentially drive dramatic benefits also introduces risks that need to be planned for.”

      Bill Wong, Principal Research Director – Data and BI, Info-Tech Research Group

      Who benefits from this project?

      This research is designed for:

      • Senior IT, developers, data staff, and project managers who:
        • Have received a mandate from their executives to begin researching the Gen AI market.
        • Need to quickly get up to speed on the state of the Gen AI market, given no deep prior knowledge of the space.
        • Require an overview of the different components to Gen AI to contextualize how vendor comparisons and selections can be made.
        • Want to gain an understanding of key trends, risks, and evaluative criteria to consider in their selection process.

      This research will help you:

      • Articulate the potential business value of Gen AI to your organization.
      • Establish which high-value use cases could be enriched by Gen AI functionality.
      • Assess vendor viability for enterprise and specialized software providers in the Gen AI marketspace.
      • Collect information on the prerequisites for implementing Gen AI functionality.
      • Develop relevant evaluative criteria to assist differentiating between shortlisted contenders.

      This research will also assist:

      • Executives, business analysts, and procurement teams who are stakeholders in:
        • Contextualizing the landscape for learning opportunities.
        • Gathering and documenting requirements.
        • Building deliverables for software selection projects.
        • Managing vendors, especially managing the relationships with incumbent enterprise software providers.

      This research will help you:

      • Identify examples of how Gen AI applications could be leveraged for your organization’s core use cases.
      • Verify the extent of Gen AI functionality an incumbent enterprise provider has.
      • Validate accuracy of Gen AI language and architecture referenced in project deliverables.

      Insight Summary

      You cannot speedrun Gen AI selection and implementation.

      Organizations with (1) FTEs devoted to making Gen AI work (including developers and business intelligence analysts), (2) trustworthy and regularly updated data, and (3) AI governance are just now reaching PoC testing.

      Gen AI is not a software category – it is an umbrella concept.

      Gen AI platforms will be built on different foundational models, be trained in different ways, and provide varying modalities. Do not expect to compare Gen AI platforms to the same parameters in a vendor quadrant.

      Bad data is the tip of the iceberg for Gen AI risks.

      While Gen AI success will be heavily reliant on the quality of data it is fine-tuned on, there are independent risks organizations must prepare for: from Gen AI hallucinations and output reliability to infrastructure feasibility to handle high-volume events.

      Gen AI use may require changes to sales incentives.

      If you plan to use Gen AI in a commercial setting, review your sales team’s KPIs. They are rewarded for sales velocity; if they are the human-in-the-loop to check for hallucinations, you must change incentives to ensure quality management.

      Prepare for ongoing instability in the Gen AI market.

      If your organization is unsure about where to start with Gen AI, the secure route is to examine what your enterprise providers are offering. Use this as a learning platform to confidently navigate which specialized Gen AI provider will be viable for meeting your use cases.

      Brace for a potential return of on-premises infrastructure to power Gen AI.

      The market trend has been for organizations to move to cloud-based products. Yet, for Gen AI, effective data processing and fine-tuning may call for organizations to invest in on-premises infrastructure (such as more GPUs) to enable their Gen AI to function effectively.

      Info-Tech’s methodology for understanding the Gen AI marketspace

      Phase Steps

      1. Contextualize the Gen AI marketplace

      1. Define Gen AI and its components.
      2. Explore Gen AI trends.
      3. Begin deriving Gen AI initiatives that align with business capabilities.

      2. Prepare for and understand Gen AI platform offerings

      1. Review Gen AI selection best practices and requisites for effective procurement.
      2. Determine evaluative criteria for Gen AI solutions.
      3. Explore Gen AI offerings with enterprise and specialized providers.
      Phase Outcomes
      1. Achieve consensus on Gen AI scope and key Gen AI capabilities.
      2. Identify your readiness to leverage Gen AI applications.
      3. Hand off to Build Your Generative AI Roadmap to complete pre-requisites for selection.
      1. Determine whether deeper data and AI governance is required; if so, hand off to Create an Architecture for AI.
      2. Gain consensus on Gen AI evaluative criteria.
      3. Understand vendor viability.

      Guided Implementation

      Phase 1

      Phase 2

      • Call #1: Discover if Gen AI is right for your organization. Understand what a Gen AI platform is and discover the art of the possible.
      • Call #2: To take advantage of Gen AI, perform a business capabilities analysis to begin deriving Gen AI initiatives.
      • Call #3: Explore whether Gen AI initiatives can be achieved either with incumbent enterprise players or via procurement of specialized solutions.
      • Call #4: Evaluate vendors and perform final due diligence.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      The Gen AI market evaluation process should be broken into segments:

      1. Gen AI market education with this primer
      2. Structured approach to selection
      3. Evaluation and final due diligence

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful"

      Guided Implementation

      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      Workshop

      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting

      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      Software selection engagement

      Five advisory calls over a five-week period to accelerate your selection process

      • Receive expert analyst guidance over five weeks (on average) to select and negotiate software.
      • Save money, align stakeholders, speed up the process, and make better decisions.
      • Use a repeatable, formal methodology to improve your application selection process.
      • Get better, faster results guaranteed, included in membership.
      Software selection process timeline. Week 1: Awareness - 1 hour call, Week 2: Education & Discovery - 1 hour call, Week 3: Evaluation - 1 hour call, Week 4: Selection - 1 hour call, Week 5: Negotiation & Configuration - 1 hour call.

      Click here to book your selection engagement.

      Software selection workshops

      40 hours of advisory assistance delivered online.

      Select better software, faster.

      • 40 hours of expert analyst guidance
      • Project and stakeholder management assistance
      • Save money, align stakeholders, speed up the process, and make better decisions
      • Better, faster results guaranteed; 25K standard engagement fee
      Software selection process timeline. Week 1: Awareness - 5 hours of Assistance, Week 2: Education & Discovery - 10 hours of assistance, Week 3: Evaluation - 10 hours of assistance, Week 4: Selection - 10 hours of assistance, Week 5: Negotiation & Configuration - 10 hours of assistance.

      Click here to book your workshop engagement.

      Collaborate Effectively in Microsoft Teams

      • Buy Link or Shortcode: {j2store}63|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: End-User Computing Applications
      • Parent Category Link: /end-user-computing-applications

      Your organization has adopted Microsoft Teams, but users are not maximizing their use of it.

      • IT needs to support the business to get the best value out of Microsoft Teams: managing Teams effectively while also enabling end users to use Teams creatively.
      • IT must follow best practices for evaluation of new functionality when integrating Microsoft and third-party apps and also communicate changes to end users.
      • Due in part to the frequent addition of new features and lack of communication and training, many organizations don’t know which apps would benefit their users.

      Our Advice

      Critical Insight

      Collaboration is as much an art as a science. IT can help users collaborate more effectively in Teams by removing friction – while still maintaining guardrails – for users attempting to build out and experiment with features and capabilities.

      Impact and Result

      Use Info-Tech’s Collaborate Effectively in Microsoft Teams to help collaboration flourish:

      • Collate key organizational collaboration use cases.
      • Prioritize the most important Teams apps and features to support use cases.
      • Implement request process for new Teams apps.
      • Communicate new Teams collaboration functionality.

      Collaborate Effectively in Microsoft Teams Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Collaborate Effectively in Microsoft Teams Deck – Maximize the use of your chosen collaboration software solution.

      Set up your users for Teams collaboration success. Create a process that improves their ability to access, understand, and maximize their use of your chosen collaboration software solution.

      • Collaborate Effectively in Microsoft Teams Storyboard

      2. Microsoft Teams End-User Satisfaction Survey – Capture end-user feedback on their collaborative use of Microsoft Teams.

      The survey responses will inform your organization's collaboration use cases for Teams and help you to identify which features and apps to enable.

      • Microsoft Teams End-User Satisfaction Survey

      3. Microsoft Teams Planning Tool – A tool to help prioritize features to implement.

      Use this Excel tool to help you document the organization’s key collaboration use cases and prioritize which Teams apps to implement and encourage adoption on.

      • Microsoft Teams Planning Tool
      [infographic]

      Further reading

      Collaborate Effectively in Microsoft Teams

      Empower your users to explore Teams collaboration beyond the basics.

      Analyst Perspective

      Life after Teams implementation

      You have adopted Teams, implemented it, and painted an early picture for your users on the basics. However, your organization is not yet maximizing its use of Teams' collaboration capabilities. Although web conferencing, channel-based collaboration, and chat are the most obvious ways Teams supports collaboration, users must explore Teams' functionality further to harness the application's full potential.

      You should enable your users to expand their collaboration use cases in Teams, but not at the risk of being flooded with app requests, nor user confusion or dissatisfaction. Instead, develop a process to evaluate and integrate new apps that will benefit the organization. Encourage your users to request new apps that will benefit them, while proactively planning for app integration that users should be alerted to.

      Photo of Emily Sugerman, Research Analyst, Infrastructure and Operations, Info-Tech Research Group. Emily Sugerman
      Research Analyst, Infrastructure and Operations
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Your organization has adopted Microsoft Teams, but users are not getting the maximum benefit.

      • IT needs to support the business to get the best value out of Microsoft Teams: managing Teams effectively while enabling end-user creativity.
      • IT must follow best practices for evaluating new functionality when integrating Microsoft and third-party apps, while communicating changes to end users.
      • Due partly to the frequent addition of new features and lack of communication and training, many organizations don't know which apps would benefit their users.

      Common Obstacles

      • Users are unenthusiastic about exploring Teams further due to negative past experiences, preference for other applications, or indifference.
      • End users are unaware of the available range of features. When they become aware and try to add unapproved or unlicensed apps, they experience the frustration of being declined.
      • Users seek support from IT who are unfamiliar with new Teams features an apps, or with supporting Teams beyond the basics.
      • IT teams have no process to raise end-user awareness of these apps and functionality.

      Info-Tech's Approach

      Use Info-Tech's Collaborate Effectively in Microsoft Teams to help collaboration flourish:

      • Collate key organizational collaboration use cases
      • Prioritize the most important Teams apps and features to support use cases
      • Implement request process for new Teams apps
      • Communicate new Teams collaboration functionality

      Info-Tech Insight

      Collaboration is as much an art as a science. IT can help users collaborate more effectively in Teams by removing friction – while still maintaining guardrails – for users attempting to build out and experiment with features and capabilities.

      Are your users in a Teams rut?

      Are users failing to maximize their use of Teams to collaborate and get work done?

      Teams can do much more than chat, video conferencing, and document sharing. A fully-deployed Teams also lets users leverage apps and advanced collaboration features.

      However, IT must create a process for evaluating and approving Microsoft and third-party apps, and for communicating changes to end users.

      In the end, IT needs to support the business to get the best value out of Microsoft Teams: managing Teams effectively while also enabling end-user creativity.

      Third-party app use in Teams is rising:

      “Within Teams, the third-party apps with 10,000 users and above rose nearly 40% year-over-year.”
      Source: UC Today, 2023.

      Collaborate effectively in Microsoft Teams

      Set up your users for Teams collaboration success. Create a process that improves their ability to access, understand, and maximize their use of your chosen collaboration software solution.

      Challenges with Teams collaboration

      • Lack of motivation to explore available features
      • Scattered information
      • Lack of comfort using Teams beyond the basics
      • Blocked apps
      • Overlapping features
      • Confusing permissions

      Empowering Collaboration in Microsoft Teams

      1. Identify current collaboration challenges and use cases in Teams
      2. Create Teams app request workflows
      3. Set up communication hubs in Teams
      4. Empower end users to customize their Teams for effective collaboration

      Solution

      • Collate key organizational collaboration use cases
      • Prioritize the most important Teams apps and features to support use cases
      • Implement request process for new Teams apps
      • Communicate new Teams collaboration functionality

      Project deliverables

      Use these tools to develop your plan to enable effective collaboration in Microsoft Teams.

      Key deliverable:

      Microsoft Teams Planning Tool

      An Excel tool for documenting the organization's key collaboration use cases and prioritizing which Teams apps to implement and encourage adoption of.

      Sample of the Microsoft Teams Planning Tool deliverable.

      Additional support:

      Microsoft Teams End-User Satisfaction Survey

      Use or adapt this survey to capture user perception of how effectively Teams supports collaboration needs.

      Sample of the End-user satisfaction survey deliverable.

      Insight Summary

      Key Insight:

      Collaboration is as much an art as a science. IT can help users collaborate more effectively in Teams by removing friction – while still maintaining guardrails – for users attempting to build out and experiment with features and capabilities.

      Additional insights:

      Insight 1

      Users can browse the Teams app store and attempt to add unapproved apps, but they may not be able to distinguish between available and blocked apps. To avoid a bad user experience, communicate which apps they can add without additional approval and which they will need to send through an approval process.

      Insight 2

      Teams lets you customize the message users see when they request unapproved apps and/or redirect their request to your own URL. Review this step in the request process to ensure users are seeing the instructions that they need to see.

      Insight 3

      A Teams hub is where users can access a service catalog of approved Teams apps and submit service requests for new ones via the Make a Request button.

      Section 1: Collaborating Effectively in Teams for IT

      Section 1

      Collaborating Effectively in Teams for IT

      Section 2

      Collaborating Effectively in Teams for End Users

      Stop: Do you need the Teams Cookbook?

      If you:

      • are at the Teams implementation stage,
      • require IT best practices for initial governance of Teams creation, or
      • require end-user best practices for basic Teams functionality …

      Consult the Microsoft Teams Cookbook first.

      Understand the Microsoft vision of Teams collaboration

      Does it work for you?

      Microsoft's vision for Teams collaboration is to enable end-user freedom. For example, out of the box, users can create their own teams and channels unless IT restricts this ability.

      Teams is meant to be more than just chats and meetings. Microsoft is pushing Teams app integration so that Teams becomes, essentially, a landing page from which users can centralize their work and org updates.

      In partnership with the business, IT must determine which guardrails are necessary to balance end-user collaboration and creativity with the need for governance and control.

      Why is it difficult to increase the caliber of collaboration in Teams?

      Because collaboration is inherently messy, complex, and creative

      Schubert & Glitsch find that enterprise collaboration systems (such as Teams) have characteristics that reflect the unstructured and creative nature of collaboration. These systems “are designed to support joint work among people in the workplace. . . [They] contain, for the most part, unstructured content such as documents, blogs, or news posts,” and their implementations “are often reported to follow a ‘bottom up' and rather experimental introduction approach.” The open-endedness of the tool requires users to be able to creatively and voluntarily apply it, which in turn requires more enterprise effort to help increase adoption over time through trial and error.

      Source: Procedia Computer Science, 2015

      Info-Tech Insight

      Collaboration is as much an art as a science. IT can help users collaborate more effectively in Teams by removing friction – while still maintaining guardrails – for users attempting to build out and experiment with features and capabilities.

      Activity 1: Identify current challenges

      Input: Team input, Survey results
      Output: List of Teams challenges experienced by the organization
      Materials: Whiteboard (digital or physical)
      Participants: Teams collaboration working group

      First, identify what works and what doesn't for your users in Teams

      • Have users reported any challenges with Teams as their primary means of channel-based collaboration? Run a short survey to capture end-user sentiment on how Teams works for them. This survey can be set up and distributed through Microsoft Forms. Distribute either to the whole organization or a specific focus group. Gather feedback from users on the following: What are the major ways they need to collaborate to do their jobs? What IT-supported tools do they need to support this collaboration? What specific aspects of Teams do they want to better exploit?
      • If you send out transactional surveys on service desk tickets, run a report on Teams-related tickets to identify common complaints.
      • Brainstorm Teams challenges IT has experienced personally or have seen reported – especially difficulties with collaboration.
      • Once you have the data, group the challenges into themes. Are the challenges specifically related to collaboration? Data issues? Support issues? Access issues? Technical issues? Document them in tab 2 of the Microsoft Teams Planning Tool.

      Download the Microsoft Teams End-User Satisfaction Survey template

      Define your organization's key collaboration scenarios

      Next, identify what users need to do in Teams

      The term collaboration scenarios has been proposed to describe the types of collaboration behavior your software – in this case, Teams – must support (Schubert & Glitsch, 2015). A successful implementation of this kind of tool requires that you “identif[y] use cases and collaboration scenarios that best suit a specific company and the people working in it” (Schubert & Glitsch, 2016).

      Teams tends to support the following kinds of collaboration and productivity goals (see list).

      What types of collaboration scenarios arise in the user feedback in the previous activity? What do users most need to do?

      Be proactive: Configure Microsoft Teams to match collaboration scenarios/use cases your users must engage in. This will help prevent an increase in shadow IT, where users attempt to bring in unapproved/unreviewed software that might duplicate your existing service catalog and/or circumvent the proper review and procurement process.

      MS Teams Use Cases

      1. Gather feedback
      2. Collaboratively create content
      3. Improve project & task management
      4. Add media content
      5. Conduct knowledge management
      6. Increase meeting effectiveness
      7. Increase employee engagement
      8. Enhance professional development
      9. Provide or access support
      10. Add third-party apps

      Activity 2: Match your collaboration scenarios to Teams capabilities

      Input: Collaboration scenarios, Teams use cases
      Output: Ranked list of Teams features to implement and/or promote
      Materials: Microsoft Teams Planning Tool
      Participants: Teams collaboration working group

      Which features support the key collaboration use cases?

      1. Using the Microsoft Teams Planning Tool, list your organization's key collaboration scenarios. Draw on the data returned in the previous activity. List them in Tab 2.
      2. See the following slide for the types of collaboration use cases Teams is designed to support. In the planning tool, select use cases that best match your organizational collaboration scenarios.
      3. Dive into more specific features on Tab 3, which are categorized by collaboration use case. Where do users' collaboration needs align with Teams' inherent capabilities? Add lines in Tab C for the third-party apps that you are considering adding to Teams.
      4. In columns B and C of Tab 3, decide and prioritize the candidates for implementation. Review the list of prioritized features on tab 4.

      NB: Microsoft has introduced a Teams Premium offering, with additional capabilities for meetings and webinars (including customized banding, meeting watermarks, and virtual webinar green rooms) and will paywall some features previously available without Premium (live caption translations, meeting data on attendee departure/arrival times) (“What is Microsoft Teams Premium?”, n.d.)

      Download the Microsoft Teams Planning Tool

      MS Teams productivity & collab features

      Teams apps & collaboration features enable the following types of work. When designing collaboration use cases, identify which types of collaboration are necessary, then explore each category in depth.

      1. Gather feedback

        Solicit feedback and comments, and provide updates
      2. Collaboratively create content

        Compose as a group, with live-synced changes
      3. Improve project & task management

        Keep track of projects and tasks
      4. Add media content

        Enrich Teams conversations with media, and keep a library of video resources
      5. Knowledge management

        Pull together document libraries and make information easier to find
      6. Increase meeting effectiveness

        Facilitate interactions and document meeting outcomes
      7. Increase employee engagement

        Use features that enhance social interaction among Teams users
      8. Enhance professional development

        Find resources to help achieve professional goals
      9. Provide or access support

        IT and user-facing resources for accessing and/or providing support
      10. Add third-party apps

        Understand the availability/restrictions of the built-in Teams app catalog

      The Teams app store

      • The lure of the app store: Your users will encounter a mix of supported and unsupported applications, some of which they can access, some for which you have no licenses, some built by your organization, some built by Microsoft or third parties. However, the distinction between these categories may not be immediately apparent to users. Microsoft does not remove blocked apps from users' view.
      • Users may attempt to add unsupported apps and then receive error messages or prompts to send a request through Teams to IT for approval.
      • App add-ins are not limited to those built by Microsoft Corporation. The Teams app store also features a plethora of third-party apps that can provide value.
      • However, their third-party status introduces another set of complications.
      • Attempting to add third-party apps may expose users to sales pitches and encourage the implementation of shadow IT, circumventing the IT request process.

      Info-Tech Insight

      Users can browse and attempt to add unapproved apps in the Teams app store, but they may have difficulty distinguishing between available and blocked apps. To avoid a bad user experience, communicate to your users which apps they can add without additional approval, and which must be sent through an approval process.

      Decide how you will evaluate requests for new Teams apps

      • As you encourage users to explore and fully utilize Teams, you may see increased requests for admin approval for apps you do not currently support.
      • To prevent disorganized response and user dissatisfaction, build out a workflow for handling new/unapproved Teams app requests. Ensure the workflow accounts for Microsoft and third-party apps.
      • What must you consider when integrating third-party tools? You must have control over what users may add. These requests should follow, or build upon, your existing process for non-standard requests, including a process for communicating the change.
      • Track the fulfillment time for Teams app requests. The longer the user must wait for a response, the more their satisfaction will decline.

      icrosoft suggests that you regularly review the app usage report in the Teams admin center as “a signal about the demand for an app within your organization.” This will help you proactively determine which apps to evaluate for approval.

      Build request workflow for unsupported Teams apps

      What are the key steps?

      1. Request comes in
      2. Review by a technical review team
      3. Review by service desk or business analyst
      4. Additional operational technical reviews if necessary
      5. Procurement and installation
      6. Communication of result to requester
      7. App added to the catalog so it can be used by others

      Example workflow of a 'Non-Standard Software Request Process'.

      Info-Tech Insight

      Teams allows you to customize the message users see when they request an unapproved app and/or redirect their request to your own URL. Review this step in the request process to ensure your users are seeing the instructions that they need to see.

      Download the Service Request Workflow library

      Incorporate new approved service requests into a service request catalog

      Follow the process in Reduce Shadow IT With a Service Request Catalog to build out a robust request management process and service catalog to continuously incorporate new non-standard requests and advertise new Teams apps:

      • Design the service
      • Design the catalog
      • Build the catalog
      • Market the service

      Sample of the 'Reduce Shadow IT With a Service Request Catalog' blueprint.

      Add a company hub to Teams

      Use Teams to help users access the company intranet for organizational information that is relevant to their roles.

      This can be done in two ways:

      1. By adding a SharePoint home site to Teams.
      2. By leveraging Viva Connections: A hub to access other apps and Viva services. The user sees a personalized dashboard, feed, and resources.

      Venn diagram with two circles 'Viva Connections - App-based employee experience where individuals get their work done' and 'Home Sites - Portal that features organizational news, events, and supplemental resources'. The overlapping middle has a list: 'News, Shared navigation, Integrates with M365, Developer platforms & management, Audience targeting, Web parts, Permissions'. (Venn diagram recreated from Microsoft Learn, 2023.)

      Info-Tech Insight

      The hub is where users can access a service catalog of approved Teams apps and submit service requests for a new one via a Make a Request button.

      Communicate changes to Teams

      Let end users know what's available and how to add new productivity tools.

      Where will users find approved Teams apps? How will you inform people about what's available? Once a new app is available, how is this communicated?

      Options:

      • Communicate new Teams features in high-visibility places (e.g. the Hub).
      • Leverage the Power Apps Bulletins app in Teams to communicate regular announcements about new features.
      • Create a company-wide Team with a channel called “What's New in Teams.” Post updates on new features and integrations, and link to more detailed knowledgebase articles on how to use the new features.
      • Aim for the sweet spot of communication frequency: not too much nor too little.

      Measure your success

      Determine how you will evaluate the success of your efforts to improve the Teams collaboration experience

      Improved satisfaction with Teams: Increased net promoter score (NPS)

      Utilization of features: Increased daily average users on key features, apps, integrations

      Timeliness: % of SLAs met for service request fulfillment

      Improved communication to end users about Teams' functionality: Satisfaction with knowledgebase articles on Teams

      Satisfaction with communication from IT

      Section 2: Collaborating Effectively in Teams for End Users

      Section 1

      Collaborating Effectively in Teams for IT

      Section 2

      Collaborating Effectively in Teams for End Users

      For IT: Use this section to help users understand Teams collaboration features

      Share the collateral in this section with your users to support their deeper exploration of Teams collaboration.

      • Use the Microsoft Teams Planning Tool to prepare a simple service catalog of the features and apps available to your users.
      • Edit Tab 2 (MS Teams Collab Features & Apps) by deleting the blocked apps/features.
      • Share this document with your users by linking to it via this image on the following slides:
      Sample of the Microsoft Teams Planning Tool deliverable.

      Download the Microsoft Teams Planning Tool for an expanded list of features & apps

      End-user customization of Teams

      Consider how you want to set up your Teams view. Add the apps you already use to have them at your fingertips in Teams.

      You can . . .

      1. Customize your navigation bar by pinning your preferred apps and working with them within Teams (Microsoft calls these personal apps).
      2. Customize your message bar by adding the app extensions you find most useful. Screenshot of the message bar with the 3-dot highlighted.
      3. Customize chats and Teams by adding tabs with content your group needs frequent access to. Screenshot of MS Teams tabs with the plus sign highlighted.
      4. Set up connectors to send notifications from apps to a Team and bots to answer questions and automate simple tasks. Screenshot of the 'Set up a connector' button.

      Learn more from Microsoft here

      MS Teams productivity & collab features

      The Apps catalog includes a range of apps that users may add to channels, chat, or the navigation bar. Teams also possesses other collaboration features that may be underused in your organization.

      1. Gather feedback

        Solicit feedback and comments, and provide updates
      2. Collaboratively create content

        Compose as a group, with live-synced changes
      3. Improve project & task management

        Keep track of projects and tasks
      4. Add media content

        Enrich Teams conversations with media, and keep a library of video resources
      5. Knowledge management

        Pull together document libraries and make information easier to find
      6. Increase meeting effectiveness

        Facilitate interactions and document meeting outcomes
      7. Increase employee engagement

        Use features that enhance social interaction among Teams users
      8. Enhance professional development

        Find resources to help achieve professional goals
      9. Provide or access support

        IT and user-facing resources for accessing and/or providing support
      10. Add third-party apps

        Understand the availability/restrictions of the built-in Teams app catalog

      Samples of four features: 'Prioritize with a voting table', 'Launch a live meeting poll', 'Launch a survey', and 'Request an update'.

      Download the Microsoft Teams Collaboration Tool for an expanded list of features & apps

      Use integrated Teams features to gather feedback and provide updates

      • Vote: Create a list of items for teams to brainstorm pros and cons, and then tabulate votes on. This component can be edited inline by anyone with whom the component is shared. The edits will sync anywhere the component is shared.
      • Meeting polls: Capture instant feedback from teams, chat, and call participants. Participant anonymity can be set by the poll organizer. Results can be exported.
      • Create surveys and quizzes and share the results. Results can be exported.
      • Create, track, and review updates and progress reports from teams and individuals.

      Collaboratively create content

      Samples of four features: 'Add Office suite docs', 'Brainstorm in Whiteboard', 'Add Loop components', and 'Take notes in OneNote'.

      Download the Microsoft Teams Planning Tool for an expanded list of features & apps

      Use integrated Teams features composed as a group, with live-synced changes

      • Microsoft Office documents: Add/upload files to a chat or channel discussion. Find them again in the Files tab or add the file itself as a tab to a chat or channel and edit it within Teams.
      • Brainstorm with the Whiteboard application. Add a whiteboard to a tab or to a meeting.
      • Add Loop components to a chat: Create a list, checklist, paragraph, or table that can be edited in real time by anyone in the chat.
      • Add OneNote to a chat or channel tab or use during a meeting to take notes. Pin OneNote to your app bar if it's one of your most frequently-used apps.

      Improve project & task management

      Samples of four features: 'Request approvals and updates', 'Add & track tasks', 'Create a personal notespace', and 'Manage workflows'.

      Download the Microsoft Teams Planning Tool for an expanded list of features & apps

      Keep track of projects and tasks

      • Use the Approvals and Update apps to create, track, and respond to requests for approvals and progress reports within Teams.
      • Use Tasks by Planner & To Do to track both individual and team tasks. Pin the Tasks app to the app bar, add a plan as a tab to a Team, and turn any Teams message into a task by right-clicking on it.
      • Start a chat with yourself to maintain a private space to jot down quick notes.
      • Add Lists to a Teams channel.
      • Explore automation: Add pre-built Teams workflows from the Workflows app, or build new ones in PowerAutomate
      • IT teams may leverage Teams apps like Azure Boards, Pipelines, Repos, AD notifications, and GitHub.

      Add media content

      Samples of four features: 'Share news stories', 'Share YouTube videos', 'Share Stream content', and 'Add RSS feeds'.

      Download the Microsoft Teams Planning Tool for an expanded list of features & apps

      Enrich Teams conversations with media, and keep a library of video resources

      • Search for and add specific news stories to a chat or channel. See recent news stories in search.
      • Search, share, and watch YouTube videos.
      • Share video links from Microsoft Stream.
      • Add RSS feeds.

      Knowledge management

      Samples of four features: 'SharePoint Pages', 'SharePoint document library', 'SharePoint News', and 'Who'.

      Download the Microsoft Teams Planning Tool for an expanded list of features & apps

      Pull together document libraries and make information easier to find

      • Add a page from an existing SharePoint site to a Team as a tab.
      • Add a SharePoint document library to a Team as a tab.
      • Search names of members of your organization to learn about their role, place in the organizational structure, and contact information.

      Increase meeting effectiveness

      Samples of four features: 'Take meeting notes', 'Set up a Q&A', 'Use live captions', and 'Record and transcribe meetings'.

      Download the Microsoft Teams Planning Tool for an expanded list of features & apps

      Facilitate interactions and document meeting outcomes

      • Take simple notes during a meeting.
      • Start conversations and ask and answer questions in a dedicated Q&A space during the Teams meeting.
      • Turn on live captions during the meeting.
      • Record a meeting and automatically generate a transcript of the meeting.
      • Assign attendees to breakout rooms.
      • Track the effectiveness of the meeting by producing an attendance report with the number of attendees, the meeting start/end time, a list of the attendees, and participation in activities.

      Increase employee engagement

      Samples of four features: 'Send praise', 'Build an avatar', 'Add video effects', and 'Play games during meetings'.

      Download the Microsoft Teams Planning Tool for an expanded list of features & apps

      Use features that enhance social interaction among Teams users

      • Send supportive comments to colleagues using Praise.
      • Build out digital avatars to toggle on during meetings instead of your own video.
      • Apply different visual effects, filters, and backgrounds to your screen during meetings.
      • Games for Work: Launch icebreaker games during a meeting.
      • Translate a Teams message from another language to your default language.
      • Send emojis, GIFs, and stickers in messages or as reactions to others' messages. You can also send reactions live during meetings to increase meeting engagement.

      Enhance professional development

      Samples of four features: 'Launch Viva Learning', 'Turn on Speaker Coach', 'Viva Insights', and 'Viva Goals'.

      Download the Microsoft Teams Planning Tool for an expanded list of features & apps

      Connect with learning resources and apply data-driven feedback based on Teams usage

      • Add learning materials from various course catalogs in Viva Learning.
      • Speaker Coach: Receive AI feedback on your performance as a speaker during a meeting.
      • Receive automatically generated insights and suggestions from Viva Insights on work habits and time allocation to different work activities.
      • Viva Goals: Track organizational "objectives and key results"/manage organizational goals

      Provide or access support

      Samples of four features: 'Access MS Support', 'Manage Teams & M365', 'Deploy power virtual agents', and 'Consult MS resource center'.

      Download the Microsoft Teams Planning Tool for an expanded list of features & apps

      IT and user-facing resources for accessing or providing support

      • Admin: Carry out simple Teams management tasks (for IT).
      • Power Virtual Agents: Build out chatbots to answer user questions (can be built by IT and end users for their customers).
      • Resource Center: A combination of pre-built Microsoft resources (tips, templates) with resources provided by organizational IT.
      • Support: Access Microsoft self-serve knowledgebase articles (for IT).

      Add third-party apps

      Understand the availability/restrictions of the built-in Teams app catalog

      • App add-ins are not limited to those built by Microsoft Corporation. The Teams app store also features a plethora of third-party apps that may provide value.
      • However, being able to view an app in the app store does not necessarily mean it's supported or licensed by your organization.
      • Teams will allow users to request access to apps, which will then be evaluated by your IT support team. Follow your service desk's recommended request process for requesting and justifying the addition of a new Teams app that is not currently supported.
      • Before making the request, investigate existing Teams features to determine if the functionality is already available.

      Research contributors

      Mike Cavanagh
      Global Service Desk Manager
      Clearwater Seafoods LP

      Info-Tech contributors:

      Benedict Chang, Senior Advisory Analyst

      John Donovan, Principal Research Director

      Allison Kinnaird, Practice Lead

      P.J. Ryan, Research Director

      Natalie Sansone, Research Director

      Christine West, Managing Partner

      Related Info-Tech Research

      Sample of the 'Reduce Shadow IT with a Service Request Catalog' blueprint.

      Reduce Shadow IT With a Service Request Catalog

      Foster business relationships through sourcing-as-a-service. There is a direct correlation between service delivery dissatisfaction and increases in shadow IT. Whether the goal is to reduce shadow IT or gain control, improved customer service and fast delivery are key to making lasting changes.

      Sample of the 'Microsoft Teams Cookbook' blueprint.

      Microsoft Teams Cookbook

      Recipes for best practices and use cases for Teams. Microsoft Teams is not a standalone app. Successful utilization of Teams occurs when conceived in the broader context of how it integrates with M365. Understanding how information flows between Teams, SharePoint Online, and OneDrive for Business, for instance, will aid governance with permissions, information storage, and file sharing.

      Sample of the 'Govern Office 365 (M365)' blueprint.

      Govern Office 365

      You bought it. Use it right. Map your organizational goals to the administration features available in the Office 365/M365 console. Your governance should reflect your requirements.

      Bibliography

      Mehta, Tejas. “The Home Site App for Microsoft Teams.” Microsoft Community Hub. https://techcommunity.microsoft.com/t5/microsoft-sharepoint-blog/the-home-site-app-for-microsoft-teams/ba-p/1714255.

      Overview: Viva Connections. 7 Mar. 2023, https://learn.microsoft.com/en-us/viva/connections/viva-connections-overview.

      Rogers, Laura. “SharePoint Home Site in Teams.” Wonderlaura, 24 Jun 2021. https://wonderlaura.com/2021/06/24/sharepoint-home...

      Schubert, Petra, and Johannes H. Glitsch. “Adding Structure to Enterprise Collaboration Systems: Identification of Use Cases and Collaboration Scenarios.” Procedia Computer Science, vol. 64, Jan. 2015, pp. 161–69. ScienceDirect, https://doi.org/10.1016/j.procs.2015.08.477.

      Schubert, Petra, and Johannes Glitsch. “Use Cases and Collaboration Scenarios: How Employees Use Socially-Enabled Enterprise Collaboration Systems (ECS).” International Journal of Information Systems and Project Management, vol. 4, no. 2, Jan. 2016, pp. 41–62.

      Thompson, Mark. “User Requests for Blocked Apps in the Teams Store.” Supersimple365, 5 Apr 2022, https://supersimple365.com/user-requests-for-apps-...

      “What is Microsoft Teams Premium?” Breakwater IT, n.d., https://breakwaterit.co.uk/guides/microsoft-teams-...

      Wills, Jonny. “Microsoft Teams Monthly Users Hits 280 Million.” UC Today, 25 Jan. 2023, https://www.uctoday.com/unified-communications/microsoft-teams-monthly-users-hits-280-million/.

      Time Study

      • Buy Link or Shortcode: {j2store}260|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Governance, Risk & Compliance
      • Parent Category Link: /governance-risk-compliance
      • In ESG’s 2018 report “The Life of Cybersecurity Professionals,” 36% of participants expressed the overwhelming workload was a stressful aspect of their job.
      • Organizations expect a lot from their security specialists. From monitoring the threat environment, protecting business assets, and learning new tools, to keeping up with IT initiatives, cybersecurity teams struggle to balance their responsibilities with the constant emergencies and disruptions that take them away from their primary tasks.
      • Businesses fail to recognize the challenges associated with task prioritization and the time management practices of a security professional.

      Our Advice

      Critical Insight

      • The majority of scheduled calendar meetings include employees and peers.
        • Our research indicates cybersecurity professionals spent the majority of their meetings with employees (28%) and peers (24%). Other stakeholders involved in meetings included by myself (15%), boss (13%), customers (10%), vendors (8%), and board of directors (2%).
      • Calendar meetings are focused on project work, management, and operations.
        • When asked to categorize calendar meetings, the focus was on project work (26%), management (23%), and operations (22%). Other scheduled meetings included ones focused on strategy (15%), innovation (9%), and personal time (5%).
      • Time management scores were influenced by the percentage of time spent with employees and peers.
        • When participants were divided into good and poor time managers, we found good time managers spent less time with their peers and more time with their employees. This may be due to the nature of employee meetings being more directly tied to the project outputs of the manager than their peer meetings. Managers who spend more time in meetings with their employees feel a sense of accomplishment, and hence rate themselves higher in time management.

      Impact and Result

      • Understand how cybersecurity professionals allocate their time.
      • Gain insight on whether perceived time management skills are associated with calendar maintenance factors.
      • Identify common time management pain points among cybersecurity professionals.
      • Identify current strategies cybersecurity professionals use to manage their time.

      Time Study Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Read our Time Study

      Read our Time Study to understand how cybersecurity professionals allocate their time, what pain points they endure, and tactics that can be leveraged to better manage time.

      • Time Study Storyboard
      [infographic]

      Prepare for the Upgrade to Windows 11

      • Buy Link or Shortcode: {j2store}166|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: End-User Computing Devices
      • Parent Category Link: /end-user-computing-devices
      • Windows 10 is going EOL in 2025.That is closer than you think.
      • Many of your endpoints are not eligible for the Windows 11 upgrade. You can’t afford to replace all your endpoints this year. How do you manage this Microsoft initiated catastrophe?
      • You want to stay close to the leading edge of technology and services, but how do you do that while keeping your spending in check and within budget?

      Our Advice

      Critical Insight

      Windows 11 is a step forward in security, which is one of the primary reasons for the release of the new operating system. Windows 11 comes with a list of hardware requirements that enable the use of tools and features that, when combined, will reduce malware infections.

      Impact and Result

      Windows 11 hardware requirements will result in devices that are not eligible for the upgrade. Companies will be left to spend money on replacement devices. Following the Info-Tech guidance will help clients properly budget for hardware replacements before Windows 10 is no longer supported by Microsoft. Eligible devices can be upgraded, but Info-Tech guidance can help clients properly plan the upgrade using the upgrade ring approach.

      Prepare for the Upgrade to Windows 11 Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Prepare for the Upgrade to Windows 11 Deck – A look into some of the pros and cons of Microsoft’s latest desktop operating system, along with guidance on moving forward with this inevitable upgrade.

      Discover the reason for the release of Windows 11, what you require to be eligible for the upgrade, what features were added or updated, and what features were removed. Our guidance will assist you with a planned and controlled rollout of the Windows 11 upgrade. We also provide guidance on how to approach a device refresh plan if some devices are not eligible for Windows 11. The upgrade is inevitable, but you have time, and you have options.

      • Prepare for the Upgrade to Windows 11 Storyboard

      2. What Are My Options If My Devices Cannot Upgrade to Windows 11? – Build a Windows 11 Device Replacement budget with our Hardware Asset Management Budgeting Tool.

      This tool will help you budget for a hardware asset refresh and to adjust the budget as necessary to accommodate any unexpected changes. The tool can easily be modified to assist in developing and justifying the budget for hardware assets for a Windows 11 project. Follow the instructions on each tab and feel free to play with the HAM budgeting tool to fit your needs.

      • HAM Budgeting Tool
      [infographic]

      Further reading

      Prepare for the Upgrade to Windows 11

      The upgrade is inevitable, but you have time, and you have options.

      Analyst Perspective

      Upgrading to Windows 11 is easy, and while it should be properly investigated and planned, it should absolutely be an activity you undertake.

      “You hear that Mr. Anderson? That is the sound of inevitability.” ("The Matrix Quotes" )

      The fictitious Agent Smith uttered those words to Keanu Reeves’ character, Neo, in The Matrix in 1999, and while Agent Smith was using them in a very sinister and figurative context, the words could just as easily be applied to the concept of upgrading to the Windows 11 operating system from Microsoft in 2022.

      There have been two common, recurring themes in the media since late 2019. One is the global pandemic and the other is cyber-related crime. Microsoft is not in a position to make an impact on a novel coronavirus, but it does have the global market reach to influence end-user technology and it appears that it has done just that. Windows 11 is a step forward in endpoint security and functionality. It also solidifies the foundation for future innovations in end-user operating systems and how they are delivered. Windows-as-a-Service (WAAS) is the way forward for Microsoft. Windows 10 is living on borrowed time, with a defined end of support date of October 14, 2025. Upgrading to Windows 11 is easy, and while it should be properly investigated and planned, it should absolutely be an activity you undertake.

      It is inevitable!

      P.J. Ryan

      Research Director, Infrastructure & Operations

      Info-Tech Research Group

      Executive Summary

      Your Challenge

      • Windows 10 is going EOL in 2025. That is closer than you think.
      • Many of your endpoints are not eligible for the Windows 11 upgrade. You can’t afford to replace all your endpoints this year. How do you manage this Microsoft-initiated catastrophe?
      • You want to stay close to the leading edge of technology and services, but how do you do that while keeping your spending in check and within budget?

      Common Obstacles

      • The difference between Windows 10 and Windows 11 is not clear. Windows 11 looks like Windows 10 with some minor changes, mostly cosmetic. Many online users don’t see the need. Why upgrade? What are the benefits?
      • The cost of upgrading devices just to be eligible for Windows 11 is high.
      • Your end users don’t like change. This is not going to go over well!

      Info-Tech's Approach

      • Spend wisely. Space out your endpoint replacements and upgrades over several years. You do not have to upgrade everything right away.
      • Be patient. Windows 11 contained some bugs when it was initially released. Microsoft fixed most of the issues through monthly quality updates, but you should ensure that you are comfortable with the current level of functionality before you upgrade.
      • Use the upgrade ring approach. Test your applications with a small group first, and then stage the rollout to increasingly larger groups over time.

      Info-Tech Insight

      There is a lot of talk about Windows 11, but this is only an operating system upgrade, and it is not a major one. Understand what is new, what is added, and what is missing. Check your devices to determine how many are eligible and ineligible. Many organizations will have to spend capital on endpoint upgrades. Solid asset management practices will help.

      Insight summary

      Windows 11 is a step forward in security, which is one of the primary reasons for the release of the new operating system.

      Windows 11 comes with a list of hardware requirements that enable the use of tools and features that, when combined, will reduce malware infections.

      The hardware requirements for Windows 11 enable security features such as password-less logon, disk encryption, increased startup protection with secure boot, and virtualization-based security.

      Many organizations will have to spend capital on endpoint upgrades.

      Microsoft now insists that modern hardware is required for Windows 11 for not only security but also for improved stability. That same hardware requirement will mean that many devices that are only three or four years old (as well as older ones) may not be eligible for Windows 11.

      Windows 11 is a virtualization challenge for some providers.

      The hardware requirements for physical devices are also required for virtual devices. The TPM module appears to be the biggest challenge. Oracle VirtualBox and Citrix Hypervisor as well as AWS and Google are unable to support Windows 11 virtual devices as of the time of writing.

      Windows 10 will be supported by Microsoft until October 2025.

      That will remove some of the pressure felt due to the ineligibility of many devices and the need to refresh them. Take your time and plan it out, keeping within budget constraints. Use the upgrade ring approach for systems that are eligible for the Windows 11 upgrade.

      New look and feel, and a center screen taskbar.

      Corners are rounded, some controls look a little different, but overall Windows 11 is not a dramatic shift from Windows 10. It is easier to navigate and find features. Oh, and yes, the taskbar (and start button) is shifted to the center of the screen, but you can move them back to the left if desired.

      The education industry gets extra attention with the release of Windows 11.

      Windows 11 comes with multiple subscription-based education offerings, but it also now includes a new lightweight SE edition that is intended for the K-8 age group. Microsoft also released a Windows 11 Education SE specific laptop, at a very attractive price point. Other manufacturers also offer Windows 11 SE focused devices.

      Why Windows 11?

      Windows 10 was supposed to be the final desktop OS from Microsoft, wasn’t it?

      Maybe. It depends who you ask.

      Jerry Nixon, a Microsoft developer evangelist, gained notoriety when he uttered these words while at a Microsoft presentation as part of Microsoft Ignite in 2015: “Right now we’re releasing Windows 10, and because Windows 10 is the last version of Windows, we’re all still working on Windows 10,” (Hachman). Microsoft never officially made that statement. Interestingly enough, it never denied the comments made by Jerry Nixon either.

      Perhaps Microsoft released a new operating system as a financial grab, a way to make significant revenue?

      Nope.

      Windows 11 is a free upgrade or is included with any new computer purchase.

      Market share challenges?

      Doubtful.

      It’s true that Microsoft's market share of desktop operating systems is dropping while Apple OS X and Google Chrome OS are rising.

      In fact, Microsoft has relinquished over 13% of the market share since 2012 and Apple has almost doubled its market share. BUT:

      Microsoft is still holding 75.12% of the market while Apple is in the number 2 spot with 14.93% (gs.statcounter.com).

      The market share is worth noting for Microsoft but it hardly warrants a new operating system.

      New look and feel?

      Unlikely

      New start button and taskbar orientation, new search window, rounded corners, new visual look on some controls like the volume bar, new startup sound, new Windows logo, – all minor changes. Updates could achieve the same result.

      Security?

      Likely the main reason.

      Windows 11 comes with a list of hardware requirements that enable the use of tools and features that, when combined, will reduce malware infections.

      The hardware requirements for Windows 11 enable security features such as password-less logon, disk encryption, increased startup protection with secure boot, and virtualization-based security.

      The features are available on all Windows 11 physical devices, due to the common hardware requirements.

      Windows 11 hardware-based security

      These hardware options and features were available in Windows 10 but not enforced. With Windows 11, they are no longer optional. Below is a description and explanation of the main features.

      Feature What it is How it works
      TPM 2.0 (Trusted Platform Module) Chip TPM is a chip on the motherboard of the computer. It is used to store encryption keys, certificates, and passwords. TPM does this securely with tamper-proof prevention. It can also generate encryption keys and it includes its own unique encryption key that cannot be altered (helpdeskgeek.com). You do not need to enter your password once you setup Windows Hello, so the password is no longer easy to capture and steal. It is set up on a device per device basis, meaning if you go to a different device to sign in, your Windows Hello authentication will not follow you and you must set up your Hello pin or facial recognition again on that particular device. TPM (Trusted Platform Module) can store the credentials used by Windows Hello and encrypt them on the module.
      Windows Hello Windows Hello is an alternative to using a password for authentication. Users can use a pin, a fingerprint, or facial recognition to authenticate.
      Device Encryption Device encryption is only on when your device is off. It scrambles the data on your disk to make it unreadable unless you have the key to unscramble it. If your endpoint is stolen, the contents of the hard drive will remain encrypted and cannot be accessed by anyone unless they can properly authenticate on the device and allow the system to unscramble the encrypted data.
      UEFI Secure Boot Capable UEFI is an acronym for Unified Extensible Firmware Interface. It is an interface between the operating system and the computer firmware. Secure Boot, as part of the firmware interface, ensures that only unchangeable and approved software and drivers are loaded at startup and not any malware that may have infiltrated the system (Lumunge). UEFI, with Secure Boot, references a database containing keys and signatures of drivers and runtime code that is approved as well as forbidden. It will not let the system boot up unless the signature of the driver or run-time code that is trying to execute is approved. This UEFI Secure boot recognition process continues until control is handed over to the operating system.
      Virtualization Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) VBS is security based on virtualization capabilities. It uses the virtualization features of the Windows operating system, specifically the Hyper-V hypervisor, to create and isolate a small chunk of memory that is isolated from the operating system. HVCI checks the integrity of code for violations. The Code Integrity check happens in the isolated virtual area of memory protected by the hypervisor, hence the acronym HVCI (Hypervisor Protected Code Integrity) (Murtaza). In the secure, isolated region of memory created by VBS with the hypervisor, Windows will run checks on the integrity of the code that runs various processes. The isolation protects the stored item from tampering by malware and similar threats. If they run incident free, they are released to the operating system and can run in the standard memory space. If issues are detected, the code will not be released, nor will it run in the standard memory space of the operating system, and damage or compromise will be prevented.

      How do all the hardware-based security features work?

      This scenario explains how a standard boot up and login should happen.

      You turn on your computer. Secure Boot authorizes the processes and UEFI hands over control to the operating system. Windows Hello works with TPM and uses a pin to authenticate the user and the operating systems gives you access to the Windows environment.

      Now imagine the same process with various compromised scenarios.

      You turn on your computer. Secure Boot does not recognize the signature presented to it by the second process in the boot sequence. You will be presented with a “Secure Boot Violation” message and an option to reboot. Your computer remains protected.

      You boot up and get past the secure boot process and UEFI passes control over to the Windows 11 operating system. Windows Hello asks for your pin, but you cannot remember the pin and incorrectly enter it three times before admitting temporary defeat. Windows Hello did not find a matching pin on the TPM and will not let you proceed. You cannot log in but in the eyes of the operating system, it has prevented an unauthorized login attempt.

      You power up your computer, log in without issue, and go about your morning routine of checking email, etc. You are not aware that malware has infiltrated your system and modified a page in system memory to run code and access the operating system kernel. VBS and HVCI check the integrity of that code and detect that it is malicious. The code remains isolated and prevented from running, protecting your system.

      TPM, Hello, UEFI with Secure Boot, VBS and HVCI all work together like a well-oiled machine.

      “Microsoft's rationale for Windows 11's strict official support requirements – including Secure Boot, a TPM 2.0 module, and virtualization support – has always been centered on security rather than raw performance.” – Andrew Cunningham, arstechnica.com

      “Windows 11 raises the bar for security by requiring hardware that can enable protections like Windows Hello, Device Encryption, virtualization-based security (VBS), hypervisor-protected code integrity (HVCI), and Secure Boot. These features in combination have been shown to reduce malware by 60% on tested devices.” – Steven J. Vaughan-Nichols, Computerworld

      Can any device upgrade to Windows 11?

      In addition to the security-related hardware requirements listed previously, which may exclude some devices from Windows 11 eligibility, Windows 11 also has a minimum requirement for other hardware components.

      Windows 7 and Windows 10 were publicized as being backward compatible and almost any hardware would be able to run those operating systems. That changed with Windows 11. Microsoft now insists that modern hardware is required for Windows 11 for not only security but also improved stability.

      Software Requirement

      You must be running Windows 10 version 2004 or greater to be eligible for a Windows 11 upgrade (“Windows 11 Requirements”).

      Complete hardware requirements for Windows 11

      • 1 GHz (or faster) compatible 64-bit processor with two or more cores
      • 4 GB RAM
      • 64 GB or more of storage space
      • Compatible with DirectX 12 or later with WDDM 2.0 driver
        • DirectX connects the hardware in your computer with Windows. It allows software to display graphics using the video card or play audio, as long as that software is DirectX compatible. Windows 11 requires version 12 (“What are DirectX 12 compatible graphics”).
        • WDDM is an acronym for Windows Display Driver Model. WDDM is the architecture for the graphics driver for Windows (“Windows Display Driver Model”).
        • Version 2.0 of WDDM is required for Windows 11.
      • 720p display greater than 9" diagonally with 8 bits per color channel
      • UEFI Secure Boot capable
      • TPM 2.0 chip
      • (“Windows 11 Requirements”)

      Windows 11 may challenge your virtual environment

      When Windows 11 was initially released, some IT administrators experienced issues when trying to install or upgrade to Windows 11 in the virtual world.

      The Challenge

      The issues appeared to be centered around the Windows 11 hardware requirements, which must be detected by the Windows 11 pre-install check before the operating system will install.

      The TPM 2.0 chip requirement was indeed a challenge and not offered as a configuration option with Citrix Hypervisor, the free VMware Workstation Player or Oracle VM VirtualBox when Windows 11 was released in October 2021, although it is on the roadmap for Oracle and Citrix Hypervisor. VMware provides alternative products to the free Workstation Player that do support a virtual TPM. Oracle and Citrix reported that the feature would be available in the future and Windows 11 would work on their platforms.

      Short-Term Solutions

      VMware and Microsoft users can add a vTPM hardware type when configuring a virtual Windows 11 machine. Microsoft Azure does offer Windows 11 as an option as a virtual desktop. Citrix Desktop-As-A-Service (DAAS) will connect to Azure, AWS, or Google Cloud and is only limited by the features of the hosting cloud service provider.

      Additional Insight

      According to Microsoft, any VM running Windows 11 must meet the following requirements (“Virtual Machine Support”):

      • It must be a generation 2 VM, and upgrading a generation 1 VM to Windows 11 (in-place) is not possible
      • 64 GB of storage or greater
      • Secure Boot capable with the virtual TPM enabled
      • 4 GB of memory or greater
      • 2 or more virtual processors
      • The CPU of the physical computer that is hosting the VM must meet the Windows 11 (“Windows Processor Requirements”)

      What’s new or updated in Windows 11?

      The following two slides highlight some of the new and updated features in Windows 11.

      Security

      The most important change with Windows 11 is what you cannot see – the security. Windows 11 adds requirements and controls to make the user and device more secure, as described in previous slides.

      Taskbar

      The most prominent change in relation to the look and feel of Windows 11 is the shifting of the taskbar (and Start button) to the center of the screen. Some users may find this more convenient but if you do not and prefer the taskbar and start button back on the left of your screen, you can change it in taskbar settings.

      Updated Apps

      Paint, Photos, Notepad, Media Player, Mail, and other standard Windows apps have been updated with a new look and in some cases minor enhancements.

      User Interface

      The first change users will notice after logging in to Windows 11 is the new user interface – the look and feel. You may not notice the additional colors added to the Windows palette, but you may have thought that the startup sound was different, and the logo also looks different. You would be correct. Other look-and-feel items that changed include the rounded corners on windows, slightly different icons, new wallpapers, and controls for volume and brightness are now a slide bar. File explorer and the settings app also have a new look.

      Microsoft Teams

      Microsoft Teams is now installed on the taskbar by default. Note that this is for a personal Microsoft account only. Teams for Work or School will have to be installed separately if you are using a work or school account.

      What’s new or updated in Windows 11?

      Snap Layouts

      Snap layouts have been enhanced and snap group functionality has been added. This will allow you to quickly snap one window to the side of the screen and open other Windows in the other side. This feature can be accessed by dragging the window you wish to snap to the left or right edge of the screen. The window should then automatically resize to occupy that half of the screen and allow you to select other Windows that are already open to occupy the remaining space on the screen. You can also hover your mouse over the maximize button in the upper right-hand corner of the window. A small screen with multiple snap layouts will appear for your selection. Multiple snapped Windows can be saved as a “Snap Group” that will open together if one of the group windows are snapped in the future.

      Widgets

      Widgets are expanding. Microsoft started the re-introduction of widgets in Windows 10, specifically focusing on the weather. Widgets now include other services such as news, sports, stock prices, and others.

      Android Apps

      Android apps can now run in Windows 11. You will have to use the Amazon store to access and install Android apps, but if it is available in the Amazon store, you can install it on Windows 11.

      Docking

      Docking has improved with Windows 11. Windows knows when you are docked and will minimize apps when you undock so they are not lost. They will appear automatically when you dock again.

      This is not intended to be an inclusive list but does cover some of the more prominent features.

      What’s missing from Windows 11?

      The following features are no longer found in Windows 11:

      • Backward compatibility
        • The introduction of the hardware requirements for Windows 11 removed the backward compatibility (from a hardware perspective) that made the transition from previous versions of Windows to their successor less of a hardware concern. If a computer could run Windows 7, then it could also run Windows 10. That does not automatically mean it can also run Windows 11.
      • Internet Explorer
        • Internet Explorer is no longer installed by default in Windows 11. Microsoft Edge is now the default browser for Windows. Other browsers can also be installed if preferred.
      • Tablet mode
        • Windows 11 does not have a "tablet" mode, but the operating system will maximize the active window and add more space between icons to make selecting them easier if the 2-in-1 hardware detects that you wish to use the device as a tablet (keyboard detached or device opened up beyond 180 degrees, etc.).
      • Semi-annual updates
        • It may take six months or more to realize that semi-annual feature updates are missing. Microsoft moved to an annual feature update schema but continued with monthly quality updates with Windows 11.
      • Specific apps
        • Several applications have been removed (but can be manually added from the Microsoft Store by the user). They include:
          • OneNote for Windows 10
          • 3D Viewer
          • Paint 3D
          • Skype
      • Cortana (by default)
        • Cortana is missing from Windows 11. It is installed but not enabled by default. Users can turn it on if desired.

      Microsoft included a complete list of features that have been removed or deprecated with Windows 11, which can be found here Windows 11 Specs and System Requirements.

      Windows 11 editions

      • Windows 11 is offered in several editions:
        • Windows 11 Home
        • Windows 11 Pro
        • Windows 11 Pro for Workstations
        • Windows 11 Enterprise Windows 11 for Education
        • Windows 11 SE for Education
      • Windows 11 hardware requirements and security features are common throughout all editions.
      • The new look and feel along with all the features mentioned previously are common to all editions as well.
      • Windows Home
        • Standard offering for home users
      • Pro versus Pro for Workstations
        • Windows 11 Pro and Pro for Workstations are both well suited for the business environment with available features such as support for Active Directory or Azure Active Directory, Windows Autopilot, OneDrive for Business, etc.
        • Windows Pro for Workstations is designed for increased demands on the hardware with the higher memory limits (2 TB vs. 6 TB) and processor count (2 CPU vs. 4 CPU).
        • Windows Pro for Workstations also features Resilient File System, Persistent Memory, and SMB Direct. Neither of these features are available in the Windows 11 Pro edition.
        • Windows 11 Pro and Pro for Workstations are both very business focused, although Pro may also be a common choice for non-business users (Home and Education).
      • Enterprise Offerings
        • Enterprise licenses are subscription based and are part of the Microsoft 365 suite of offerings.
        • Windows 11 Enterprise is Windows 11 Pro with some additional addons and functionality in areas such as device management, collaboration, and security services.
        • The level of the Microsoft 365 Enterprise subscription (E3 or E5) would dictate the additional features and functionality, such as the complete Microsoft Defender for Endpoint suite or the Microsoft phone system and Audio Conferencing, which are only available with the E5 subscription.

      Windows 11 Education Editions

      With the release of a laptop targeted specifically at the education market, Microsoft must be taking notice of the Google Chrome educational market penetration, especially with headlines like these.

      “40 Million Chromebooks in Use in Education” (Thurrott)

      “The Unprecedented Growth of the Chromebook Education Market Share” (Carklin)

      “Chromebooks Gain Market Share as Education Goes Online” (Hruska)

      “Chromebooks Gain Share of Education Market Despite Shortages” (Mandaro)

      “Chromebook sales skyrocketed in Q3 2020 with online education fueling demand” (Duke)

      • Education licenses are subscription based and are part of the Microsoft 365 suite of offerings. Educational pricing is one benefit of the Microsoft 365 Education model.
      • Windows 11 Education is Windows 11 Pro with some additional addons and functionality similar to the Enterprise offerings for Windows 11 in areas such as device management, collaboration, and security services. Windows 11 Education also adds some education specific settings such as Classroom Tools, which allow institutions to add new students and their devices to their own environment with fewer issues, and includes OneNote Class Notebook, Set Up School PCs app, and Take a Test app.
      • The level of the Microsoft 365 Education subscription (A3 or A5) would dictate the additional features and functionality, such as the complete Microsoft Defender for Endpoint suite or the Microsoft phone system and Audio Conferencing, which are only available with the A5 subscription.
      • Windows 11 SE for Education:
        • A cloud-first edition of Windows 11 specifically designed for the K-8 education market.
        • Windows 11 SE is a light version of Windows 11 that is designed to run on entry-level devices with better performance and security on that hardware.
        • Windows 11 SE requires Intune for Education and only IT admins can install applications.
      • Microsoft and others have come out with Windows SE specific devices at a low price point.
        • The Microsoft Surface Laptop SE comes pre-loaded with Windows 11 SE and can be purchased for US$249.00.
        • Dell, Asus, Acer, Lenovo, and others also offer Windows 11 SE specific devices (“Devices for Education”).

      Initial Reactions

      Below you can find some actual initial reactions to Windows 11.

      Initial reactions are mixed, as is to be expected with any new release of an operating system. The look and feel is new, but it is not a huge departure from the Windows 10 look and feel. Some new features are well received such as the snap feature.

      The shift of the taskbar (and start button) is the most popular topic of discussion online when it comes to Windows 11 reactions. Some love it and some do not. The best part about the shift of the taskbar is that you can adjust it in settings and move it back to its original location.

      The best thing about reactions is that they garner attention, and thanks in part to all the online reactions and comments, Microsoft is continually improving Windows 11 through quality updates and annual feature releases.

      “My 91-year-old Mum has found it easy!” Binns, Paul ITRG

      “It mostly looks quite nice and runs well.” Jmbpiano, Reddit user

      “It makes me feel more like a Mac user.” Chang, Ben Info-Tech

      “At its core, Windows 11 appears to be just Windows 10 with a fresh coat of paint splashed all over it.” Rouse, Rick RicksDailyTips.com

      “Love that I can snap between different page orientations.” Roberts, Jeremy Info-Tech

      “I finally feel like Microsoft is back on track again.” Jawed, Usama Neowin

      “A few of the things that seemed like issues at first have either turned out not to be or have been fixed with patches.” Jmbpiano, Reddit user

      “The new interface is genuinely intuitive, well-designed, and colorful.” House, Brett AnandTech

      “No issues. Have it out on about 50 stations.” Sandrews1313, Reddit User

      “The most striking change is to the Start menu.” Grabham, Dan pocket-lint.com

      How do I upgrade to Windows 11?

      The process is very similar to applying updates in Windows 10.

      • Windows 11 is offered as an upgrade through the standard Windows 10 update procedure. Windows Update will notify you when the Windows 11 upgrade is ready (assuming your device is eligible for Windows 11).
        • Allow the update (upgrade in this case) to proceed, reboot, and your endpoint will come back to life with Windows 11 installed and ready for you.
      • A fresh install can be delivered by downloading the required Windows 11 installation media from the Microsoft Software Download site for Windows 11.
      • Business users can control the timing and schedule of the Windows 11 rollout to corporate endpoints using Microsoft solutions such as WSUS, Configuration Manager, Intune and Endpoint Manager, or by using other endpoint management solutions.
      • WSUS and Configuration Manager will have to sync the product category for Windows 11 to manage the deployment.
      • Windows Update for Business policies will have to use the target version capability rather than using the feature update referrals alone.
      • Organizations using Intune and a Microsoft 365 E3 license will be able to use the Feature Update Deployments page to select Windows 11.
      • Other modern endpoint management solutions may also allow for a controlled deployment.

      Info-Tech Insight

      The upgrade itself may be a simple process but be prepared for the end-user reactions that will follow. Some will love it but others will despise it. It is not an optional upgrade in the long run, so everyone will have to learn to accept it.

      When can I upgrade to Windows 11?

      You can upgrade right now BUT there is no need to rush. Windows 11 was released in October 2021 but that doesn’t mean you have to upgrade everyone right away. Plan this out.

      • Build deployment rings into your Windows 11 upgrade approach: This approach, also referred to as Canary Releases or deployment rings, allows you to ensure that IT can support users if there's a major problem with the upgrade. Instead of disrupting all end users, you are only disrupting a portion of end users.
        • Deploy the initial update to your test environment.
        • After testing is successful or changes have been made, deploy Windows 11 to your pilot group of users.
        • After the pilot group gives you the thumbs up, deploy to the rest of production in phases. Phases are sometimes by office/location, sometimes by department, sometimes by persona (i.e. defer people that don't handle updates well), and usually by a combination of these factors.
        • Increase the size of each ring as you progress.
      • Always back up your data before any upgrade.

      Deployment Ring Example

      Pilot Ring - Individuals from all departments - 10 users

      Ring #1 - Dev, Finance - 20 Users

      Ring #2 - Research - 100 Users

      Ring #3 - Sales, IT, Marketing - 500 Users

      Upgrade your eligible devices and users to Windows 11

      Build Windows 11 Deployment Rings

      Instructions:

      1. Identify who will be in the pilot group. Use individuals instead of user groups.
      2. Identify how many standard rings you need. This number will be based on the total number of employees per office.
      3. Map groups to rings. Define which user groups will be in each ring.
      4. Allow some time to elapse between upgrades. Allow the first group to work with Windows 11 and identify any potential issues that may arise before upgrading the next group.
      5. Track and communicate. Record all information into a spreadsheet like the one on the right. This will aid in communication and tracking.
      Ring Department or Group Total Users Delay Time Before Next Group
      Pilot Ring Individuals from all departments 10 Three weeks
      Ring 1 Dev Finance 20 Two weeks
      Ring 2 Research 100 One week
      Ring 3 Sales, IT Marketing 500 N/A

      What are my options if my devices cannot upgrade to Windows 11?

      Don’t rush out to replace all the ineligible endpoint devices. You have some time to plan this out. Windows 10 will be available and supported by Microsoft until October 2025.

      Use asset management strategies and budget techniques in your Windows 11 upgrade approach:

      • Start with current inventory and determine which devices will not be eligible for upgrade to Windows 11.
      • Prioritize the devices for replacement, taking device age, the role of the user the device supports, and delivery times for remote users into consideration.
      • Take this opportunity to review overall device offerings and end-user compute strategy. This will help decide which devices to offer going forward while improving end-user satisfaction.
      • Determine the cost for replacement devices:
        • Compare vendor offerings using an RFP process.
      • Use the hardware asset management planning spreadsheet on the next slide to budget for the replacements over the coming months leading up to October 2025.

      Leverage Info-Tech research to improve your end-user computing strategy and hardware asset management processes:

      New to End User Computing Strategies? Start with Modernize and Transform Your End-User Computing Strategy.

      New to IT asset management? Use Info-Tech’s Implement Hardware Asset Management blueprint.

      Use Info-Tech’s HAM Budgeting Tool to plan your hardware asset budget

      Build a Windows 11 Device Replacement Budget

      The link below will open up a hardware asset management (HAM) budgeting tool. This tool can easily be modified to assist in developing and justifying the budget for hardware assets for the Windows 11 project. The tool will allow you to budget for hardware asset refresh and to adjust the budget as needed to accommodate any changes. Follow the instructions on each tab to complete the tool.

      A sample of a possible Windows 11 budgeting spreadsheet is shown on the right, but feel free to play with the HAM budgeting tool to fit your needs.

      HAM Budgeting Tool

      Windows 11 Replacement Schedule
      2022 2023 2024 2025
      Department Total to replace Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Left to allocate
      Finance 120 20 20 20 10 10 20 20 0
      HR 28 15 13 0
      IT 30 15 15 0
      Research 58 8 15 5 20 5 5 0
      Planning 80 10 15 15 10 15 15 0
      Other 160 5 30 5 15 15 30 30 30 0
      Totals 476 35 38 35 35 35 35 38 35 50 35 35 35 35 0

      Related Info-Tech Research

      Modernize and Transform Your End-User Computing Strategy

      This project helps support the workforce of the future by answering the following questions: What types of computing devices, provisioning models, and operating systems should be offered to end users? How will IT support devices? What are the policies and governance surrounding how devices are used? What actions are we taking and when? How do end-user devices support larger corporate priorities and strategies?

      Implement Hardware Asset Management

      This project will help you analyze the current state of your HAM program, define assets that will need to be managed, and build and involve the ITAM team from the beginning to help embed the change. It will also help you define standard policies, processes, and procedures for each stage of the hardware asset lifecycle, from procurement through to disposal.

      Bibliography

      aczechowski, et al. “Windows 11 Requirements.” Microsoft, 3 June 2022. Accessed 13 June 2022.

      Binns, Paul. Personal interview. 07 June 2022.

      Butler, Sydney. “What Is Trusted Platform Module (TPM) and How Does It Work?” Help Desk Geek, 5 August 2021. Accessed 18 May 2022.

      Carklin, Nicolette. “The Unprecedented Growth of the Chromebook Education Market Share.” Parallels International GmbH, 26 October 2021. Accessed 19 May 2022.

      Chang, Ben. Personal interview. 26 May 2022.

      Cunningham, Andrew. “Why Windows 11 has such strict hardware requirements, according to Microsoft.” Ars Technica, 27 August 2021. Accessed 19 May 2022.

      Dealnd-Han, et al. “Windows Processor Requirements.” Microsoft, 9 May 2022. Accessed 18 May 2022.

      “Desktop Operating Systems Market Share Worldwide.” Statcounter Globalstats, June 2021–June 2022. Accessed 17 May 2022.

      “Devices for education.” Microsoft, 2022. Accessed 13 June 2022.

      Duke, Kent. “Chromebook sales skyrocketed in Q3 2020 with online education fueling demand.” Android Police, 16 November 2020. Accessed 18 May 2022.

      Grabham, Dan. “Windows 11 first impressions: Our initial thoughts on using Microsoft's new OS.” Pocket-Lint, 24 June 2021. Accessed 3 June 2022.

      Hachman, Mark. “Why is there a Windows 11 if Windows 10 is the last Windows?” PCWorld, 18 June 2021. Accessed 17 May 2022.

      Howse, Brett. “What to Expect with Windows 11: A Day One Hands-On.” Anandtech, 16 November 2020. Accessed 3 June 2022.

      Hruska, Joel. “Chromebooks Gain Market Share as Education Goes Online.” Extremetech, 26 October 2020. Accessed 19 May 2022.

      Jawed, Usama. “I am finally excited about Windows 11 again.” Neowin, 26 February 2022. Accessed 3 June 2022.

      Jmbpiano. “Windows 11 - What are our initial thoughts and feelings?” Reddit, 22 November 2021. Accessed 3 June 2022.

      Lumunge, Erick. “UEFI and Legacy boot.” OpenGenus, n.d. Accessed 18 May 2022.

      Bibliography

      Mandaro, Laura. “Chromebooks Gain Share of Education Market Despite Shortages.” The Information, 9 September 2020. Accessed 19 May 2022.

      Murtaza, Fawad. “What Is Virtualization Based Security in Windows?” Valnet Inc, 24 October 2021. Accessed 17 May 2022.

      Roberts, Jeremy. Personal interview. 27 May 2022.

      Rouse, Rick. “My initial thoughts about Windows 11 (likes and dislikes).” RicksDailyTips.com, 5 September 2021. Accessed 3 June 2022.

      Sandrews1313. “Windows 11 - What are our initial thoughts and feelings?” Reddit, 22 November 2021. Accessed 3 June 2022.

      “The Matrix Quotes." Quotes.net, n.d. Accessed 18 May 2022.

      Thurrott, Paul.” Google: 40 Million Chromebooks in Use in Education.” Thurrott, 21 January 2020. Accessed 18 May 2022.

      Vaughan-Nichols, Steven J. “The real reason for Windows 11.” Computerworld, 6 July 2021, Accessed 19 May 2022.

      “Virtual Machine Support.” Microsoft,3 June 2022. Accessed 13 June 2022.

      “What are DirectX 12 compatible graphics and WDDM 2.x.” Wisecleaner, 20 August 2021. Accessed 19 May 2022.

      “Windows 11 Specs and System Requirements.” Microsoft, 2022. Accessed 13 June 2022.

      “Windows Display Driver Model.” MiniTool, n.d. Accessed 13 June 2022.

      Improve Service Desk Ticket Intake

      • Buy Link or Shortcode: {j2store}481|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Service Desk
      • Parent Category Link: /service-desk

      • Customers expect a consumer experience with IT. It won’t be long until this expectation expands to IT service support.
      • Messaging and threads are becoming central to how businesses organize information and conversations, but voice isn’t going away. It is still by far people’s favorite channel.
      • Tickets are becoming more complicated. BYOD, telework, and SaaS products present a perfect storm.
      • Traditional service metrics are not made for self service. Your mean-time-to-resolve will increase and first-contact resolution will decrease.

      Our Advice

      Critical Insight

      • Bring the service desk to the people. Select channels that are most familiar to your users, and make it as easy possible to talk to a human.
      • Integrate channels. Users should have a consistent experience, and technicians should know user history.
      • Don’t forget the human aspect. People aren’t always good with technology. Allow them to contact a person if they are struggling.

      Impact and Result

      • Define which channels will be prioritized.
      • Identify improvements to these channels based on best practices and our members’ experiences.
      • Streamline your ticket intake process to remove unnecessary steps.
      • Prioritize improvements based on their value. Implement a set of improvements every quarter.

      Improve Service Desk Ticket Intake Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should improve your ticket intake, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Define and prioritize ticket channels

      Align your improvements with business goals and the shift-left strategy.

      • Improve Service Desk Ticket Intake – Phase 1: Define and Prioritize Ticket Channels
      • Service Desk Maturity Assessment
      • Service Desk Improvement Presentation Template

      2. Improve ticket channels

      Record potential improvements in your CSI Register, as you review best practices for each channel.

      • Improve Service Desk Ticket Intake – Phase 2: Improve Ticket Channels
      • Service Desk Continual Improvement Roadmap
      • Service Desk Ticket Intake Workflow Samples (Visio)
      • Service Desk Ticket Intake Workflow Samples (PDF)
      • Service Definition Checklist
      • Service Desk Site Visit Checklist Template

      3. Define next steps

      Streamline your ticket intake process and prioritize opportunities for improvement.

      • Improve Service Desk Ticket Intake – Phase 3: Define Next Steps
      [infographic]

      Workshop: Improve Service Desk Ticket Intake

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Optimize Ticket Channels

      The Purpose

      Brainstorm improvements to your systems and processes that will help you optimize.

      Key Benefits Achieved

      Develop a single point of contact.

      Reduce the time before a technician can start productively working on a ticket.

      Enable Tier 1 and end users to complete more tickets.

      Activities

      1.1 Prioritize channels for improvement.

      1.2 Optimize the voice channel.

      1.3 Identify improvements for self service.

      1.4 Improve Tier 1 agents’ access to information.

      1.5 Optimize supplementary ticket channels.

      Outputs

      Action items to improve the voice channel.

      Populated CSI Register for self-service channels.

      Identified action items for the knowledgebase.

      Populated CSI Register for additional ticket channels.

      2 Streamline Ticket Intake

      The Purpose

      Create long-term growth by taking a sustainable approach to improvements.

      Key Benefits Achieved

      Streamline your overall ticket intake process for incidents and service requests.

      Activities

      2.1 Map out the incident intake processes.

      2.2 Identify opportunities to streamline the incident workflow.

      2.3 Map out the request processes.

      2.4 Identify opportunities to streamline the request workflow.

      Outputs

      Streamlined incident intake process.

      Streamlined request intake process.

      Populated CSI Register for request intake.

      Optimize IT Project Intake, Approval, and Prioritization

      • Buy Link or Shortcode: {j2store}433|cart{/j2store}
      • member rating overall impact: 9.5/10 Overall Impact
      • member rating average dollars saved: $124,419 Average $ Saved
      • member rating average days saved: 31 Average Days Saved
      • Parent Category Name: Portfolio Management
      • Parent Category Link: /portfolio-management
      • Companies are approving more projects than they can deliver. Most organizations say they have too many projects on the go and an unmanageable and ever-growing backlog of things to get to.
      • While organizations want to achieve a high throughput of approved projects, many are unable or unwilling to allocate an appropriate level of IT resourcing to adequately match the number of approved initiatives.
      • Portfolio management practices must find a way to accommodate stakeholder needs without sacrificing the portfolio to low-value initiatives that do not align with business goals.

      Our Advice

      Critical Insight

      • Approve only the right projects that you have capacity to deliver. Failure to align projects with strategic goals and resource capacity are the most common causes of portfolio waste across organizations.
      • More time spent with stakeholders during the ideation phase to help set realistic expectations for stakeholders and enhance visibility into IT’s capacity and processes is key to both project and organizational success.
      • Too much intake red tape will lead to an underground economy of projects that escape portfolio oversight, while too little intake formality will lead to a wild west of approvals that could overwhelm the PMO. Finding the right balance of intake formality for your organization is the key to establishing a PMO that has the ability to focus on the right things.

      Impact and Result

      • Establish an effective scorecard to create transparency into IT’s capacity and processes. This will help set realistic expectations for stakeholders, eliminate “squeaky wheel” prioritization, and give primacy to the highest value requests.
      • Build a centralized process that funnels requests into a single intake channel to eliminate confusion and doubt for stakeholders and staff while also reducing off-the-grid initiatives.
      • Clearly define a series of project approval steps, and communicate requirements for passing them.
      • Develop practices that incorporate the constraint of resource capacity to cap the amount of project approvals to that which is realistic to help improve the throughput of projects through the portfolio.

      Optimize IT Project Intake, Approval, and Prioritization Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should optimize project intake, approval, and prioritization process, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Set realistic goals for optimizing project intake, approval, and prioritization process

      Get value early by piloting a scorecard for objectively determining project value, and then examine your current state of project intake to set realistic goals for optimizing the process.

      • Optimize Project Intake, Approval, and Prioritization – Phase 1: Set Realistic Goals for Optimizing Process
      • Project Value Scorecard Development Tool
      • Project Intake Workflow Template - Visio
      • Project Intake Workflow Template - PDF
      • Project Intake, Approval, and Prioritization SOP

      2. Build an optimized project intake, approval, and prioritization process

      Take a deeper dive into each of the three processes – intake, approval, and prioritization – to ensure that the portfolio of projects is best aligned to stakeholder needs, strategic objectives, and resource capacity.

      • Optimize Project Intake, Approval, and Prioritization – Phase 2: Build New Optimized Processes
      • Light Project Request Form
      • Detailed Project Request Form
      • Project Intake Classification Matrix
      • Benefits Commitment Form Template
      • Proposed Project Technology Assessment Tool
      • Fast Track Business Case Template
      • Comprehensive Business Case Template
      • Project Intake and Prioritization Tool

      3. Integrate the new optimized processes into practice

      Plan a course of action to pilot, refine, and communicate the new optimized process using Info-Tech’s expertise in organizational change management.

      • Optimize Project Intake, Approval, and Prioritization – Phase 3: Integrate the New Processes into Practice
      • Intake Process Pilot Plan Template
      • Project Backlog Manager
      • Intake and Prioritization Impact Analysis Tool
      [infographic]

      Workshop: Optimize IT Project Intake, Approval, and Prioritization

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Refocus on Project Value to Set Realistic Goals

      The Purpose

      Set the course of action for optimizing project intake, approval, and prioritization by examining the current state of the process, the team, the stakeholders, and the organization as a whole.

      Key Benefits Achieved

      The overarching goal of optimizing project intake, approval, and prioritization process is to maximize the throughput of the best projects. To achieve this goal, one must have a clear way to determine what are “the best” projects.

      Activities

      1.1 Define the criteria with which to determine project value.

      1.2 Envision your target state for your optimized project intake, approval, and prioritization process.

      Outputs

      Draft project valuation criteria

      Examination of current process, definition of process success criteria

      2 Examine, Optimize, and Document the New Process

      The Purpose

      Drill down into, and optimize, each of the project intake, approval, and prioritization process.

      Key Benefits Achieved

      Info-Tech’s methodology systemically fits the project portfolio into its triple constraint of stakeholder needs, strategic objectives, and resource capacity, to effectively address the challenges of establishing organizational discipline for project intake.

      Activities

      2.1 Conduct retrospectives of each process against Info-Tech’s best practice methodology for project intake, approval, and prioritization process.

      2.2 Pilot and customize a toolbox of deliverables that effectively captures the right amount of data developed for informing the appropriate decision makers for approval.

      Outputs

      Documentation of new project intake, approval, and prioritization process

      Tools and templates to aid the process

      3 Pilot, Plan, and Communicate the New Process

      The Purpose

      Reduce the risks of prematurely implementing an untested process.

      Methodically manage the risks associated with organizational change and maximize the likelihood of adoption for the new process.

      Key Benefits Achieved

      Engagement paves the way for smoother adoption. An “engagement” approach (rather than simply “communication”) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.

      Activities

      3.1 Create a plan to pilot your intake, approval, and prioritization process to refine it before rollout.

      3.2 Analyze the impact of organizational change through the eyes of PPM stakeholders to gain their buy-in.

      Outputs

      Process pilot plan

      Organizational change communication plan

      Further reading

      Optimize IT Project Intake, Approval, and Prioritization

      Decide which IT projects to approve and when to start them.

      ANALYST PERSPECTIVE

      Capacity-constrained intake is the only sustainable path forward.

      "For years, the goal of project intake was to select the best projects. It makes sense and most people take it on faith without argument. But if you end up with too many projects, it’s a bad strategy. Don’t be afraid to say NO or NOT YET if you don’t have the capacity to deliver. People might give you a hard time in the near term, but you’re not helping by saying YES to things you can’t deliver."

      Barry Cousins,

      Senior Director, PMO Practice

      Info-Tech Research Group

      Our understanding of the problem

      This Research Is Designed For:

      • PMO Directors who have trouble with project throughput
      • CIOs who want to improve IT’s responsive-ness to changing needs of the business
      • CIOs who want to maximize the overall business value of IT’s project portfolio

      This Research Will Help You:

      • Align project intake and prioritization with resource capacity and strategic objectives
      • Balance proactive and reactive demand
      • Reduce portfolio waste on low-value projects
      • Manage project delivery expectations and satisfaction of business stakeholders
      • Get optimized project intake processes off the ground with low-cost, high-impact tools and templates

      This Research Will Also Assist:

      • C-suite executives and steering committee members who want to ensure IT’s successful delivery of projects with high business impact
      • Project sponsors and product owners who seek visibility and transparency toward proposed projects

      This Research Will Help Them:

      • Ensure that high-impact projects are approved and delivered in a timely manner
      • Gain clarity and visibility in IT’s project approval process
      • Improve your understanding of IT’s capacity to set more realistic expectations on what gets done

      Executive summary

      Situation

      • As a portfolio manager, you do not have the authority to decline or defer new projects – but you also lack the capacity to realistically say yes to more project work.
      • Stakeholders have unrealistic expectations of what IT can deliver. Too many projects are approved, and it may be unclear why their project is delayed or in a state of suspended animation.

      Complication

      • The cycle of competition is making it increasingly difficult to follow a longer-term strategy during project intake, making it unproductive to approve projects for any horizon longer than one to two years.
      • As project portfolios become more aligned to “transformative” projects, resourcing for smaller, department-level projects becomes increasingly opaque.

      Resolution

      • Establish an effective scorecard to create transparency into IT’s capacity and processes. This will help set realistic expectations for stakeholders, eliminate “squeaky wheel” prioritization, and give primacy to the highest value requests.
      • Build a centralized process that funnels requests into a single intake channel to eliminate confusion and doubt for stakeholders and staff while also reducing off-the-grid initiatives.
      • Clearly define a series of project approval steps, and communicate requirements for passing them.
      • Developing practices that incorporate the constraint of resource capacity to cap the amount of project approvals to that which is realistic will help improve the throughput of projects through the portfolio.

      Info-Tech Insight

      1. Approve only the right projects… Counterbalance stakeholder needs with strategic objectives of the business and that of IT, in order to maintain the value of your project portfolio at a high level.
      2. …that you have capacity to deliver. Resource capacity-informed project approval process enables you to avoid biting off more than you can chew and, over time, build a track record of fulfilling promises to deliver on projects.

      Most organizations are good at approving projects, but bad at starting them – and even worse at finishing them

      Establishing project intake discipline should be a top priority from a long-term strategy and near-term tactical perspective.

      Most organizations approve more projects than they can finish. In fact, many approve more than they can even start, leading to an ever-growing backlog where project ideas – often good ones – are never heard from again.

      The appetite to approve more runs directly counter to the shortage of resources that plagues most IT departments. This tension of wanting more from less suggests that IT departments need to be more disciplined in choosing what to take on.

      Info-Tech’s data shows that most IT organizations struggle with their project backlog (Source: N=397 organizations, Info-Tech Research Group PPM Current State Scorecard, 2017).

      “There is a minimal list of pending projects”

      A bar graph is depicted. It has 5 bars to show that when it comes to minimal lists of pending projects, 34% strongly disagree, 35% disagree, and 21% are ambivalent. Only 7% agree and 3% strongly agree.

      “Last year we delivered the number of projects we anticipated at the start of the year”

      A bar graph is depicted. It has 5 bars to show that when it comes to the number of projects anticipated at the start of the year, they were delivered. Surveyors strongly disagreed at 24%, disagreed at 31%, and were ambivalent at 30%. Only 13% agreed and 2% strongly agreed.

      The concept of fiduciary duty demonstrates the need for better discipline in choosing what projects to take on

      Unless someone is accountable for making the right investment of resource capacity for the right projects, project intake discipline cannot be established effectively.

      What is fiduciary duty?

      Officers and directors owe their corporation the duty of acting in the corporation’s best interests over their own. They may delegate the responsibility of implementing the actions, but accountability can't be delegated; that is, they have the authority to make choices and are ultimately answerable for them.

      No question is more important to the organization’s bottom line. Projects directly impact the bottom line because they require investment of resource time and money for the purposes of realizing benefits. The scarcity of resources requires that choices be made by those who have the right authority.

      Who approves your projects?

      Historically, the answer would have been the executive layer of the organization. However, in the 1990s management largely abdicated its obligation to control resources and expenditures via “employee empowerment.”

      Controls on approvals became less rigid, and accountability for choosing what to do (and not do) shifted onto the shoulders of the individual worker. This creates a current paradigm where no one is accountable for the malinvestment…

      …of resources that comes from approving too many projects. Instead, it’s up to individual workers to sink or swim as they attempt to reconcile, day after day, seemingly infinite organizational demand with their finite supply of working hours.

      Ad hoc project selection schemes do not work

      Without active management, reconciling the imbalance between demand with available work hours is a struggle that results largely in one of these two scenarios:

      “Squeaky wheel”: Projects with the most vocal stakeholders behind them are worked on first.

      • IT is seen to favor certain lines of business, leading to disenfranchisement of other stakeholders.
      • Everything becomes the highest priority, which reinforces IT’s image as a firefighter, rather than a business value contributor
      • High-value projects without vocal support never get resourced; opportunities are missed.

      “First in, first out”: Projects are approved and executed in the order they are requested.

      • Urgent or important projects for the business languish in the project backlog; opportunities are missed.
      • Low-value projects dominate the project portfolio.
      • Stakeholders leave IT out of the loop and resort to “underground economy” for getting their needs addressed.

      80% of organizations feel that their portfolios are dominated by low-value initiatives that do not deliver value to the business (Source: Cooper).

      Approve the right projects that you have capacity to deliver by actively managing the intake of projects

      Project intake, approval, and prioritization (collectively “project intake”) reconciles the appetite for new projects with available resource capacity and strategic goals.

      Project intake is a key process of project portfolio management (PPM). The Project Management Institute (PMI) describes PPM as:

      "Interrelated organizational processes by which an organization evaluates, selects, prioritizes, and allocates its limited internal resources to best accomplish organizational strategies consistent with its vision, mission, and values."

      (PMI, Standard for Portfolio Management, 3rd ed.)

      Triple Constraint Model of the Project Portfolio

      Project Intake:

      • Stakeholder Need
      • Strategic Objectives
      • Resource Capacity

      All three components are required for the Project Portfolio

      Organizations practicing PPM recognize available resource capacity as a constraint and aim to select projects – and commit the said capacity – to projects that:

      1. Best satisfy the stakeholder needs that constantly change with the market
      2. Best align to the strategic objectives and contribute the most to business
      3. Have sufficient resource capacity available to best ensure consistent project throughput

      92% vs. 74%: 92% of high-performing organizations in PPM report that projects are well aligned to strategic initiatives vs. 74% of low performers (PMI, 2015).

      82% vs. 55%: 82% of high-performing organizations in PPM report that resources are effectively reallocated across projects vs. 55% of low performers (PMI, 2015)

      Info-Tech’s data demonstrates that optimizing project intake can also improve business leaders’ satisfaction of IT

      CEOs today perceive IT to be poorly aligned to business’ strategic goals:

      43% of CEOs believe that business goals are going unsupported by IT (Source: Info-Tech’s CEO-CIO Alignment Survey (N=124)).

      60% of CEOs believe that improvement is required around IT’s understanding of business goals (Source: Info-Tech’s CEO-CIO Alignment Survey (N=124)).

      Business leaders today are generally dissatisfied with IT:

      30% of business stakeholders are supporters of their IT departments (Source: Info-Tech’s CIO Business Vision Survey (N=21,367)).

      The key to improving business satisfaction with IT is to deliver on projects that help the business achieve its strategic goals:

      A chart is depicted to show a list of reported important projects, and then reordering the projects based on actual importance.
      Source: Info-Tech’s CIO Business Vision Survey (N=21,367)

      Optimized project intake not only improves the project portfolio’s alignment to business goals, but provides the most effective way to improve relationships with IT’s key stakeholders.

      Benchmark your own current state with overall & industry-specific data using Info-Tech’s Diagnostic Program.

      However, establishing organizational discipline for project intake, approval, and prioritization is difficult

      Capacity awareness

      Many IT departments struggle to realistically estimate available project capacity in a credible way. Stakeholders question the validity of your endeavor to install capacity-constrained intake process, and mistake it for unwillingness to cooperate instead.

      Many moving parts

      Project intake, approval, and prioritization involve the coordination of various departments. Therefore, they require a great deal of buy-in and compliance from multiple stakeholders and senior executives.

      Lack of authority

      Many PMOs and IT departments simply lack the ability to decline or defer new projects.

      Unclear definition of value

      Defining the project value is difficult because there are so many different and conflicting ways that are all valid in their own right. However, without it, it's impossible to fairly compare among projects to select what's "best."

      Establishing intake discipline requires a great degree of cooperation and conformity among stakeholders that can be cultivated through strong processes.

      Info-Tech’s intake, approval, and prioritization methodology systemically fits the project portfolio to its triple constraint

      Info-Tech’s Methodology

      Info-Tech’s Methodology
      Project Intake Project Approval Project Prioritization
      Project requests are submitted, received, triaged, and scoped in preparation for approval and prioritization. Business cases are developed, evaluated, and selected (or declined) for investment, based on estimated value and feasibility. Work is scheduled to begin, based on relative value, urgency, and availability of resources.
      Stakeholder Needs Strategic Objectives Resource Capacity
      Project Portfolio Triple Constraint

      Info-Tech’s methodology for optimizing project intake delivers extraordinary value, fast

      In the first step of the blueprint, you will prototype a set of scorecard criteria for determining project value.

      Our methodology is designed to tackle your hardest challenge first to deliver the highest-value part of the deliverable. Since the overarching goal of optimizing project intake, approval, and prioritization process is to maximize the throughput of the best projects, one must define how “the best projects” are determined.

      In nearly all instances…a key challenge for the PPM team is reaching agreement over how projects should rank.

      – Merkhofer

      A Project Value Scorecard will help you:

      • Evolve the discussions on project and portfolio value beyond a theoretical concept
      • Enable apples-to-apples comparisons amongst many different kinds of projects

      The Project Value Scorecard Development Tool is designed to help you develop the project valuation scheme iteratively. Download the pre-filled tool with content that represents a common case, and then, customize it with your data.

      A screenshot of Info-Tech's Project Value Scorecard Development Tool

      This blueprint provides a clear path to maximizing your chance of success in optimizing project intake

      Info-Tech’s practical, tactical research is accompanied by a suite of tools and templates to accelerate your process optimization efforts.

      Organizational change and stakeholder management are critical elements of optimizing project intake, approval, and prioritization processes because they require a great degree of cooperation and conformity among stakeholders, and the list of key stakeholders are long and far-reaching.

      This blueprint will provide a clear path to not only optimize the processes themselves, but also for the optimization effort itself. This research is organized into three phases, each requiring a few weeks of work at your team’s own pace – or all in one week, through a workshop facilitated by Info-Tech analysts.

      Set Realistic Goals for Optimizing Project Intake, Approval, and Prioritization

      Tools and Templates:

      • Project Value Scorecard Development Tool (.xlsx)
      • PPM Assessment Report (Info-Tech Diagnostics)
      • Standard Operating Procedure Template (.docx)

      Build Optimized Project Intake, Approval, and Prioritization Processes

      Tools and Templates:

      • Project Request Forms (.docx)
      • Project Classification Matrix (.xlsx)
      • Benefits Commitment Form (.xlsx)
      • Proposed Project Technology Assessment Tool (.xlsx)
      • Business Case Templates (.docx)
      • Intake and Prioritization Tool (.xlsx)

      Integrate the Newly Optimized Processes into Practice

      Tools and Templates:

      • Process Pilot Plan Template (.docx)
      • Impact Assessment and Communication Planning Tool (.xlsx)

      Info-Tech’s approach to PPM is informed by industry best practices and rooted in practical insider research

      Info-Tech uses PMI and ISACA frameworks for areas of this research.

      The logo for PMI is in the picture.

      PMI’s Standard for Portfolio Management, 3rd ed. is the leading industry framework, proving project portfolio management best practices and process guidelines.

      The logo for COBIT 5 is in the picture.

      COBIT 5 is the leading framework for the governance and management of enterprise IT.

      In addition to industry-leading frameworks, our best-practice approach is enhanced by the insights and guidance from our analysts, industry experts, and our clients.

      Info-Tech's logo is shown.

      33,000+

      Our peer network of over 33,000 happy clients proves the effectiveness of our research.

      1,000+

      Our team conducts 1,000+ hours of primary and secondary research to ensure that our approach is enhanced by best practices.

      Deliver measurable project intake success for your organization with this blueprint

      Measure the value of your effort to track your success quantitatively and demonstrate the proposed benefits, as you aim to do so with other projects through improved PPM.

      Optimized project intake, approval, and prioritization processes lead to a high PPM maturity, which will improve the successful delivery and throughput of your projects, resource utilization, business alignment, and stakeholder satisfaction ((Source: BCG/PMI).

      A double bar graph is depicted to show high PPM maturity yields measurable benefits. It covers 4 categories: Management for individual projects, financial performance, strategy implementation, and organizational agility.

      Measure your success through the following metrics:

      • Reduced turnaround time between project requests and initial scoping
      • Number of project proposals with articulated benefits
      • Reduction in “off-the-grid” projects
      • Team satisfaction and workplace engagement
      • PPM stakeholder satisfaction score from business stakeholders: see Info-Tech’s PPM Customer Satisfaction Diagnostics

      $44,700: In the past 12 months, Info-Tech clients have reported an average measured value of $44,700 from undertaking a guided implementation of this research.

      Add your own organization-specific goals, success criteria, and metrics by following the steps in the blueprint.

      Case Study: Financial Services PMO prepares annual planning process with Project Value Scorecard Development Tool

      CASE STUDY

      Industry: Financial Services

      Source: Info-Tech Client

      Challenge

      PMO plays a diverse set of roles, including project management for enterprise projects (i.e. PMI’s “Directive” PMO), standards management for department-level projects (i.e. PMI’s “Supportive” PMO), process governance of strategic projects (i.e. PMI’s “Controlling” PMO), and facilitation / planning / reporting for the corporate business strategy efforts (i.e. Enterprise PMO).

      To facilitate the annual planning process, the PMO needed to develop a more data-driven and objective project intake process that implicitly aligned with the corporate strategy.

      Solution

      Info-Tech’s Project Value Scorecard tool was incorporated into the strategic planning process.

      Results

      The scorecard provided a simple way to list the competing strategic initiatives, objectively score them, and re-sort the results on demand as the leadership chooses to switch between ranking by overall score, project value, ability to execute, strategic alignment, operational alignment, and feasibility.

      The Project Value Scorecard provided early value with multiple options for prioritized rankings.

      A screenshot of the Project Value Scorecard is shown in the image.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Optimize Project Intake, Approval, and Prioritization – project overview

      1. Set Realistic Goals for Optimizing Process 2. Build New Optimized Processes 3. Integrate the New Processes into Practice
      Best-Practice Toolkit

      1.1 Define the criteria with which to determine project value.


      2.1 Streamline intake to manage stakeholder expectations.

      2.2 Set up steps of project approval to maximize strategic alignment while right-sizing the required effort.

      2.3 Prioritize projects to maximize the value of the project portfolio within the constraint of resource capacity.

      3.1 Pilot your intake, approval, and prioritization process to refine it before rollout.

      3.2 Analyze the impact of organizational change through the eyes of PPM stakeholders to gain their buy-in.

      Guided Implementations
      • Introduce Project Value Scorecard Development Tool and pilot Info-Tech’s example scorecard on your own backlog.
      • Map current project intake, approval, and prioritization process and key stakeholders.
      • Set realistic goals for process optimization.
      • Improve the management of stakeholder expectations with an optimized intake process.
      • Improve the alignment of the project portfolio to strategic objectives with an optimized approval process.
      • Enable resource capacity-constrained greenlighting of projects with an optimized prioritization process.
      • Create a process pilot strategy with supportive stakeholders.
      • Conduct a change impact analysis for your PPM stakeholders to create an effective communication strategy.
      • Roll out the new process and measure success.
      Onsite Workshop

      Module 1:

      Refocus on Project Value to Set Realistic Goals for Optimizing Project Intake, Approval, and Prioritization Process

      Module 2:

      Examine, Optimize, and Document the New Project Intake, Approval, and Prioritization Process

      Module 3:

      Pilot, Plan, and Communicate the New Process and Its Required Organizational Changes

      Phase 1 Outcome:
      • Draft project valuation criteria
      • Examination of current process
      • Definition of process success criteria
      Phase 2 Outcome:
      • Documentation of new project intake, approval, and prioritization process
      • Tools and templates to aid the process
      Phase 3 Outcome:
      • Process pilot plan
      • Organizational change communication plan

      Workshop overview

      Contact your account representative or email Workshops@InfoTech.com for more information.

      Workshop Day 1 Workshop Day 2 Workshop Day 3 Workshop Day 4 Workshop Day 5
      Activities

      Benefits of optimizing project intake and project value definition

      1.1 Complete and review PPM Current State Scorecard Assessment

      1.2 Define project value for the organization

      1.3 Engage key PPM stakeholders to iterate on the scorecard prototype

      Set realistic goals for process optimization

      2.1 Map current intake, approval, and prioritization workflow

      2.2 Enumerate and prioritize process stakeholders

      2.3 Determine the current and target capability levels

      2.4 Define the process success criteria and KPIs

      Optimize project intake and approval processes

      3.1 Conduct focused retrospectives for project intake and approval

      3.2 Define project levels

      3.3 Optimize project intake processes

      3.4 Optimize project approval processes

      3.5 Compose SOP for intake and approval

      3.6 Document the new intake and approval workflow

      Optimize project prioritization process plan for a process pilot

      4.1 Conduct focused retrospective for project prioritization

      4.2 Estimate available resource capacity

      4.3 Pilot Project Intake and Prioritization Tool with your project backlog

      4.4 Compose SOP for prioritization

      4.5 Document the new prioritization workflow

      4.6 Discuss process pilot

      Analyze stakeholder impact and create communication strategy

      5.1 Analyze stakeholder impact and responses to impending organization change

      5.2 Create message canvas for at-risk change impacts and stakeholders

      5.3 Set course of action for communicating change

      Deliverables
      1. PPM Current State Scorecard
      2. Project Value Scorecard prototype
      1. Current intake, approval, and prioritization workflow
      2. Stakeholder register
      3. Intake process success criteria
      1. Project request form
      2. Project level classification matrix
      3. Proposed project deliverables toolkit
      4. Customized intake and approval SOP
      5. Flowchart for the new intake and approval workflow
      1. Estimated resource capacity for projects
      2. Customized Project Intake and Prioritization Tool
      3. Customized prioritization SOP
      4. Flowchart for the new prioritization workflow
      5. Process pilot plan
      1. Completed Intake and Prioritization Impact Analysis Tool
      2. Communication strategy and plan

      Phase 1

      Set Realistic Goals for Optimizing Project Intake, Approval, and Prioritization Process

      Phase 1 outline

      Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 1: Set Realistic Goals for Project Intake, Approval, and Prioritization Process Proposed Time to Completion: 1-2 weeks

      Step 1.1: Define the project valuation criteria

      Start with an analyst kick-off call:

      • Discuss how a project value is currently determined
      • Introduce Info-Tech’s scorecard-driven project valuation approach

      Then complete these activities…

      • Create a first-draft version of a project value-driven prioritized list of projects
      • Review and iterate on the scorecard criteria

      With these tools & templates:

      Project Value Scorecard Development Tool

      Step 1.2: Envision your process target state

      Start with an analyst kick-off call:

      • Introduce Info-Tech’s project intake process maturity model
      • Discuss the use of Info-Tech’s Diagnostic Program for an initial assessment of your current PPM processes

      Then complete these activities…

      • Map your current process workflow
      • Enumerate and prioritize your key stakeholders
      • Define process success criteria

      With these tools & templates:

      Project Intake Workflow Template

      Project Intake, Approval, and Prioritization SOP Template

      Phase 1 Results & Insights:
      • The overarching goal of optimizing project intake, approval, and prioritization process is to maximize the throughput of the best projects. To achieve this goal, one must have a clear way to determine what are “the best” projects.

      Get to value early with Step 1.1 of this blueprint

      Define how to determine a project’s value and set the stage for maximizing the value of your project portfolio using Info-Tech’s Project Value Scorecard Development Tool.

      Where traditional models of consulting can take considerable amounts of time before delivering value to clients, Info-Tech’s methodology for optimizing project intake, approval, and prioritization process gets you to value fast.

      The overarching goal of optimizing project intake, approval, and prioritization process is to maximize the throughput of the best projects. To achieve this goal, one must have a clear way to determine what are “the best” projects.

      In the first step of this blueprint, you will pilot a multiple-criteria scorecard for determining project value that will help answer that question. Info-Tech’s Project Value Scorecard Development Tool is pre-populated with a ready-to-use, real-life example that you can leverage as a starting point for tailoring it to your organization – or adopt as is.

      Introduce objectivity and clarity to your discussion of maximizing the value of your project portfolio with Info-Tech’s practical IT research that drives measurable results.

      Download Info-Tech’s Project Value Scorecard Development Tool.

      A screenshot of Info-Tech's Project Value Scorecard Development Tool

      Step 1.1: Define the criteria with which to determine project value

      PHASE 1 PHASE 2 PHASE 3

      1.1

      Define project valuation criteria

      1.2

      Envision process target state

      2.1

      Streamline intake

      2.2

      Right-size approval steps

      2.3

      Prioritize projects to fit resource capacity

      3.1

      Pilot your optimized process

      3.2

      Communicate organizational change

      This step will walk you through the following activities:

      • Learn how to use the Project Value Scorecard Development Tool
      • Create a first-draft version of a project value-driven prioritized list of projects

      This step involves the following participants:

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • CIO (optional)

      Outcomes of this step

      • Understand the importance of devising a consensus criteria for project valuation.
      • Try a project value scorecard-driven prioritization process with your currently proposed.
      • Set the stage for optimizing project intake, approval, and prioritization processes.

      Intake, Approval, and Prioritization is a core process in Info-Tech’s project portfolio management (PPM) framework

      PPM is an infrastructure around projects that aims to ensure that the best projects are worked on at the right time with the right people.

      PPM’s goal is to maximize the throughput of projects that provide strategic and operational value to the organization. To do this, a PPM strategy must help to:

      Info-Tech's Project Portfolio Management Process Model
      3. Status & Progress Reporting
      1. Intake, Approval & Prioritization 2. Resource Management 3. Project Management 4. Project Closure 5. Benefits Tracking
      Intake Execution Closure
      1. Select the best projects
      2. Pick the right time and people to execute the projects
      3. Make sure the projects are okay
      4. Make sure the projects get done
      5. Make sure they were worth doing

      If you don’t yet have a PPM strategy in place, or would like to revisit your existing PPM strategy before optimizing your project intake, approval, and prioritization practices, see Info-Tech’s blueprint, Develop a Project Portfolio Management Strategy.

      A screenshot of Info-Tech's blueprint Develop a Project Portfolio Management Strategy is shown.

      “Too many projects, not enough resources” is the reality of most IT environments

      A profound imbalance between demand (i.e. approved project work and service delivery commitments) and supply (i.e. people’s time) is the top challenge IT departments face today.

      In today’s organizations, the desires of business units for new products and enhancements, and the appetites of senior leadership to approve more and more projects for those products and services, far outstrip IT’s ability to realistically deliver on everything.

      The vast majority of IT departments lack the resourcing to meet project demand – especially given the fact that day-to-day operational demands frequently trump project work.

      As a result, project throughput suffers – and with it, IT’s reputation within the organization.

      An image is depicted that has several projects laid out near a scale filling one side of it and off of it. On the other part of the scale which is higher, has an image of people in it to help show the relationship between resource supply and project demand.

      Info-Tech Insight

      Where does the time go? The portfolio manager (or equivalent) should function as the accounting department for time, showing what’s available in IT’s human resources budget for projects and providing ongoing visibility into how that budget of time is being spent.

      Don’t weigh your portfolio down by starting more than you can finish

      Focus on what will deliver value to the organization and what you can realistically deliver.

      Most of the problems that arise during the lifecycle of a project can be traced back to issues that could have been mitigated during the initiation phase.

      More than simply a means of early problem detection at the project level, optimizing your initiation processes is also the best way to ensure the success of your portfolio. With optimized intake processes you can better guarantee:

      • The projects you are working on are of high value
      • Your project list aligns with available resource capacity
      • Stakeholder needs are addressed, but stakeholders do not determine the direction of the portfolio

      80% of organizations feel their portfolios are dominated by low-value initiatives that do not deliver value to the business (Source: Cooper).

      "(S)uccessful organizations select projects on the basis of desirability and their capability to deliver them, not just desirability" (Source: John Ward, Delivering Value from Information Systems and Technology Investments).

      Establishing project value is the first – and difficult – step for optimizing project intake, approval, and prioritization

      What is the best way to “deliver value to the organization”?

      Every organization needs to explicitly define how to determine project value that will fairly represent all projects and provide a basis of comparison among them during approval and prioritization. Without it, any discussions on reducing “low-value initiatives” from the previous slide cannot yield any actionable plan.

      However, defining the project value is difficult, because there are so many different and conflicting ways that are all valid in their own right and worth considering. For example:

      • Strategic growth vs. operational stability
      • Important work vs. urgent work
      • Return on investment vs. cost containment
      • Needs of a specific line of business vs. business-wide needs
      • Financial vs. intangible benefits

      This challenge is further complicated by the difficulty of identifying the right criteria for determining project value:

      Managers fail to identify around 50% of the important criteria when making decisions (Source: Transparent Choice).

      Info-Tech Insight

      Sometimes it can be challenging to show the value of IT-centric, operational-type projects that maintain critical infrastructure since they don’t yield net-new benefits. Remember that benefits are only half the equation; you must also consider the costs of not undertaking the said project.

      Find the right mix of criteria for project valuation with Info-Tech’s Project Value Scorecard Development Tool

      Scorecard-driven approach is an easy-to-understand, time-tested solution to a multiple-criteria decision-making problem, such as project valuation.

      This approach is effective for capturing benefits and costs that are not directly quantifiable in financial terms. Projects are evaluated on multiple specific questions, or criteria, that each yield a score on a point scale. The overall score is calculated as a weighted sum of the scores.

      Info-Tech’s Project Value Scorecard is pre-populated with a best-practice example of eight criteria, two for each category (see box at bottom right). This example helps your effort to develop your own project scorecard by providing a solid starting point:

      60%: On their own, decision makers could only identify around 6 of their 10 most important criteria for making decisions (Source: Transparent Choice).

      Finally, in addition, the overall scores of approved projects can be used as a metric on which success of the process can be measured over time.

      Download Info-Tech’s Project Value Scorecard Development Tool.

      A screenshot of Info-Tech's Project Value Scorecard Development Tool

      Categories of project valuation criteria

      • Strategic alignment: projects must be aligned with the strategic goals of the business and IT.
      • Operational alignment: projects must be aligned with the operational goals of the business and IT.
      • Feasibility: practical considerations for projects must be taken into account in selecting projects.
      • Financial: projects must realize monetary benefits, in increased revenue or decreased costs, while posing as little risk of cost overrun as possible.

      Review the example criteria and score description in the Project Value Scorecard Development Tool

      1.1.1 Project Value Scorecard Development Tool, Tab 2: Evaluation Criteria

      This tab lists eight criteria that cover strategic alignment, operational alignment, feasibility, and financial benefits/risks. Each criteria is accompanied by a qualitative score description to standardize the analysis across all projects and analysts. While this tool supports up to 15 different criteria, it’s better to minimize the number of criteria and introduce additional ones as the organization grows in PPM maturity.

      A screenshot of Info-Tech's Project Value Scorecard Development Tool, Tab 2: Evaluation Criteria

      Type: It is useful to break down projects with similar overall scores by their proposed values versus ease of execution.

      Scale: Five-point scale is not required for this tool. Use more or less granularity of description as appropriate for each criteria.

      Blank Criteria: Rows with blank criteria are greyed out. Enter a new criteria to turn on the row.

      Score projects and search for the right mix of criteria weighting using the scorecard tab

      1.1.1 Project Value Scorecard Development Tool, Tab 3: Project Scorecard

      In this tab, you can see how projects are prioritized when they are scored according to the criteria from the previous tab. You can enter the scores of up to 30 projects in the scorecard table (see screenshot to the right).

      A screenshot of Info-Tech's Project Value Scorecard Development Tool, Tab 3: Project Scorecard is shown.

      Value (V) or Execution (E) & Relative Weight: Change the relative weights of each criteria and review any changes to the prioritized list of projects change, whose rankings are updated automatically. This helps you iterate on the weights to find the right mix.

      Feasibility: Custom criteria category labels will be automatically updated.

      A screenshot of Info-Tech's Project Value Scorecard Development Tool, Tab 3: Project Scorecard is shown.

      Overall: Choose the groupings of criteria by which you want to see the prioritized list. Available groupings are:

      • Overall score
      • By value or by execution
      • By category

      Ranks and weighted scores for each project is shown.

      For example, click on the drop-down and choose “Execution.”

      A screenshot of Info-Tech's Project Value Scorecard Development Tool, Tab 3: Project Scorecard is shown.

      Project ranks are based only on execution criteria.

      Create a first-draft version of a project value-driven prioritized list of projects

      1.1.1 Estimated Time: 60 minutes

      Follow the steps below to test Info-Tech’s example Project Value Scorecard and examine the prioritized list of projects.

      1. Using your list of proposed, ongoing, and completed projects, identify a representative sample of projects in your project portfolio, varying in size, scope, and perceived value – about 10-20 of them.
      2. Arrange these projects in the order of priority using any processes or prioritization paradigm currently in place in your organization.
      • In the absence of formal process, use your intuition, as well as knowledge of organizational priorities, and your stakeholders.
    • Use the example criteria and score description in Tab 2 of Info-Tech’s Project Value Scorecard Development Tool to score the same list of projects:
      • Avoid spending too much time at this step. Prioritization criteria will be refined in the subsequent parts of the blueprint.
      • If multiple scorers are involved, allow some overlap to benchmark for consistency.
    • Enter the scores in Tab 3 of the tool to obtain the first-draft version of a project value-driven prioritized project list. Compare it with your list from Step 2.
    • INPUT

      • Knowledge of proposed, ongoing, and completed projects in your project portfolio

      OUTPUT

      • Prioritized project lists

      Materials

      • Project Value Scorecard Development Tool

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • CIO (optional)

      Iterate on the scorecard to set the stage for optimizing project intake, approval, and prioritization

      1.1.2 Estimated Time: 60 minutes

      Conduct a retrospective of the previous activity by asking these questions:

      • How smooth was the overall scoring experience (Step 3 of Activity 1.1.1)?
      • Did you experience challenges in interpreting and applying the example project valuation criteria? Why? (e.g. lack of information, absence of formalized business strategic goals, too much room for interpretation in scoring description)
      • Did the prioritized project list agree with your intuition?

      Iterate on the project valuation criteria:

      • Manipulate the relatives weights of valuation criteria to fine-tune them.
      • Revise the scoring descriptions to provide clarity or customize them to better fit your organization’s needs, then update the project scores accordingly.
      • For projects that did not score well, will this cause concern from any stakeholders? Are the concerns legitimate? If so, this may indicate the need for inclusion of new criteria.
      • For projects that score too well, this may indicate a bias toward a specific type of project or group of stakeholders. Try adjusting the relative weights of existing criteria.

      INPUT

      • Activity 1.1.1

      OUTPUT

      • Retrospective on project valuation
      • Review of project valuation criteria

      Materials

      • Project Value Scorecard Development Tool

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • CIO (optional)

      Next steps: engage key PPM stakeholders to reach a consensus when establishing how to determine project value

      Engage these key players to create the evaluation criteria that all stakeholders will support:

      • Business units: Projects are undertaken to provide value to the business. Senior management from business units must help define how project will be valued.
      • IT: IT must ensure that technical/practical considerations are taken into account when determining project value.
      • Finance: The CFO or designated representative will ensure that estimated project costs and benefits can be used to manage the budget.
      • PMO: PMO is the administrator of the project portfolio. PMO must provide coordination and support to ensure the process operates smoothly and its goals are realized.
      • Business analysts: BAs carry out the evaluation of project value. Therefore, their understanding of the evaluation criteria and the process as a whole are critical to the success of the process.
      • Project sponsors: Project sponsors are accountable for the realization of benefits for which projects are undertaken.

      Optimize the process with the new project value definition to focus your discussion with stakeholders

      This blueprint will help you not only optimize the process, but also help you work with your stakeholders to realize the benefits of the optimized process.

      In this step, you’ve begun improving the definition of project value. Getting it right will require several more iterations and will require a series of discussions with your key stakeholders.

      The optimized intake process built around the new definition of project value will help evolve a conceptual discussion about project value into a more practical one. The new process will paint a picture of what the future state will look like for your stakeholders’ requested projects getting approved and prioritized for execution, so that they can provide feedback that’s concrete and actionable. To help you with that process, you will be taken through a series of activities to analyze the impact of change on your stakeholders and create a communication plan in the last phase of the blueprint.

      For now, in the next step of this blueprint, you will undergo a series of activities to assess your current state to identify the specific areas for process optimization.

      "To find the right intersection of someone’s personal interest with the company’s interest on projects isn’t always easy. I always try to look for the basic premise that you can get everybody to agree on it and build from there… But it’s sometimes hard to make sure that things stick. You may have to go back three or four times to the core agreement."

      -Eric Newcomer

      Step 1.2: Envision your target state for your optimized project intake, approval, and prioritization process

      PHASE 1 PHASE 2 PHASE 3

      1.1

      Define project valuation criteria

      1.2

      Envision process target state

      2.1

      Streamline intake

      2.2

      Right-size approval steps

      2.3

      Prioritize projects to fit resource capacity

      3.1

      Pilot your optimized process

      3.2

      Communicate organizational change

      This step will walk you through the following activities:

      • Map your current project intake, approval, and prioritization workflow, and document it in a flowchart
      • Enumerate and prioritize your key process stakeholders
      • Determine your process capability level within Info-Tech’s Framework
      • Establish your current and target states for project intake, approval, and prioritization process

      This step involves the following participants:

      • CIO
      • PMO Director/Portfolio Manager
      • Project Managers
      • Business Analysts
      • Other PPM stakeholders

      Outcomes of this step

      • Current project intake, approval, and prioritization process is mapped out and documented in a flowchart
      • Key process stakeholders are enumerated and prioritized to inform future discussion on optimizing processes
      • Current and target organizational process capability levels are determined
      • Success criteria and key performance indicators for process optimization are defined

      Use Info-Tech’s Diagnostic Program for an initial assessment of your current PPM processes

      This step is highly recommended but not required. Call 1-888-670-8889 to inquire about or request the PPM Diagnostics.

      Info-Tech's Project Portfolio Management Assessmentprovides you with a data-driven view of the current state of your portfolio, including your intake processes. Our PPM Assessment measures and communicates success in terms of Info-Tech’s best practices for PPM.

      A screenshot of Info-Tech's Project Portfolio Management Assessment blueprint is shown.

      Use the diagnostic program to:

      • Assess resource utilization across the portfolio.
      • Determine project portfolio reporting completeness.
      • Solicit feedback from your customers on the clarity of your portfolio’s business goals.
      • Rate the overall quality of your project management practices and benchmark your rating over time.
      A screenshot of Info-Tech's Project Portfolio Management Assessment blueprint is shown.

      Scope your process optimization efforts with Info-Tech’s high-level intake, approval, and prioritization workflow

      Info-Tech recommends the following workflow at a high level for a capacity-constrained intake process that aligns to strategic goals and stakeholder need.

      • Intake (Step 2.1)*
        • Receive project requests
        • Triage project requests and assign a liaison
        • High-level scoping & set stakeholder expectations
      • Approval (Step 2.2)*
        • Concept approval by project sponsor
        • High-level technical solution approval by IT
        • Business case approval by business
        • Resource allocation & greenlight projects
      • Prioritization (Step 2.3)*
        • Update project priority scores & available project capacity
        • Identify high-scoring and “on-the-bubble” projects
        • Recommend projects to greenlight or deliberate

      * Steps denote the place in the blueprint where the steps are discussed in more detail.

      Use this workflow as a baseline to examine your current state of the process in the next slide.

      Map your current project intake, approval, and prioritization workflow

      1.2.1 Estimated Time: 60-90 minutes

      Conduct a table-top planning exercise to map out the processes currently in place for project intake, approval, and prioritization.

      1. Use white 4”x6” recipe cards / large sticky notes to write out unique steps of a process. Use the high-level process workflow from the previous slides as a guide.
      2. Arrange the steps into chronological order. Benchmark the arrangement through a group discussion.
      3. Use green cards to identify artifacts or deliverables that result from a step.
      4. Use yellow cards to identify who does the work (i.e. responsible parties), and who makes the decisions (i.e. accountable party). Keep in mind that while multiple parties may be responsible, accountability cannot be shared and only a single party can be accountable for a process.
      5. Use red cards to identify issues, problems, or risks. These are opportunities for optimization.

      INPUT

      • Documentation describing the current process (e.g. standard operating procedures)
      • Info-Tech’s high-level intake workflow

      OUTPUT

      • Current process, mapped out

      Materials

      • 4x6” recipe cards
      • Whiteboard

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • Other PPM stakeholders

      Document the current project intake, approval, and prioritization workflow in a flowchart

      1.2.2 Estimated Time: 60 minutes

      Document the results of the previous table-top exercise (Activity 1.1.1) into a flow chart. Flowcharts provide a bird’s-eye view of process steps that highlight the decision points and deliverables. In addition, swim lanes can be used to indicate process stages, task ownership, or responsibilities (example below).

      An example is shown for activity 1.2.2

      Review and customize section 1.2, “Overall Process Workflow” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      "Flowcharts are more effective when you have to explain status and next steps to upper management."

      – Assistant Director-IT Operations, Healthcare Industry

      Browser-based flowchart tool examples

      INPUT

      • Mapped-out project intake process (Activity 1.2.1)

      OUTPUT

      • Flowchart representation of current project intake workflow

      Materials

      • Microsoft Visio, flowchart software, or Microsoft PowerPoint

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts

      Example of a project intake, approval, and prioritization flow chart – without swim lanes

      An example project intake, approval, and prioritization flow chart without swim lanes is shown.

      Example of a project intake, approval, and prioritization flow chart – with swim lanes

      An example project intake, approval, and prioritization flow chart with swim lanes is shown.

      Download Info-Tech’s Project Intake Workflow Template (Visio and PDF)

      Enumerate your key stakeholders for optimizing intake, approval, and prioritization process

      1.2.3 30-45 minutes

      In the previous activity, accountable and responsible stakeholders for each of the steps in the current intake, approval, and prioritization process were identified.

      1. Based on your knowledge and insight of your organization, ensure that all key stakeholders with accountable and responsible stakeholders are accounted for in the mapped-out process. Note any omissions: it may indicate a missing step, or that the stakeholder ought to be, but are not currently, involved.
      2. For each step, identify any stakeholders that are currently consulted or informed. Then, examine the whole map and identify any other stakeholders that ought to be consulted or informed.
      3. Compile a list of stakeholders from steps 1-2, and write each of their names in two sticky notes.
      4. Put both sets of sticky notes on a wall. Use the wisdom-of-the-crowd approach to arrange one set in a descending order of influence. Record their ranked influence from 1 (least) to 10 (most).
      5. Rearrange the other set in a descending order of interest in seeing the project intake process optimized. Record their ranked interest from 1 (least) to 10 (most).

      INPUT

      • Mapped-out project intake process (Activity 1.2.1)
      • Insight on organizational culture

      OUTPUT

      • List of stakeholders in project intake
      • Ranked list in their influence and interest

      Materials

      • Sticky notes
      • Walls

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • Other PPM stakeholders

      Prioritize your stakeholders for project intake, approval, and prioritization process

      There are three dimensions for stakeholder prioritization: influence, interest, and support.

      1. Map your stakeholders in a 2D stakeholder power map (top right) according to their relative influence and interest.
      2. Rate their level of support by asking the following question: how likely is it that your stakeholder would welcome an improved process for project intake?

      These parameters will inform how to prioritize your stakeholders according to the stakeholder priority heatmap (bottom right). This priority should inform how to focus your attention during the subsequent optimization efforts.

      A flowchart is shown to show the relationship between influence and interest.

      Level of Support
      Stakeholder Category Supporter Evangelist Neutral Blocker
      Engage Critical High High Critical
      High Medium Low Low Medium
      Low High Medium Medium High
      Passive Low Irrelevant Irrelevant Low

      Info-Tech Insight

      There may be too many stakeholders to be able to achieve complete satisfaction. Focus your attention on the stakeholders that matter the most.

      Most organizations have low to medium capabilities around intake, approval, and prioritization

      1.2.4 Estimated Time: 15 minutes

      Use Info-Tech’s Intake Capability Framework to help define your current and target states for intake, approval, and prioritization.

      Capability Level Capability Level Description
      Capability Level 5: Optimized Our department has effective intake processes with right-sized administrative overhead. Work is continuously prioritized to keep up with emerging challenges and opportunities.
      Capability Level 4: Aligned Our department has very strong intake processes. Project approvals are based on business cases and aligned with future resource capacity.
      Capability Level 3: Engaged Our department has processes in place to track project requests and follow up on them. Priorities are periodically re-evaluated, based largely on the best judgment of one or several executives.
      Capability Level 2: Defined Our department has some processes in place but no capacity to say no to new projects. There is a formal backlog, but little or no method for grooming it.
      Capability Level 1: Unmanaged Our department has no formal intake processes in place. Most work is done reactively, with little ability to prioritize proactive project work.

      Refer to the subsequent slides for more detail on these capability levels.

      Level 1: Unmanaged

      Use these descriptions to place your organization at the appropriate level of intake capability.

      Intake Projects are requested through personal conversations and emails, with minimal documentation and oversight.
      Approval Projects are approved by default and rarely (if ever) declined. There is no definitive list of projects in the pipeline or backlog.
      Prioritization Most work is done reactively, with little ability to prioritize proactive project work.

      Symptoms

      • Poorly defined – or a complete absence of – PPM processes.
      • No formal approval committee.
      • No processes in place to balance proactive and reactive demands.

      Long Term

      PMOs at this level should work to have all requests funneled through a proper request form within six months. Decision rights for approval should be defined, and a scorecard should be in place within the year.

      Quick Win

      To get a handle on your backlog, start tracking all project requests using the “Project Data” tab in Info-Tech’s Project Intake and Prioritization Tool.

      Level 2: Defined

      Use these descriptions to place your organization at the appropriate level of intake capability.

      Intake Requests are formally documented in a request form before they’re assigned, elaborated, and executed as projects.
      Approval Projects are approved by default and rarely (if ever) declined. There is a formal backlog, but little or no method for grooming it.
      Prioritization There is a list of priorities but no process for updating it more than annually or quarterly.

      Symptoms

      • Organization does not have clear concept of project capacity.
      • There is a lack of discipline enforced on stakeholders.
      • Immature PPM processes in general.

      Long Term

      PMOs at this level should strive for greater visibility into the portfolio to help make the case for declining (or at least deferring) requests. Within the year, have a formal PPM strategy up and running.

      Quick Win

      Something PMOs at this level can accomplish quickly without any formal approval is to spend more time with stakeholders during the ideation phase to better define scope and requirements.

      Level 3: Engaged

      Use these descriptions to place your organization at the appropriate level of intake capability.

      Intake Processes and skills are in place to follow up on requests to clarify project scope before going forward with approval and prioritization.
      Approval Projects are occasionally declined based on exceptionally low feasibility or value.
      Prioritization Priorities are periodically re-evaluated based largely on the best judgment of one or several executives.

      Challenges

      • Senior executives’ “best judgement” is frequently fallible or influenced. Pet projects still enter the portfolio and deplete resources.
      • While approval processes “occasionally” filter out some low-value projects, many still get approved.

      Long Term

      PMOs at this level should advocate for a more formal cadence for prioritization and, within the year, establish a formal steering committee that will be responsible for prioritizing and re-prioritizing quarterly or monthly.

      Quick Win

      At the PMO level, employ Info-Tech’s Project Intake and Prioritization Tool to start re-evaluating projects in the backlog. Make this data available to senior executives when prioritization occurs.

      Level 4: Aligned

      Use these descriptions to place your organization at the appropriate level of intake capability.

      Intake Occurs through a centralized process. Processes and skills are in place for follow-up.
      Approval Project approvals are based on business cases and aligned with future resource capacity.
      Prioritization Project prioritization is visibly aligned with business goals.

      Challenges

      • The process of developing business cases can be too cumbersome, distracting resources from actual project work.
      • “Future” resource capacity predictions are unreliable. Reactive support work and other factors frequently change actual resource availability.

      Long Term

      PMOs at this level can strive for more accurate and frequent resource forecasting, establishing a more accurate picture of project vs. non-project work within the year.

      Quick Win

      PMOs at this level can start using Info-Tech’s Business Case Template (Comprehensive or Fast Track) to help simplify the business case process.

      Level 5: Optimizing

      Use these descriptions to place your organization at the appropriate level of intake capability.

      Intake Occurs through a centralized portal. Processes and skills are in place for thorough follow-up.
      Approval Project approvals are based on business cases and aligned with future resource capacity.
      Prioritization Work is continuously prioritized to keep up with emerging challenges and opportunities.

      Challenges

      • Establishing a reliable forecast for resource capacity remains a concern at this level as well.
      • Organizations at this level may experience an increasing clash between Agile practices and traditional Waterfall methodologies.

      A screenshot of Info-Tech's Manage an Agile Portfolio Blueprint

      PMOs at this level should look at Info-Tech’s Manage an Agile Portfolio for comprehensive tools and guidance on maintaining greater visibility at the portfolio level into work in progress and committed work.

      Establish your current and target states for process intake, approval, and prioritization

      1.2.5 Estimated Time: 20 minutes

      • Having reviewed the intake capability framework, you should be able to quickly identify where you currently reside in the model. Document this in the “Current State” box below.
      • Next, spend some time as a group discussing your target state. Make sure to set a realistic target as well as a realistic timeframe for meeting this target. Level 1s will not be able to become Level 5s overnight and certainly not without passing through the other levels on the way.
        • A realistic goal for a Level 1 to become a Level 2 is within six to eight months.
      Current State:
      Target State:
      Timeline for meeting target

      INPUT

      • Intake, approval, and prioritization capability framework (Activity 1.2.4)

      OUTPUT

      • Current and target state, with stated time goals

      Materials

      • Whiteboard

      Participants

      • CIO
      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts

      Align your intake success with the strategic expectations of overall project portfolio management

      A successful project intake, approval, and prioritization process puts your leadership in a position to best steer the portfolio, like a conductor of an orchestra.

      To frame the discussion on deciding what intake success will look like, review Info-Tech’s PPM strategic expectations:

      • Project Throughput: Maximize throughput of the best projects.
      • Portfolio Visibility: Ensure visibility of current and pending projects.
      • Portfolio Responsiveness: Make the portfolio responsive to executive steering when new projects and changing priorities need rapid action.
      • Resource Utilization: Minimize resource waste and optimize the alignment of skills to assignments.
      • Benefits Realization: Clarify accountability for post-project benefits attainment for each project, and facilitate the process of tracking/reporting those benefits.
      A screenshot of Info-Tech's Develop a Project Portfolio Management Strategy blueprint.

      For a more detailed discussion and insight on PPM strategic expectations see Info-Tech’s blueprint, Develop a Project Portfolio Management Strategy.

      Decide what successful project intake, approval, prioritization process will look like

      1.2.6 Estimated Time: 60 minutes

      While assessing your current state, it is important to discuss and determine as a team how success will be defined.

      • During this process, it is important to consider tentative timelines for success milestones and to ask the question: what will success look like and when should it occur by?
      • Use the below table to help document success factors and timeliness. Follow the lead of our example in row 1.
      Optimization Benefit Objective Timeline Success Factor
      Facilitate project intake, prioritization, and communication with stakeholders to maximize time spent on the most valuable or critical projects. Look at pipeline as part of project intake approach and adjust priorities as required. July 1st Consistently updated portfolio data. Dashboards to show back capacity to customers. SharePoint development resources.

      Review and customize section 1.5, “Process Success Criteria” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      Info-Tech Insight

      Establish realistic short-term goals. Even with optimized intake procedures, you may not be able to eliminate underground project economies immediately. Make your initial goals realistic, leaving room for those walk-up requests that may still appear via informal channels.

      Prepare to optimize project intake and capture the results in the Intake, Approval, and Prioritization SOP

      Standard Operating Procedure (SOP) is the reference document to get all PPM stakeholders on the same page with the new optimized process.

      The current state explored and documented in this step will serve as a starting point for each step of the next phase of the blueprint. The next phase will take a deeper dive into each of the three components of Info-Tech’s project intake methodology, so that they can achieve the success criteria you’ve defined in the previous activity.

      Info-Tech’s Project Intake, Approval, and Prioritization SOP Template is intended to capture the outcome of your process optimization efforts. This blueprint guides you through numerous activities designed for your core project portfolio management team to customize each section.

      To maximize the chances of success, it is important that the team makes a concerted effort to participate. Schedule a series of working sessions over the course of several weeks for your team to work through it – or get through it in one week, with onsite Info-Tech analyst-facilitated workshops.

      Download Info-Tech’s Project Intake, Approval, and Prioritization SOP.

      A screenshot of Info-Tech's Project Intake, Approval, and Prioritization SOP.

      Contact your account representative or email Workshops@InfoTech.com for more information.

      Case study: PMO develops mature intake and prioritization processes by slowly evolving its capability level

      CASE STUDY

      Industry: Not-for-Profit

      Source: Info-Tech Interview

      Challenge

      • A PMO for a large not-for-profit benefits provider had relatively high project management maturity, but the enterprise had low PPM maturity.
      • There were strong intake processes in place for following up on requests. For small projects, project managers would assist as liaisons to help control scope. For corporate initiates, PMs were assigned to work with a sponsor to define scope and write a charter.

      Solution

      Prioritization was a challenge. Initially, the organization had ad hoc prioritization practices, but they had developed a scoring criteria to give more formality and direction to the portfolio. However, the activity of formally prioritizing proved to be too time consuming.

      Off-the-grid projects were a common problem, with initiatives consuming resources with no portfolio oversight.

      Results

      After trying “heavy” prioritization, the PMO loosened up the process. PMO staff now go through and quickly rank projects, with two senior managers making the final decisions. They re-prioritize quarterly to have discussions around resource availability and to make sure stakeholders are in tune to what IT is doing on a daily basis. IT has a monthly meeting to go over projects consuming resources and to catch anything that has fallen between the cracks.

      "Everything isn't a number one, which is what we were dealing with initially. We went through a formal prioritization period, where we painstakingly scored everything. Now we have evolved: a couple of senior managers have stepped up to make decisions, which was a natural evolution from us being able to assign a formal ranking. Now we are able to prioritize more easily and effectively without having to painstakingly score everything."

      – PMO Director, Benefits Provider

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

      Book a workshop with our Info-Tech analysts:

      A photo of an Info-Tech analyst is shown.
      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      1.1.1-2

      A screenshot of activities 1.1.1 and 1.1.2 are shown.

      Pilot Info-Tech’s Project Value Scorecard-driven prioritization method

      Use Info-Tech’s example to prioritize your current project backlog to pilot a project value-driven prioritization, which will be used to guide the entire optimization process.

      1.2.1-3

      A screenshot of activities 1.2.1 and 1.2.3 are shown.

      Map out and document current project intake, approval, and prioritization process, and the involved key stakeholders

      A table-top planning exercise helps you visualize the current process in place and identify opportunities for optimization.

      Phase 2

      Build an Optimized Project Intake, Approval, and Prioritization Process

      Phase 2 outline

      Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 2: Build an Optimized Project Intake, Approval, and Prioritization Process Proposed Time to Completion: 3-6 weeks

      Step 2.1: Streamline Intake

      Start with an analyst kick-off call:

      • Challenges of project intake
      • Opportunities for improving the management of stakeholder expectations by optimizing intake

      Then complete these activities…

      • Perform a process retrospective
      • Optimize your process to receive, triage, and follow up on project requests

      With these tools & templates:

      • Project Request Form.
      • Project Intake Classification Matrix

      Step 2.2: Right-Size Approval

      Start with an analyst call:

      • Challenges of project approval
      • Opportunities for improving strategic alignment of the project portfolio by optimizing project approval

      Then complete these activities…

      • Perform a process retrospective
      • Clarify accountability at each step
      • Decide on deliverables to support decision makers at each step

      With these tools & templates:

      • Benefits Commitment Form
      • Technology Assessment Tool
      • Business Case Templates

      Step 3.3: Prioritize Realistically

      Start with an analyst call:

      • Challenges in project prioritization
    • Opportunities for installing a resource capacity-constrained intake by optimizing prioritization
    • Then complete these activities…

      • Perform a process retrospective
      • Pilot the Intake and Prioritization Tool for prioritization within estimated resource capacity

      With these tools & templates:

      • Project Intake and Prioritization Tool

      Phase 2 Results & Insights:

      • Info-Tech’s methodology systemically fits the project portfolio into its triple constraint of stakeholder needs, strategic objectives, and resource capacity, to effectively address the challenges of establishing organizational discipline for project intake.

      Step 2.1: Streamline intake to manage stakeholder expectations

      PHASE 1 PHASE 2 PHASE 3

      1.1

      Define project valuation criteria

      1.2

      Envision process target state

      2.1

      Streamline intake

      2.2

      Right-size approval steps

      2.3

      Prioritize projects to fit resource capacity

      3.1

      Pilot your optimized process

      3.2

      Communicate organizational change

      This step will walk you through the following activities:

      • Perform a deeper retrospective on current project intake process
      • Optimize your process to receive project requests
      • Revisit the definition of a project for triaging requests
      • Optimize your process to triage project requests
      • Optimize your process to follow up on project requests

      This step involves the following participants:

      • PMO Director / Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Administrative Staff

      Outcomes of this Step

      • Retrospective of the current project intake process: to continue doing, to start doing, and to stop doing
      • A streamlined, single-funnel intake channel with the right procedural friction to receive project requests
      • A refined definition of what constitutes a project, and project levels that will determine the necessary standard of rigor with which project requests should be scoped and developed into a proposal throughout the process
      • An optimized process for triaging and following up on project requests to prepare them for the steps of project approval
      • Documentation of the optimized process in the SOP document

      Understand the risks of poor intake practices

      Too much red tape could result in your portfolio falling victim to underground economies. Too little intake formality could lead to the Wild West.

      Off-the-grid projects, i.e. projects that circumvent formal intake processes, lead to underground economies that can deplete resource capacity and hijack your portfolio.

      These underground economies are typically the result of too much intake red tape. When the request process is made too complex or cumbersome, project sponsors may unsurprisingly seek alternative means to get their projects done.

      While the most obvious line of defence against the appearance of underground economies is an easy-to-use and access request form, one must be cautious. Too little intake formality could lead to a Wild West of project intake where everyone gets their initiatives approved regardless of their business merit and feasibility.

      Benefits of optimized intake Risks of poor intake
      Alignment of portfolio with business goals Portfolio overrun by off-the-grid projects
      Resources assigned to high-value projects Resources assigned to low-value projects
      Better throughput of projects in the portfolio Ever-growing project backlog
      Strong stakeholder relations Stakeholders lose faith in value of PMO

      Info-Tech Insight

      Intake is intimately bound to stakeholder management. Finding the right balance of friction for your team is the key to successfully walking the line between asking for too much and not asking for enough. If your intake process is strong, stakeholders will no longer have any reason to circumvent formal process.

      An excess number of intake channels is the telltale sign of a low capability level for intake

      Excess intake channels are also a symptom of a portfolio in turmoil.

      If you relate to the graphic below in any way, your first priority needs to be limiting the means by which projects get requested. A single, centralized channel with review and approval done in batches is the goal. Otherwise, with IT’s limited capacity, most requests will simply get added to the backlog.

      A graphic is shown to demonstrate how one may receive project requests. The following icons are in a circle: Phone, Intranet Request Form, In person, anywhere, anytime, SharePoint Request Form, Weekly Scrum, Document, and Email.

      Info-Tech Insight

      The PMO needs to have the authority – and needs to exercise the authority – to enforce discipline on stakeholders. Organizations that solicit in verbal requests (by phone, in person, or during scrum) lack the orderliness required for PPM success. In these cases, it needs to be the mission of the PMO to demand proper documentation and accountability from stakeholders before proceeding with requests.

      "The golden rule for the project documentation is that if anything during the project life cycle is not documented, it is the same as if it does not exist or never happened…since management or clients will never remember their undocumented requests or their consent to do something."

      – Dan Epstein, “Project Initiation Process: Part Two”

      Develop an intake workflow

      Info-Tech recommends following a four-step process for managing intake.

      1. Requestor fills out form and submits the request.

      Project Request Form Templates

      2. Requests are triaged into the proper queue.

      1. Divert non-project request
      2. Quickly assess value and urgency
      3. Assign specialist to follow up on request
      4. Inform the requestor

      Project Intake Classification Matrix

      3. BA or PM prepares to develop requests into a project proposal.

      1. Follow up with requestor and SMEs to refine project scope, benefits, and risks
      2. Estimate size of project and determine the required level of detail for proposal
      3. Prepare for concept approval

      Benefits Commitment Form Template

      4. Requestor is given realistic expectations for approval process.

      Perform a start-stop-continue exercise to help determine what is working and what is not working

      2.1.1 Estimated Time: 45 minutes

      Optimizing project intake may not require a complete overhaul of your existing processes. You may only need to tweak certain templates or policies. Perhaps you started out with a strong process and simply lost resolve over time – in which case you will need to focus on establishing motivation and discipline, rather than rework your entire process.

      Perform a start-stop-continue exercise with your team to help determine what should be salvaged, what should be abandoned, and what should be introduced:

      1. On a whiteboard or equivalent, write “Start,” “Stop,” and “Continue” in three separate columns. 3. As a group, discuss the responses and come to an agreement as to which are most valid.
      2. Equip your team with sticky notes or markers and have them populate the columns with ideas and suggestions surrounding your current processes. 4. Document the responses to help structure your game plan for intake optimization.
      Start Stop Continue
      • Explicitly manage follow-up expectations with project requestor
      • Receiving informal project requests
      • Take too long in proposal development
      • Quarterly approval meetings
      • Approve resources for proposal development

      INPUT

      • Current project intake workflow (Activity 1.2.2)
      • Project intake success criteria (Activity 1.2.6)

      OUTPUT

      • Retrospective review of current intake process

      Materials

      • Whiteboard
      • Sticky notes/markers

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Streamline project requests into a single funnel

      It is important to identify all of the ways through which projects currently get requested and initiated, especially if you have various streams of intake competing with each other for resources and a place in the portfolio. Directing multiple channels into a single, centralized funnel is step number one in optimizing intake.

      To help you identify project sources within your organization, we’ve broken project requests into three archetypes: the good, the bad, and the ugly.

      1. The Good – Proper Requests: written formal requests that come in through one appropriate channel.

      The Bad – Walk-Ups: requests that do not follow the appropriate intake channel(s), but nevertheless make an effort to get into the proper queue. The most common instance of this is a portfolio manager or CIO filling out the proper project request form on behalf of, and under direction from, a senior executive.

      The Ugly – Guerilla Tactics: initiatives that make their way into the portfolio through informal methods or that consume portfolio resources without formal approval, authority, or oversight. This typically involves a key resource getting ambushed to work on a stakeholder’s “side project” without any formal approval from, or knowledge of, the PMO.

      Funnel requests through a single portal to streamline intake

      Decide how you would funnel project requests on a single portal for submitting project requests. Determining the right portal for your organization will depend on your current infrastructure options, as well as your current and target state capability levels.

      Below are examples of a platform for your project request portal.

      Platform Template document, saved in a repository or shared drive Email-based form (Outlook forms) Intranet form (SharePoint, internal CMS) Dedicated intake solution (PPM tool, idea/innovation tool)
      Pros Can be deployed very easily Consolidates requests into a single receiver Users have one place to go from any device All-in-one solution that includes scoring and prioritization
      Cons Manual submission and intake process consumes extra effort Can pose problems in managing requests across multiple people and platforms Requires existing intranet infrastructure and some development effort Solution is costly; requires adoption across all lines of business

      Increasing intake capability and infrastructure availability

      Introduce the right amount of friction into your intake process

      The key to an effective intake process is determining the right amount of friction to include for your organization. In this context, friction comes from the level of granularity within your project request form and the demands or level of accountability your intake processes place on requestors. You will want to have more or less friction on your intake form, depending on your current intake pain points.

      If you are inundated with a high volume of requests:

      • Make your intake form more detailed to deter “half-baked” requests.
      • Have more managerial oversight into the process. Require approval for each request.

      If you want to encourage the use of a formal channel:

      • Make your intake form more concise and lightweight.
      • Have less managerial oversight into the process. Inform managers of each request rather than requiring approval.

      Download Info-Tech’s Detailed Project Request Form.

      Download Info-Tech’s Light Project Request Form.

      A screenshot of Info-Tech's Project Request Form is shown.

      Info-Tech Insight

      Optimizing a process should not automatically mean reducing friction. Blindly reducing friction could generate a tidal wave of poorly thought-out requests, which only drives up unrealistic expectations. Mitigate the risk of unrealistic stakeholder expectations by carefully managing the message: optimize friction.

      Document your process to receive project requests

      2.1.2 Estimated Time: 30-60 minutes

      Review and customize section 2.2, “Receive project requests” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      The goal of optimizing this process is to consolidate multiple intake channels into a single funnel with the right amount of friction to improve visibility and manageability of incoming project requests.

      The important decisions to document for this step include:

      1. What data will be collected, and from whom? For example, Info-Tech’s Light Project Request Form Template will be used to collect project requests from everyone.
      2. How will requests be collected, and from where? For example, the template will be available as a fillable form on a SharePoint site.
      3. Who will be informed of the requests? For example, the PMO Director and the BA team will be notified with a hyperlink to the completed request form.
      4. Who will handle exceptions? For example, PMO will maintain this process and will handle any questions or issues that pertain to this part of the process.

      INPUT

      • Retrospective of current process (Activity 2.1.1)

      OUTPUT

      • Customized Project Request Form
      • Method of implementation

      Materials

      • Project Request Form Templates

      Participants

      • PMO Director/ Portfolio Manager
      • Business Analysts

      Info-Tech Best Practice

      Whatever method of request collection you choose, ensure there is no doubt about how requesters can access the intake form.

      Establish a triage process to improve portfolio success

      Once a request has been submitted, it will need to be triaged. Triage begins as soon as the request is received. The end goal of the triage process is to set appropriate expectations for stakeholders and to ensure that all requests going forward for approval are valid requests.

      PPM Triage Process

      1. Divert non-project requests by validating that what is described on the request form qualifies as a “project.” Make sure requests are in the appropriate queue – for example, service desk request queue, change and release management queue, etc.
      2. Quickly assess value and urgency to determine whether the request requires fast-tracking or any other special consideration.
      3. Assign a specialist to follow up on the request. Match the request to the most suitable BA, PM, or equivalent. This person will become the Request Liaison (“RL”) for the request and will work with the requestor to define preliminary requirements.
      4. Inform the requestor that the request has been received and provide clear direction on what will happen with the request next, such as who will follow up on it and when. See the next slide for some examples of this follow-up.

      The PMO Triage Team

      • Portfolio Manager, or equivalent
      • Request Liaisons (business analysts, project managers, or equivalent)

      “Request Liaison” Role

      The BAs and PMs who follow up on requests play an especially important role in the triage process. They serve as the main point of contact to the requestor as the request evolves into a business case. In this capacity they perform a valuable stakeholder management function, helping to increase confidence and enhance trust in IT.

      To properly triage project requests, define exactly what a project is

      Bring color to the grey area that can exist in IT between those initiatives that fall somewhere in between “clearly a service ticket” and “clearly a project.”

      What constitutes a project?

      Another way of asking this question that gets more to the point for this blueprint – for what types of initiatives is project intake, approval, and prioritization rigor required?

      This is especially true in IT where, for some smaller initiatives, there can be uncertainty in many organizations during the intake and initiation phase about what should be included on the formal project list and what should go to help desk’s queue.

      As the definitions in the table below show, formal project management frameworks each have similar definitions of “a project.”

      Source Definition
      PMI A temporary endeavor undertaken to create a unique product, service, or result.” (553)
      COBIT A structured set of activities concerned with delivering a defined capability (that is necessary but not sufficient to achieve a required business outcome) to the enterprise based on an agreed‐on schedule and budget.” (74)
      PRINCE2 A temporary organization that is created for the purpose of delivering one or more business products according to an agreed business case.

      For each, a project is a temporary endeavor planned around producing a specific organizational/business outcome. The challenge of those small initiatives in IT is knowing when those endeavors require a business case, formal resource tracking, and project management rigor, and when they don’t.

      Separating small projects from non-projects requires a consideration of approval rights

      While conventional wisdom says to base your project definition on an estimation of cost, risk, etc., you also need to ask, “does this initiative require formal approval?”

      In the next step, we will define a suggested minimum threshold for a small “level 1” project. While these level thresholds are good and necessary for a number of reasons – including triaging your project requests – you may still often need to exercise some critical judgment in separating the tickets from the projects. In addition to the level criteria that we will develop in this step, use the checklist below to help with your differentiating.

      Service Desk Ticket Small Project
      • Approval seems implicit given the scope of the task.
      • No expectations of needing to report on status.
      • No indications that management will require visibility during execution.
      • The scope of the task suggests formal approval may be required.
      • You may have to report on status.
      • Possibility that management may require visibility during execution.

      Info-Tech Insight

      Guard the value of the portfolio. Because tickets carry with them an implicit approval, you need to be wary at the portfolio level of those that might possess a larger scope than their status of ticket implies. Sponsors that, for whatever reason, resist the formal intake process may use the ticketing process to sneak projects in through the backdoor. When assessing tickets and small projects at the portfolio level, you need to ask: is it possible that someone at an executive level might want to get updates on this because of its duration, scope, risk, cost, etc.? Could someone at the management level get upset that the initiative came in as a ticket and is burning up time and driving costs without any visibility?

      Sample Project/Non-Project Separation Criteria

      Non-Project Small Project
      e.g. Time required e.g. < 40 hours e.g. 40 > hours
      e.g. Complexity e.g. Very low e.g. Moderate – Low Difficulty: Does not require highly developed or specialized skill sets
      e.g. Collaboration e.g. None required e.g. Limited coordination and collaboration between resources and departments
      e.g. Repeatability of work e.g. Fully repeatable e.g. Less predictable
      e.g. Frequency of request type e.g. Hourly to daily e.g. Weekly to monthly

      "If you worked for the help desk, over time you would begin to master your job since there is a certain rhythm and pattern to the work…On the other hand, projects are unique. This characteristic makes them hard to estimate and hard to manage. Even if the project is similar to one you have done before, new events and circumstances will occur. Each project typically holds its own challenges and opportunities"

      – Jeffrey and Thomas Mochal

      Define the minimum-threshold criteria for small projects

      2.1.3 Estimated Time: 30 minutes

      Follow the steps below to define the specifics of a “level 1” project for your organization.

      1. Using your project list and/or ticketing system, identify a handful of small projects, large service desk tickets, and especially those items that fall somewhere in the grey area in between (anywhere between 10 to 20 of each). Then, determine the organizationally appropriate considerations for defining your project levels. Options include:
      • Duration
      • Budget/Cost
      • Technology requirements
      • Customer involvement
      • Integration
      • Organizational impact
      • Complexity
      • Number of cross-functional workgroups and teams involved
    • Using the list of projects established in the previous step, determine the organizationally appropriate considerations for defining your project levels –anywhere from four to six considerations is a good number.
    • Using these criteria and your list of small projects, define the minimum threshold for your level one projects across each of these categories. Record these thresholds in the table on the next slide.
    • INPUT

      • Data concerning small projects and service desk tickets, including size, duration, etc.

      OUTPUT

      • Clarity around how to define your level 1 projects

      Materials

      • Whiteboard

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts

      Remove room for stakeholder doubt and confusion by informing requests forward in a timely manner

      During triaging, requestors should be notified as quickly as possible (a) that their request has been received and (b) what to expect next for the request. Make this forum as productive and informative as possible, providing clear direction and structure for the future of the request. Be sure to include the following:

      • A request ID or ticket number.
      • Some direction on who will be following up on the request –provide an individual’s name when possible.
      • An estimated timeframe of when they can expect to hear from the individual following up.

      The logistic of this follow-up will depend on a number of different factors.

      • The number of requests you receive.
      • Your ability to automate the responses.
      • The amount of detail you would like to, or need to, provide stakeholders with.

      Info-Tech Best Practice

      Assign an official request number or project ID to all requests during this initial response. An official request number anchors the request to a specific and traceable dataset that will accompany the project throughout its lifecycle.

      Sample “request received” emails

      If you receive a high volume of requests or need a quick win for improving stakeholder relations:

      Sample #1: Less detailed, automatic response

      Hello Emma,

      Thank you. Your project request has been received. Requests are reviewed and assigned every Monday. A business analyst will follow up with you in the next 5-10 business days. Should you have any questions in the meantime, please reply to this email.

      Best regards,

      Information Technology Services

      If stakeholder management is a priority, and you want to emphasize the customer-facing focus:

      Sample #2: More detailed, tailored response

      Hi Darren,

      Your project request has been received and reviewed. Your project ID number is #556. Business analyst Alpertti Attar has been assigned to follow up on your request. You can expect to hear from him in the next 5-10 business days to set up a meeting for preliminary requirements gathering.

      If you have any questions in the meantime, please contact Alpertti at aattar@projectco.com. Please include the Project ID provided in this email in all future correspondences regarding this request.

      Thank you for your request. We look forward to helping you bring this initiative to fruition.

      Sincerely,

      Jim Fraser

      PMO Director, Information Technology Services

      Info-Tech Insight

      A simple request response will go a long way in terms of stakeholder management. It will not only help assure stakeholders that their requests are in progress but the request confirmation will also help to set expectations and take some of the mystery out of IT’s processes.

      Document your process to triage project requests

      2.1.4 Estimated Time: 30-60 minutes

      Review and customize section 2.3, “Triage project requests” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      The goal of optimizing this process is to divert non-project requests and set an appropriate initial set of stakeholder expectations for next steps. The important decisions to document for this step include:

      1. What defines a project? Record the outcomes of Activities 2.1.3 into the SOP.
      2. Who triages the requests and assign request liaisons? Who are they? For example, a lead BA can assign a set roster of BAs to project requests.
      3. What are the steps to follow for sending the initial response? See the previous slides on automated responses vs. detailed, tailored responses.
      4. How will you account for the consumption of resource capacity? For example, impose a maximum of four hours per week per analyst, and track the hours worked for each request to establish a pattern for capacity consumption.
      5. Who will handle exceptions? For example, PMO will maintain this process and will handle any questions or issues that pertain to this part of the process.

      INPUT

      • Results of activity 2.1.3

      OUTPUT

      • SOP for triaging project requests

      Materials

      • SOP Template

      Participants

      • PMO Director/ Portfolio Manager
      • Business Analysts

      Info-Tech Best Practice

      Whatever method of request collection you choose, ensure there is no doubt about how requesters can access the intake form.

      Follow up on requests to define project scope and set realistic expectations

      The purpose of this follow-up is to foster communication among the requestor, IT, and the sponsor to scope the project at a high level. The follow-up should:

      • Clarify the goals and value of the request.
      • Begin to manage expectations based on initial assessment of feasibility.
      • Ensure the right information is available for evaluating project proposals downstream. Every project should have the below key pieces of scope defined before any further commitments are made.

      Focus on Defining Key Pieces of Scope

      • Budget (funding, source)
      • Business outcome
      • Completion criteria
      • Timeframes (start date and duration)
      • Milestones/deliverables

      Structure the Follow-Up Process to Enhance Alignment Between IT and the Business

      Once a Request Liaison (RL) has been assigned to a request, it is their responsibility to schedule time (if necessary) with the requestor to perform a scoping exercise that will help define preliminary requirements. Ideally, this follow-up should occur no later than a week of the initial request.

      Structure the follow-up for each request based on your preliminary estimates of project size (next slide). Use the “Key Pieces of Scope” to the left as a guide.

      It may also be helpful for RLs and stakeholders to work together to produce a rough diagram or mock-up of the final deliverable. This will ensure that the stakeholder’s idea has been properly communicated, and it could also help refine or broaden this idea based on IT’s capabilities.

      After the scoping exercise, it is the RL’s responsibility to inform the requestor of next steps.

      Info-Tech Insight

      More time spent with stakeholders defining high-level requirements during the ideation phase is key to project success. It will not only improve the throughput of projects, but it will enhance the transparency of IT’s capacity and enable IT to more effectively support business processes.

      Perform a preliminary estimation of project size

      Project estimation is a common pain point felt by many organizations. At this stage, a range-of-magnitude (ROM) estimate is sufficient for the purposes of sizing the effort required for developing project proposals with appropriate detail.

      A way to structure ROM estimates is to define a set of standard project levels. It will help you estimate 80% of projects with sufficient accuracy over time with little effort. The remaining 20% of projects that don’t meet their standard target dates can be managed as exceptions.

      The increased consistency of most projects will enable you to focus more on managing the exceptions.

      Example of standard project sizes:

      Level Primary unit of estimation Target completion date*
      1 Weeks 3 weeks – 3 months
      2 Months 3 months – 6 months
      3 Quarters 2 – 4 quarters
      3+ Years 1 year or more

      * Target completion date is simply that – a target, not a service level agreement (SLA). Some exceptions will far exceed the target date, e.g. projects that depend heavily on external or uncontrollable factors.

      Info-Tech Best Practice

      Project levelling is useful for right-sizing many downstream processes; it sets appropriate levels of detail and scrutiny expected for project approval and prioritization steps, as well as the appropriate extent of requirements gathering, project management, and reporting requirements afterwards.

      Set your thresholds for level 2 and level 3 projects

      2.1.5 Estimated Time: 30 minutes

      Now that the minimum threshold for your smallest projects has been identified, it’s time to identify the maximum threshold in order to better apply project intake, approval, and prioritization rigor where it’s needed.

      1. Looking at your project list (e.g. Activity 1.1.1, or your current project backlog), isolate the medium and large projects. Examine the two categories in turn.
      2. Start with the medium projects. Using the criteria identified in Activity 2.1.3, identify where your level one category ends.
      • What are the commonly recurring thresholds that distinguish medium-sized projects from smaller initiatives?
      • Are there any criteria that would need to take on a greater importance when making the distinction? For instance, will cost or duration take on a greater weighting when determining level thresholds?
      • Once you have reached consensus, record these in the table on the next slide.
    • Now examine your largest projects. Once again relying on the criteria from Activity 2.1.3, determine where your medium-sized projects end and your large projects begin.
      • What are the commonly recurring thresholds that distinguish large and extra-large projects from medium-sized initiatives?
      • Once you have reached consensus, records these in the table on the next slide.

      INPUT

      • Leveling criteria from Activity 2.1.3
      • Project backlog, or list of projects from Activity 1.1.1

      OUTPUT

      • Clarity around how to define your level two and three projects

      Materials

      • Whiteboard
      • The project level table on the next slide

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Sample Project Levels Table

      Project Level Level 1 Level 2 Level 3
      Work Effort 40-100 hours 100-500 hours 500+ hours
      Budget $100,000 and under $100,000 to $500,000 $500,000 and over
      Technology In-house expertise Familiar New or requires system-wide change/training
      Complexity Well-defined solution; no problems expected Solution is known; some problems expected Solution is unknown or not clearly defined
      Cross-Functional Workgroups/Teams 1-2 3-5 > 6

      Apply a computation decision-making method for project levelling

      2.1.5 Project Intake Classification Matrix

      Capture the project levels in Info-Tech’s Project Intake Classification Matrix Tool to benchmark your levelling criteria and to determine project levels for proposed projects.

      Download Info-Tech’s Project Intake Classification Matrix tool.

      A screenshot of Info-Tech's Project Intake Classification Matrix Tool, tab 2 is shown.
      1. Pick a category to define project levels.
      2. Enter the descriptions for each project level.
      3. Assign a relative weight for each category.
      4. A screenshot of Info-Tech's Project Intake Classification Matrix Tool, tab 3 is shown.
      5. Enter a project name.
      6. Choose the description that best fits the project. If unknown, leave it blank.
      7. Suggested project levels are displayed.

      Get tentative buy-in and support from an executive sponsor for project requests

      In most organizations a project requires sponsorship from the executive layer, especially for strategic initiatives. The executive sponsor provides several vital factors for projects:

      • Funding and resources
      • Direct support and oversight of the project leadership
      • Accountability, acting as the ultimate decision maker for the project
      • Ownership of, and commitment to, project benefits

      Sometimes a project request may be made directly by a sponsor; in other times, the Request Liaison may need to connect the project request to a project sponsor.

      In either case, project request has a tentative buy-in and support of an executive sponsor before a project request is developed into a proposal and examined for approval – the subject of this blueprint’s next step.

      PMs and Sponsors: The Disconnect

      A study in project sponsorship revealed a large gap between the perception of the project managers and the perception of sponsors relative to the sponsor capability. The widest gaps appear in the areas of:

      • Motivation: 34% of PMs say sponsors frequently motivate the team, compared to 82% of executive sponsors who say they do so.
      • Active listening: 42% of PMs say that sponsors frequently listen actively, compared to 88% of executive sponsors who say they do so.
      • Effective communication: 47% of PMs say sponsors communicate effectively and frequently, compared to 92% of executive sponsors who say they do so.
      • Managing change: 37% of PMs say sponsors manage change, compared to 82% of executive sponsors who say they do so.

      Source: Boston Consulting Group/PMI, 2014

      Actively engaged executive sponsors continue to be the top driver of whether projects meet their original goals and business intent.

      – PMI Pulse of the Profession, 2017

      76% of respondents [organizations] agree that the role of the executive sponsor has grown in importance over the past five years.

      – Boston Consulting Group/PMI, 2014

      Document your process to follow up on project requests

      2.1.6 45 minutes

      Review and customize section 2.4, “Follow up on project requests” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      The goal of optimizing this process is to initiate communication among the requestor, IT, and the sponsor to scope the project requests at a high level. The important decisions to document for this step include:

      1. How will you perform a scoping exercise with the requestor? Leverage existing organizational processes (e.g. high-level requirements gathering). Look to the previous slides for suggested outcomes of the exercise.
      2. How will you determine project levels? Record the outcomes of activities 2.1.5 into the SOP.
      3. How will the RL follow up on the scoped project request with a project sponsor? For example, project requests scoped at a high level will be presented to senior leadership whose lines of business are affected by the proposed project to gauge their initial interest.
      4. How will you account for the consumption of resource capacity? For example, impose a maximum of 8 hours per week per analyst, and track the hours worked for each request to establish a pattern for capacity consumption.
      5. Who will handle exceptions? For example, PMO will maintain this process and will handle any questions or issues that pertain to this part of the process.

      INPUT

      • Activity 2.1.5
      • Existing processes for scoping exercises

      OUTPUT

      • SOP for following up on project requests

      Materials

      • SOP Template

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Examine the new project intake workflow as a whole and document it in a flow chart

      2.1.7 Estimated Time: 30-60 minutes

      Review and customize section 2.1, “Project Intake Workflow” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      In Step 1.2 of the blueprint, you mapped out the current project intake, approval, and prioritization workflow and documented it in a flow chart. In this step, take the time to examine the new project intake process as a whole, and document the new workflow in the form of a flow chart.

      1. Requestor fills out form and submits the request.
      2. Requests are triaged into the proper queue.
      3. BA or PM prepares to develop requests into a project proposal.
      4. Requestor is given realistic expectations for approval process.

      Consider the following points:

      1. Are the inputs and outputs of each step clear? Who’s doing the work? How long will each step take, on average?
      2. Is the ownership of each step clear? How will we ensure a smooth handoff between each step and prevent requests from falling through the cracks?

      INPUT

      • New process steps for project intake (Activities 2.1.2-6)

      OUTPUT

      • Flowchart representation of new project intake workflow

      Materials

      • Microsoft Visio, flowchart software, or Microsoft PowerPoint

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Case study: Portfolio manager achieves intake and project success through detailed request follow-up

      Case Study

      Industry: Municipal Government

      Source: Info-Tech Client

      Challenge

      • There is an IT department with a relatively high level of project management maturity.
      • They have approximately 30 projects on the go, ranging from small to large.
      • To help with intake, IT assembled a project initiation team. It was made up of managers from throughout the county. This group “owned the talent” and met once a month to assess requests. As a group, they were able to assemble project teams quickly.

      Solution

      • Project initiation processes kept failing. A lot of time was spent within IT getting estimations precise, only to have sponsors reject business cases because they did not align with what those sponsors had in mind.
      • Off-the-grid projects were a challenge. Directors did not follow intake process and IT talent was torn in multiple directions. There was nothing in place for protecting the talent and enforcing processes on stakeholders.

      Results

      • IT dedicated a group of PMs and BAs to follow up on requests.
      • Working with stakeholders, this group collects specific pieces of information that allows IT to get to work on requests faster. Through this process, requests reach the charter stage more quickly and with greater success.
      • An intake ticketing system was established to protect IT talent. Workers are now better equipped to redirect stakeholders through to the proper channels.

      Step 2.2: Set up steps of project approval to maximize strategic alignment while right-sizing the required effort

      PHASE 1 PHASE 2 PHASE 3

      1.1

      Define project valuation criteria

      1.2

      Envision process target state

      2.1

      Streamline intake

      2.2

      Right-size approval steps

      2.3

      Prioritize projects to fit resource capacity

      3.1

      Pilot your optimized process

      3.2

      Communicate organizational change

      This step will walk you through the following activities:

      • Perform a deeper retrospective on current project approval process
      • Define the approval steps, their accountabilities, and the corresponding terminologies for approval
      • Right-size effort and documentation required for each project level through the approval steps

      This step involves the following participants:

      • PMO Director / Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Administrative Staff

      Outcomes of this step

      • Retrospective of the current project intake process: to continue doing, to start doing, and to stop doing
      • A series of approval steps are defined, in which their accountabilities, responsibilities, and the nomenclature for what is approved at each steps are clarified and documented
      • A toolbox of deliverables for proposed projects that captures key information developed to inform project approval decisions at each step of the approval process, and the organizational standard for what to use for which project level
      • Documentation of the optimized process in the SOP document

      Set up an incremental series of approval stage-gates to tackle common challenges in project approval

      This section will help you address key challenges IT leaders face around project approval.

      Challenges Info-Tech’s Advice
      Project sponsors receive funding from their business unit or other source (possibly external, such as a grant), and assume this means their project is “approved” without any regard to IT costs or resource constraints. Clearly define a series of approval steps, and communicate requirements for passing them.
      Business case documentation is rarely updated to reflect unforeseen costs, emerging opportunities, and changing priorities. As a result, time and money is spent finishing diminished priority projects while the value of more recent projects erodes in the backlog. Approve projects in smaller pieces, with early test/pilot phases focused on demonstrating the value of later phases.
      Project business cases often focus on implementation and overlook ongoing operating costs imposed on IT after the project is finished. These costs further diminish IT’s capacity for new projects, unless investment in more capacity (such as hiring) is included in business cases. Make ongoing support and maintenance costs a key element in business case templates and evaluations.
      Organizations approve new projects without regard to the availability of resource capacity (or lack thereof). Project lead times grow and stakeholders become more dissatisfied because IT is unable to show how the business is competing with itself for IT’s time. Increase visibility into what IT is already working on and committed to, and for whom.

      Develop a project approval workflow

      Clearly define a series of approval steps, and communicate requirements for passing them. “Approval” can be a dangerous word in project and portfolio management, so it is important to clarify what is required to pass each step, and how long the process will take.

      1 2 3 4
      Approval step Concept Approval Feasibility Approval Business Case Approval Resource Allocation (Prioritization)
      Alignment Focus Business need / Project sponsorship Technology Organization-wide business need Resource capacity
      Possible dispositions at each gate
      • Approve developing project proposal
      • Reject concept
      • Proceed to business case approval
      • Approve a test/pilot project for feasibility
      • Reject proposal
      • Approve project and funding in full
      • Approve a test/pilot project for viability
      • Reject proposal
      • Begin or continue project work
      • Hold project
      • Outsource project
      • Reject project
      Accountability e.g. Project Sponsor e.g. CIO e.g. Steering Committee e.g. CIO
      Deliverable Benefits Commitment Form Template Proposed Project Technology Assessment Tool Business Case (Fast Track, Comprehensive) Intake and Prioritization Tool

      Identify the decision-making paradigm at each step

      In general, there are three different, mutually exclusive decision-making paradigms for approving projects:

      Paradigm Description Benefits Challenges Recommendation
      Unilateral authority One individual makes decisions. Decisions tend to be made efficiently and unambiguously. Consistency of agenda is easier to preserve. Decisions are subject to one person’s biases and unseen areas. Decision maker should solicit and consider input from others and seek objective rigor.
      Ad hoc deliberation Stakeholders informally negotiate and communicate decisions between themselves. Deliberation helps ensure different perspectives are considered to counterbalance individual biases and unseen areas. Ad hoc decisions tend to lack documentation and objective rationale, which can perpetuate disagreement. Use where unilateral decisions are unfeasible (due to complexity, speed of change, culture, etc.), and stakeholders are very well aligned or highly skilled negotiators and communicators.
      Formal steering committee A select group that represent various parts of the organization is formally empowered to make decisions for the organization. Formal committees can ensure oversight into decisions, with levers available to help resolve uncertainty or disagreement. Formal committees introduce administrative overhead and effort that might not be warranted by the risks involved. Formal steering committees are best where formality is warranted by the risks and costs involved, and the organizational culture has an appetite for administrative oversight.

      Info-Tech Insight

      The individual or party who has the authority to make choices, and who is ultimately answerable for those decisions, is said to be accountable. Understanding the needs of the accountable party is critical to the success of the project approval process optimization efforts.

      Perform a start-stop-continue exercise to help determine what is working and what is not working

      2.2.1 Estimated Time: 45 minutes

      Optimizing project approval may not require a complete overhaul of your existing processes. You may only need to tweak certain templates or policies. Perhaps you started out with a strong process and simply lost resolve over time – in which case you will need to focus on establishing motivation and discipline, rather than rework your entire process.

      Perform a start-stop-continue exercise with your team to help determine what should be salvaged, what should be abandoned, and what should be introduced:

      1.On a whiteboard or equivalent, write “Start,” “Stop,” and “Continue” in three separate columns. 3.As a group, discuss the responses and come to an agreement as to which are most valid.
      2.Equip your team with sticky notes or markers and have them populate the columns with ideas and suggestions surrounding your current processes. 4.;Document the responses to help structure your game plan for intake optimization.
      StartStopContinue
      • Inject technical feasibility approval step as an input to final approval
      • Simplify business cases
      • Approve low-value projects
      • Take too long in proposal development
      • Quarterly approval meetings
      • Approve resources for proposal development

      INPUT

      • Current project approval workflow (Activity 1.2.2)
      • Project approval success criteria (Activity 1.2.6)

      OUTPUT

      • Retrospective review of current approval process

      Materials

      • Whiteboard
      • Sticky notes/markers

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Customize the approval steps and describe them at a high level

      2.2.2 Estimated Time: 30-60 minutes

      Review and customize section 3.2, “Project Approval Steps” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      The goal of this activity is to customize the definition of the approval steps for your organization, so that it makes sense for the existing organizational governance structure, culture, and need. Use the results of the start-stop-continue to inform what to customize. Consider the following factors:

      1. Order of steps: given the current decision-making paradigm, does it make sense to reorder the steps?
      2. Dispositions at each step: what are the possible dispositions, and who is accountable for making the dispositions?
      3. Project levels: do all projects require three-step approval before they’re up for prioritization? For example, IT steering committee may wish to be involved only for Level 3 projects and Level 2 projects with significant business impact, and not for Level 1 projects and IT-centric Level 2 projects.
      4. Accountability at each step: who makes the decisions?
      5. Who will handle exceptions? Aim to prevent the new process from being circumvented by vocal stakeholders, but also allow for very urgent requests. A quick win to strike this balance is to clarify who will exercise this discretion.

      INPUT

      • Retrospective of current process (Activity 2.2.1)
      • Project level definition
      • Approval steps in the previous slide

      OUTPUT

      • Customized project approval steps for each project level

      Materials

      • Whiteboard

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Specify what “approval” really means to manage expectations for what project work can be done and when

      2.2.3 Estimated Time: 15 minutes

      Review and customize section 3.2, “Project Approval Steps” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      In the old reality, projects were approved and never heard back from again, which effectively gave your stakeholders a blanket default expectation of “declined.” With the new approval process, manage your stakeholder expectations more explicitly by refining your vocabulary around approval.

      Within this, decision makers should view their role in approval as approving that which can and should be done. When a project is approved and slated to backlog, the intention should be to allocate resources to it within the current intake cycle.

      Customize the table to the right with organizationally appropriate definitions, and update your SOP.

      “No” Declined.
      “Not Now” “It’s a good idea, but the time isn’t right. Try resubmitting next intake cycle.”
      “Concept Approval” Approval to add the item to the backlog with the intention of starting it this intake cycle.
      “Preliminary Approval” Approval for consumption of PMO resources to develop a business case.
      “Full Approval” Project is greenlighted and project resources are being allocated to it.

      Info-Tech Insight

      Refine the nomenclature. Add context to “approved” and “declined.” Speak in terms of “not now” or “you can have it when these conditions are met.” With clear expectations of the resources required to support each request, you can place accountability for keeping the request alive back on the sponsors.

      Continuously work out a balance between disciplined decision making and “analysis paralysis"

      A graph is depicted to show the relationship between disciplined decision making and analysis paralysis. The sweet spot for disciplined decisions changes between situations and types of decisions.

      A double bar graph is depicted to show the relative effort spent on management practice. The first bar shows that 20% has a high success of portfolio management. 35% has a low success of portfolio management. A caption on the graph: Spending additional time assessing business cases doesn’t necessarily improve success.

      Info-Tech Insight

      Estimates that form the basis of business cases are often based on flawed assumptions. Use early project phases or sprints to build working prototypes to test the assumptions on which business cases are built, rather than investing time improving precision of estimates without improving accuracy.

      Right-size project approval process with Info-Tech’s toolbox of deliverables

      Don’t paint every project with the same brush. Choose the right set of information needed for each project level to maximize the throughput of project approval process.

      The next several slides will take you through a series of tools and templates that help guide the production of deliverables. Each deliverable wireframes the required analysis of the proposed project for one step of the approval process, and captures that information in a document. This breaks down the overall work for proposal development into digestible chunks.

      As previously discussed, aim to right-size the approval process rigor for project levels. Not all project levels may call for all steps of approval, or the extent of required analysis within an approval step may differ. This section will conclude by customizing the requirement for deliverables for each project level.

      Tools and Templates for the Project Approval Toolbox

      • Benefits Commitment Form Template (.xlsx) Document the project sponsor’s buy-in and commitment to proposed benefits in a lightweight fashion.
      • Proposed Technology Assessment Tool (.xlsx) Determine the proposed project’s readiness for adoption from a technological perspective.
      • Business Case Templates (.docx) Guide the analysis process for the overall project proposal development in varying levels of detail.

      Use Info-Tech’s lightweight Benefits Commitment Form Template to document the sponsor buy-in and support

      2.2.4 Benefits Commitment Form Template

      Project sponsors are accountable for the realization of project benefits. Therefore, for a project to be approved by a project sponsor, they must buy-in and commit to the proposed benefits.

      Defining project benefits and obtaining project sponsor commitment has been demonstrated to improve the project outcome by providing the focal point of the project up-front. This will help reduce wasted efforts to develop parts of the proposals that are not ultimately needed.

      A double bar graph titled: Benefits realization improves project outcome is shown.

      Download Info-Tech’s Benefits Commitment Form Template.

      Contents of a Benefits Commitment Form

      • One-sentence highlight of benefits and risks
      • Primary benefit, hard (quantitative) and soft (qualitative)
      • Proposed measurements for metrics
      • Responsible and accountable parties for benefits
      A screenshot of Info-Tech's Establish the Benefits Realization Process blueprint is shown.

      For further discussion on benefits realization, use Info-Tech’s blueprint, Establish the Benefits Realization Process.

      Use Info-Tech’s Proposed Project Technology Assessment Tool to analyze a technology’s readiness for adoption

      2.2.4 Proposed Project Technology Assessment Tool

      In some projects, there needs to be an initial idea of what the project might look like. Develop a high-level solution for projects that:

      • Are very different from previous projects.
      • Are fairly complex, or not business as usual.
      • Require adoption of new technology or skill set.

      IT should advise and provide subject matter expertise on the technology requirements to those that ultimately approve the proposed projects, so that they can take into account additional costs or risks that may be borne from it.

      Info-Tech’s Proposed Project Technology Assessment Tool has a series of questions to address eight categories of considerations to determine the project’s technological readiness for adoption. Use this tool to ensure that you cover all the bases, and help you devise alternate solutions if necessary – which will factor into the overall business case development.

      Download Info-Tech’s Proposed Project Technology Assessment Tool.

      A screenshot of Info-Tech's Proposed Project Technology Assessment Tool is shown.

      Enable project valuation beyond financial metrics with Info-Tech’s Business Case Templates

      2.2.4 Business Case Template (Comprehensive and Fast Track)

      Traditionally, a business case is centered around financial metrics. While monetary benefits and costs are matters of bottom line and important, financial metrics are only part of a project’s value. As the project approval decisions must be based on the holistic comparison of project value, the business case document must capture all the necessary – and only those that are necessary – information to enable it.

      However, completeness of information does not always require comprehensiveness. Allow for flexibility to speed up the process of developing business plan by making a “fast-track” business case template available. This enables the application of the project valuation criteria with all other projects, with right-sized effort.

      Alarming business case statistics

      • Only one-third of companies always prepare a business case for new projects.
      • Nearly 45% of project managers admit they are unclear on the business objectives of their IT projects.

      (Source: Wrike)

      Download Info-Tech’s Comprehensive Business Case Template.

      A screenshot of Info-Tech's Comprehensive Business Case Template is shown.

      Download Info-Tech’s Fast Track Business Case Template.

      A screenshot of Info-Tech's Fast Track Business Case Template is shown.

      Info-Tech Insight

      Pass on that which is known. Valuable information about projects is lost due to a disconnect between project intake and project initiation, as project managers are typically not brought on board until project is actually approved. This will be discussed more in Phase 3 of this blueprint.

      Document the right-sized effort and documentation required for each project level

      2.2.4 Estimated Time:60-90 minutes

      Review and customize section 3.3, “Project Proposal Deliverables” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      The goal of this activity is to customize the requirements for project proposal deliverables, so that it properly informs each of the approval steps discussed in the previous activity. The deliverables will also shape the work effort required for projects of various levels. Consider the following factors:

      1. Project levels: what deliverables should be required, recommended, or suggested for each of the project levels? How will exceptions be handled, and who will be accountable?
      2. Existing project proposal documents: what existing proposal documents, tools and templates can we leverage for the newly optimized approval steps?
      3. Skills availability: do these tools and templates represent a significant departure from the current state? If so, is there capacity (time and skill) to achieve the desired target state?
      4. How will you account for the consumption of resource capacity? Do a rough order of estimate for the resource capacity consumed the new deliverable standard.
      5. Who will handle exceptions? For example, PMO will maintain this process and will handle any questions or issues that pertain to this part of the process.

      INPUT

      • Process steps (Activity 2.2.2)
      • Current approval workflow(Activity 1.2.1)
      • Artifacts introduced in the previous slides

      OUTPUT

      • Requirement for artifacts and effort for each approval step

      Materials

      • Whiteboard

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Examine the new project approval workflow as a whole and document it in a flow chart

      2.2.5 Estimated Time: 30-60 minutes

      Review and customize section 3.1, “Project Approval Workflow” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      In Step 1.2 of the blueprint, you mapped out the current project intake, approval, and prioritization workflow and documented it in a flow chart. In this step, take the time to examine the new project intake process as a whole, and document the new workflow in the form of a flow chart.

      1 2 3 4
      Approval Step Concept Approval Feasibility Approval Business Case Approval Resource Allocation (Prioritization)
      Alignment Focus Business need/ Project Sponsorship Technology

      Organization-wide

      Business need

      Resource capacity

      Consider the following points:

      1. Are the inputs and outputs of each step clear? Who’s doing the work? How long will each step take, on average?
      2. Is the ownership of each step clear? How will we ensure a smooth hand-off between each step and prevent requests from falling through the cracks?

      INPUT

      • New process steps for project approval (Activities 2.2.2-4)

      OUTPUT

      • Flowchart representation of new project approval workflow

      Materials

      • Microsoft Visio, flowchart software, or Microsoft PowerPoint

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Step 2.3: Prioritize projects to maximize the value of the project portfolio within the constraint of resource capacity

      PHASE 1 PHASE 2 PHASE 3

      1.1

      Define project valuation criteria

      1.2

      Envision process target state

      2.1

      Streamline intake

      2.2

      Right-size approval steps

      2.3

      Prioritize projects to fit resource capacity

      3.1

      Pilot your optimized process

      3.2

      Communicate organizational change

      This step will walk you through the following activities:

      • Perform a deeper retrospective on current project prioritization process
      • Optimize your process to maintain resource capacity supply and project demand data
      • Optimize your process to formally make disposition recommendations to appropriate decision makers

      This step involves the following participants:

      • PMO Director / Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Administrative Staff

      Outcomes of this step

      • Retrospective of the current project prioritization process: to continue doing, to start doing, and to stop doing
      • Realistic estimate of available resource capacity, in the absence of a resource management practice
      • Optimized process for presenting the decision makers with recommendations and facilitating capacity-constrained steering of the project portfolio
      • Project Intake and Prioritization Tool for facilitating the prioritization process
      • Documentation of the optimized process in the SOP document

      The availability of staff time is rarely factored into IT project and service delivery commitments

      A lot gets promised and worked on, and staff are always busy, but very little actually gets done – at least not within given timelines or to expected levels of quality.

      Organizations tend to bite off more than they can chew when it comes to project and service delivery commitments involving IT resources.

      While the need for businesses to make an excess of IT commitments is understandable, the impacts of systemically over-allocating IT are clearly negative:

      • Stakeholder relations suffer. Promises are made to the business that can’t be met by IT.
      • IT delivery suffers. Project timelines and quality frequently suffer, and service support regularly lags.
      • Employee engagement suffers. Anxiety and stress levels are consistently high among IT staff, while morale and engagement levels are low.

      76%: 76% of organizations say they have too many projects on the go and an unmanageable and ever-growing backlog of things to get to.

      – Cooper, 2014

      70%: Almost 70% of workers feel as though they have too much work on their plates and not enough time to do it.

      – Reynolds, 2016

      Unconstrained, unmanaged demand leads to prioritization of work based on consequences rather than value

      Problems caused by the organizational tendency to make unrealistic delivery commitments is further complicated by the reality of the matrix environment.

      Today, many IT departments use matrix organization. In this system, demands on a resource’s time come from many directions. While resources are expected to prioritize their work, they lack the authority to formally reject any demand. As a result, unconstrained, unmanaged demand frequently outstrips the supply of work-hours the resource can deliver.

      When this happens, the resource has three options:

      1. Work more hours, typically without compensation.
      2. Choose tasks not to do in a way that minimizes personal consequences.
      3. Diminish work quality to meet quantity demands.

      The result is an unsustainable system for all those involved:

      1. Individual workers cannot meet expectations, leading to frustration and disengagement.
      2. Managers cannot deliver on the projects or services they manage and struggle to retain skilled resources who are looking elsewhere for “greener pastures.”
      3. Executives cannot execute strategic plans as they lose decision-making power over their resources.

      Prioritize project demand by project value to get the most out of constrained project capacity – but practicing it is difficult

      The theory may be simple and intuitive, but the practice is extremely challenging. There are three practical challenges to making project prioritization effective.

      Project Prioritization

      Capacity awareness

      Many IT departments struggle to realistically estimate available project capacity in a credible way. Stakeholders question the validity of your endeavor to install capacity-constrained intake process, and mistake it for unwillingness to cooperate instead.

      Lack of authority

      Many PMOs and IT departments simply lack the ability to decline or defer new projects.

      Many moving parts

      Project intake, approval, and prioritization involve the coordination of various departments. Therefore, they require a great deal of buy-in and compliance from multiple stakeholders and senior executives.

      Project Approval

      Unclear definition of value

      Defining the project value is difficult, because there are so many different and conflicting ways that are all valid in their own right. However, without it, it's impossible to fairly compare among projects to select what's "best."

      Unclear definition of value

      In Step 1.1 of the blueprint, we took the first step toward resolving this challenge by prototyping a project valuation scorecard.

      A screenshot of Step 1.1 of this blueprint is shown.

      "Prioritization is a huge issue for us. We face the simultaneous challenges of not having enough resources but also not having a good way to say no. "

      – CIO, governmental health agency

      Address the challenges of capacity awareness and authority with a project prioritization workflow

      Info-Tech recommends following a four-step process for managing project prioritization.

      1. Collect and update supply and demand data
        1. Re-evaluate project value for all proposed, on-hold and ongoing projects
        2. Estimate available resource capacity for projects
      2. Prioritize project demand by value
        1. Identify highest-value, “slam-dunk” projects
        2. Identify medium-value, “on-the-bubble” projects
        3. Identify lower-value projects that lie beyond the available capacity
      3. Approve projects for initiation or continuation
        1. Submit recommendations for review
        2. Adjust prioritized list with business judgment
        3. Steering committee approves projects to work on
      4. Manage a realistically defined project portfolio
      • Stakeholder Need
      • Strategic Objectives
      • Resource Capacity

      Intake and Prioritization Tool

      Perform a start-stop-continue exercise to help determine what is working and what is not working

      2.3.1 Estimated Time: 60 minutes

      Optimizing project prioritization may not require a complete overhaul of your existing processes. You may only need to tweak certain templates or policies. Perhaps you started out with a strong process and simply lost resolve over time – in which case you will need to focus on establishing motivation and discipline, rather than rework your entire process.

      Perform a start-stop-continue exercise with your team to help determine what should be salvaged, what should be abandoned, and what should be introduced:

      1. On a whiteboard or equivalent, write “Start,” “Stop,” and “Continue” in three separate columns. 3. As a group, discuss the responses and come to an agreement as to which are most valid.
      2. Equip your team with sticky notes or markers and have them populate the columns with ideas and suggestions surrounding your current processes. 4. Document the responses to help structure your game plan for intake optimization.
      Start Stop Continue
      • Periodically review the project value scorecard with business stakeholders
      • “Loud Voices First” prioritization
      • Post-prioritization score changes
      • Updating project value scores for current projects

      INPUT

      • Current project prioritization workflow (Activity 1.2.2)
      • Project prioritization success criteria (Activity 1.2.6)

      OUTPUT

      • Retrospective review of current prioritization process

      Materials

      • Whiteboard
      • Sticky notes/markers

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Use Info-Tech’s lightweight Intake and Prioritization Tool to get started on capacity-constrained project prioritization

      Use Info-Tech’s Project Intake and Prioritization Tool to facilitate the scorecard-driven prioritization and ensure effective flow of data.

      This tool builds on the Project Valuation Scorecard Tool to address the challenges in project prioritization:

      1. Lack of capacity awareness: quickly estimate a realistic supply of available work hours for projects for a given prioritization period, in the absence of a reliable and well-maintained resource utilization and capacity data.
      2. Using standard project sizing, quickly estimate the size of the demand for proposed and ongoing projects and produce a report that recommends the list of projects to greenlight – and highlight the projects within that list that are at risk of being short-charged of resources – that will aim to help you tackle:

      3. Lack of authority to say “no” or “not yet” to projects: save time and effort in presenting the results of project prioritization analysis that will enable the decision makers to make well-informed, high-quality portfolio decisions.
      4. The next several slides will walk you through the tool and present activities to facilitate its use for your organization.

      Download Info-Tech’s Project Intake and Prioritization Tool.

      A screenshot of Info-Tech's Project Intake Prioritization Tool is shown.

      Create a high-level estimate of available project capacity to inform how many projects can be greenlighted

      2.3.2 Project Intake and Prioritization Tool, Tab 2: Project Capacity

      Estimate how many work-hours are at your disposal for projects using Info-Tech’s resource calculator.

      A screenshot of Info-Tech's Project Intake and Prioritization Tool, Tab 2: Project Capacity

      1. Compile a list of each role within your department, the number of staff, and the hours in a typical work week.

      2. Enter the foreseeable out-of-office time (vacation, sick time, etc.). Typically, this value is 12-16% depending on the region.

      3. Enter how much working time is spent on non-projects for each role: administrative duties and “keep the lights on” work.

      4. Select a period of time for breaking down available resource capacity in hours.

      Project Work (%): Percentage of your working time that goes toward project work is calculated as what’s left after your non-project working time allocations have been subtracted.

      Project (h) Total Percentage: Take a note of this percentage as your project capacity. This number will put the estimated project demand in context for the rest of the tool.

      Example for a five-day work week:

      • 2 weeks (10 days) of statutory holidays
      • 3 weeks of vacation
      • 1.4 weeks (7 days) of sick days on average
      • 1 week (5 days) for company holidays

      Result: 7.4/52 weeks’ absence = 14%

      Estimate your available project capacity for the next quarter, half-year, or year

      2.3.2 Estimated Time: 30 minutes

      Discover how many work-hours are at your disposal for project work.

      1. Use the wisdom-of-the-crowd approach or resource utilization data to fill out Tab 2 of the tool. This is intended to be somewhat of a rough estimate; avoid the pitfall of being too granular in role or in time split.
      2. Choose a time period that corresponds to your project prioritization period: monthly, quarterly, 4 months, semi-annually (6 months), or annually.
      3. Examine the pie graph representation of your overall capacity breakdown, like the one shown below.

      Screenshot from Tab 2 of Project Intake and Prioritization Tool

      INPUT

      • Knowledge of organization’s personnel and their distribution of time

      OUTPUT

      • Estimate of available project capacity

      Materials

      • Project Intake and Prioritization Tool

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      On average, only about half of the available project capacity results in productive project work

      Place realistic expectations on your resources’ productivity.

      Info-Tech’s PPM Current State Scorecard diagnostic provides a comprehensive view of your portfolio management strengths and weaknesses, including project portfolio management, project management, customer management, and resource utilization.

      A screenshot of Info-Tech's PPM Current State Scorecard diagnostic

      Use the wisdom of the crowd to estimate resource waste in:

      • Cancelled projects
      • Inefficiency
      • Suboptimal assignment of resources
      • Unassigned resources
      • Analyzing, fixing, and redeploying

      50% of PPM resource is wasted on average, effectively halving your available project capacity.

      Source: Info-Tech PPM Current State Scorecard

      Define project capacity and project t-shirt sizes

      2.3.3 Project Intake and Prioritization Tool, Tab 3: Settings

      The resource capacity calculator in the previous tab yields a likely optimistic estimate for how much project capacity is available. Based on this estimate as a guide, enter your optimistic (maximum) and pessimistic (minimum) estimates of project capacity as a percentage of total capacity:

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 3

      Info-Tech’s data shows that only about 50% of time spent on project work is wasted: cancelled projects, inefficiency, rework, etc. As a general rule, enter half of your maximum estimate of your project capacity.

      Capacity in work hours is shown here from the previous tab, to put the percentages in context. This example shows a quarterly breakdown (Step 4 from the previous slide; cell N5 in Tab 2.).

      Next, estimate the percentage of your maximum estimated project capacity that a single project would typically consume in the given period for prioritization.

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 3

      These project sizes might not line up with the standard project levels from Step 2.1 of the blueprint: for example, an urgent mid-sized project that requires all hands on deck may need to consume almost 100% of maximum available project capacity.

      Estimate available project capacity and standard project demand sizes for prioritizing project demand

      2.3.3 Estimated Time: 30 minutes

      Refine your estimates of project capacity supply and demand as it applies to a prioritization period.

      1. The estimated project capacity from Activity 2.3.2 represents a theoretical limit. It is most likely an overestimation (see box below). As a group, discuss and decide on a more realistic available project capacity:
        1. Optimistic estimate, assuming sustained peak productivity from everyone in your organization;
        2. Pessimistic estimate, taking into account the necessary human downtime and the PPM resource waste (see previous slide).
      2. Refine the choices of standard project effort sizes, expressed as percentages of maximum project capacity. As a reminder, this sizing is for the chosen prioritization period, and is independent from the project levels set previously in Activity 2.1.4 and 2.1.5.

      Dedicated work needs dedicated break time

      In a study conducted by the Draugiem Group, the ideal work-to-break ratio for maximizing focus and productivity was 52 minutes of work, followed by 17 minutes of rest (Evans). This translates to 75% of resource capacity yielding productive work, which could inform your optimistic estimate of project capacity.

      INPUT

      • Project capacity (Activity 2.3.2)
      • PPM Current State Scorecard (optional)

      OUTPUT

      • Capacity and demand estimate data for tool use

      Materials

      • Project Intake and Prioritization Tool

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Finish setting up the Project Intake and Prioritization Tool

      2.3.4 Project Intake and Prioritization Tool, Tab 3: Settings

      Enter the scoring criteria, which was worked out from Step 1.1 of the blueprint. This workbook supports up to ten scoring criteria; use of more than ten may make the prioritization step unwieldy.

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 3

      Leave unused criteria rows blank.

      Choose “value” or “execution” from a drop-down.

      Score does not need to add up to 100.

      Finally, set up the rest of the drop-downs used in the next tab, Project Data. These can be customized to fit your unique project portfolio needs.

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 3

      Enter project data into the Project Intake and Prioritization Tool

      2.3.4 Project Intake and Prioritization Tool, Tab 4: Project Data

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 4

      Ensure that each project has a unique name.

      Completed (or cancelled) projects will not be included in prioritization.

      Choose the standard project size defined in the previous tab.

      Change the heading when you customize the workbook.

      Days in Backlog is calculated from the Date Added column.

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 4

      Overall weighted project prioritization score is calculated as a sum of value and execution scores.

      Weighted value and execution scores are calculated according to the scoring criteria table in the 2. Settings tab.

      Enter the raw scores. Weights will be taken into calculation behind the scenes.

      Spaces for unused intake scores will be greyed out. You can enter data, but they will not affect the calculated scores.

      Document your process to maintain resource capacity supply and project demand data

      2.3.4 Estimated Time: 30 minutes

      Review and customize section 4.2, “Maintain Supply and Demand Data” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      The goal of this activity is to document the process with which the supply and demand information will be updated for projects. Consider the following factors:

      1. Estimates of resource supply: how often will the resource supply be updated? How are you estimating the range (maximum vs. minimum, optimistic vs. pessimistic)? Leverage your existing organizational process assets for resource management.
      2. Updating project data for proposed projects: when and how often will the project valuation scores be updated? Do you have sufficient inputs? Examine the overall project approval process from Step 2.2 of the blueprint, and ensure that sufficient information is available for project valuation (Activity 2.2.3).
      3. Updating project data for ongoing projects: will you prioritize ongoing projects along with proposed projects? When and how often will the project valuation scores be updated? Do you have sufficient inputs?
      4. How will you account for the consumption of resource capacity? Do a rough order of estimate for the resource capacity consumed in this process.
      5. Who will handle exceptions? For example, PMO will maintain this process and will handle any questions or issues that pertain to this part of the process.

      INPUT

      • Organizational process assets for resource management, strategic planning, etc.
      • Activity 2.3.3
      • Activity 2.2.3

      OUTPUT

      • Process steps for refreshing supply and demand data

      Materials

      • SOP Template
      • Project Intake and Prioritization Tool

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts
      • PMO Admin Staff

      Prioritized list of projects shows what fits under available project capacity for realizing maximum value

      2.3.5 Project Intake and Prioritization Tool, Tab 5: Results

      The output of the Project Intake and Prioritization Tool is a prioritized list of projects with indicators to show that their demand on project capacity will fit within the estimated available project capacity for the prioritization period.

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 5

      Status indicates whether the project is proposed or ongoing; completed projects are excluded.

      Disposition indicates the course of recommended action based on prioritization.

      Proposed projects display how long they have been sitting in the backlog.

      Projects highlighted yellow are marked as “deliberate” for their dispositions. These projects pose risks of not getting properly resourced. One must proceed with caution if they are to be initiated or continued.

      Provide better support to decision makers with the prioritized list, and be prepared for their steering

      It is the portfolio manager’s responsibility to provide the project portfolio owners with reliable data and enable them to make well-informed decisions for the portfolio.

      The prioritized list of proposed and ongoing projects, and an approximate indication for how they fill out the estimated available resource capacity, provide a meaningful starting ground for discussion on which projects to continue or initiate, to hold, or to proceed with caution.

      However, it is important to recognize the limitation of the prioritization methodology. There may be legitimate reasons why some projects should be prioritized over another that the project valuation method does not successfully capture. At the end of the day, it’s the prerogative of the portfolio owners who carry on the accountabilities to steer the portfolio.

      The portfolio manager has a responsibility to be prepared for reconciling the said steering with the unchanged available resource capacity for project work. What comes off the list of projects to continue or initiate? Or, will we outsource capacity if we must meet irreconcilable demand? The next slide will show how Info-Tech’s tool helps you with this process.

      Info-Tech Best Practice

      Strive to become the best co-pilot. Constantly iterate on the scoring criteria to better adapt to the portfolio owners’ preference in steering the project portfolio.

      Manipulate the prioritized list with the Force Disposition list

      2.3.5 Project Intake and Prioritization Tool, Tab 5: Results

      The Force Disposition list enables you to inject subjective judgment in project prioritization. Force include and outsource override project prioritization scores and include the projects for approval:

      • Force include counts the project demand against capacity.
      • Outsource, on the other hand, does not count the project demand.
      • Force exclude removes a project from prioritized list altogether, without deleting the row and losing its data.

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 5

      Choose a project name and a disposition using a drop-down.

      Use this list to test out various scenarios, useful for what-if analysis.

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 5

      Document your process to formally make disposition recommendations to appropriate decision-making party

      2.3.5 Estimated Time: 60 minutes

      Review and customize section 4.3, “Approve projects for initiation or continuation” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      The goal of this activity is to formalize the process of presenting the prioritized list of projects for review, modify the list based on steering decisions, and obtain the portfolio owners’ approval for projects to initiate or continue, hold, or terminate. Consider the following factors:

      1. Existing final approval process: what are the new injections to the current decision-making process for final approval?
      2. Meeting prep, agenda, and follow-up: what are the activities that must be carried out by PMO / portfolio manager to support the portfolio decision makers and obtain final approval?
      3. “Deliberate” projects: what additional information should portfolio owners be presented with, in order to deliberate on the projects at risk of being not properly resourced? For example, consider a value-execution plot (right).

      A screenshot of Info-Tech's Project Intake and Prioritization Tool Tab 5

      INPUT

      • Approval process steps (Activity 2.2.2)
      • Steering Committee process documentation

      OUTPUT

      • Activities for supporting the decision-making body

      Materials

      • SOP Template
      • Project Intake and Prioritization Tool

      Participants

      • CIO
      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts

      Once a project is approved, pass that which is known on to those responsible for downstream processes

      Aim to be responsible stewards of important and costly information developed throughout project intake, approval, and prioritization processes.

      Once the proposed project is given a green light, the project enters an initiation phase.

      No matter what project management methodology is employed, it is absolutely vital to pass on the knowledge gained and insights developed through the intake, approval, and prioritization processes. This ensures that the project managers and team are informed of the project’s purpose, business benefits, rationale for the project approval, etc. and be able to focus their efforts in realizing the project’s business goals.

      Recognize that this does not aim to create any new artifacts. It is simply a procedural safeguard against the loss of important and costly information assets for your organization.

      A flowchart is shown as an example of business documents leading to the development of a project charter.

      Information from the intake process directly feeds into, for example, developing a project charter.

      Source: PMBOK, 6th edition

      "If the project manager can connect strategy to the project they are leading (and therefore the value that the organization desires by sanctioning the project), they can ensure that the project is appropriately planned and managed to realize those benefits."

      – Randall T. Black, P.Eng., PMP; source: PMI Today

      Examine the new project intake workflow as a whole and document it in a flow chart

      2.3.6 Estimated Time: 30-60 minutes

      Review and customize section 4.1, “Project Prioritization Workflow” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template.

      In Step 1.2 of the blueprint, you mapped out the current project intake, approval, and prioritization workflow and documented it in a flow chart. In this step, take the time to examine the new project intake process as a whole, and document the new workflow in the form of a flow chart.

      1. Collect and update supply and demand data
      2. Prioritize project demand by value
      3. Approve projects for initiation or continuation
      4. Manage a realistically defined project portfolio

      Consider the following points:

      1. Are the inputs and outputs of each step clear? Who’s doing the work? How long will each step take, on average?
      2. Is the ownership of each step clear? How will we ensure a smooth handoff between each step and prevent requests from falling through the cracks?

      INPUT

      • New process steps for project prioritization (Activities 2.3.x-y)

      OUTPUT

      • Flowchart representation of new project prioritization workflow

      Materials

      • Microsoft Visio, flowchart software, or Microsoft PowerPoint

      Participants

      • CIO
      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts

      Leverage Info-Tech’s other blueprints to complement your project prioritization processes

      The project capacity estimates overlook a critical piece of the resourcing puzzle for the sake of simplicity: skills. You need the right skills at the right time for the right project.

      Use Info-Tech’s Balance Supply and Demand with Realistic Resource Management Practices blueprint to enhance the quality of information on your project supply.

      A screenshot of Info-Tech's Balance Supply and Demand with Realistic Resource Management Practices blueprint.

      There is more to organizing your project portfolio than a strict prioritization by project value. For example, as with a financial investment portfolio, project portfolio must achieve the right investment mix to balance your risks and leverage opportunities.

      Use Info-Tech’s Maintain an Organized Portfolio blueprint to refine the makeup of your project portfolio.

      A screenshot of Info-Tech's Maintain an Organized Portfolio blueprint.

      Continuous prioritization of projects allow organizations to achieve portfolio responsiveness.

      Use Info-Tech’s Manage an Agile Portfolio blueprint to take prioritization of your project portfolio to the next level.

      A screenshot of Info-Tech's Manage an Agile Portfolio blueprint

      46% of organizations use a homegrown PPM solution. Info-Tech’s Grow Your Own PPM Solution blueprint debuts a spreadsheet-based Portfolio Manager tool that provides key functionalities that integrates those of the Intake and Prioritization Tool with resource management, allocation and portfolio reporting capabilities.

      A screenshot of Info-Tech's Grow Your Own PPM Solution blueprint

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

      Book a workshop with our Info-Tech analysts:

      A picture of an Info-Tech analyst is shown.

      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      2.1.2-6

      A screenshot of activities 2.1.2-6 is shown.

      Optimize your process to receive, triage, and follow up on project requests

      Discussion on decision points and topics of consideration will be facilitated to leverage the diverse viewpoints amongst the workshop participants.

      2.3.2-5

      A screenshot of activities 2.3.2-5 is shown.

      Set up a capacity-informed project prioritization process using Info-Tech’s Project Intake and Prioritization Tool

      A table-top planning exercise helps you visualize the current process in place and identify opportunities for optimization.

      Phase 3

      Integrate the New Optimized Processes into Practice

      Phase 3 outline

      Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 3: Integrate the New Optimized Processes into Practice

      Proposed Time to Completion: 6-12 weeks

      Step 3.1: Pilot your process to refine it prior to rollout

      Start with an analyst kick-off call:

      • Review the proposed intake, approval, and prioritization process

      Then complete these activities…

      • Select receptive stakeholders to work with
      • Define the scope of your pilot and determine logistics
      • Document lessons learned and create an action plan for any changes

      With these tools & templates:

      • Process Pilot Plan
      • Project Backlog Manager Job Description

      Step 3.2: Analyze the impact of organizational change

      Review findings with analyst:

      • Results of the process pilot and the finalized intake SOP
      • Key PPM stakeholders
      • Current organizational climate

      Then complete these activities…

      • Analyze the stakeholder impact and responses to impending organizational change
      • Create message canvases for at-risk change impacts and stakeholders to create an effective communication plan

      With these tools & templates:

      • Intake Process Implementation Impact Analysis Tool

      Phase 3 Results & Insights:

      • Engagement paves the way for smoother adoption. An “engagement” approach (rather than simply “communication”) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.

      Step 3.1: Pilot your intake, approval, and prioritization process to refine it before rollout

      PHASE 1 PHASE 2 PHASE 3

      1.1

      Define project valuation criteria

      1.2

      Envision process target state

      2.1

      Streamline intake

      2.2

      Right-size approval steps

      2.3

      Prioritize projects to fit resource capacity

      3.1

      Pilot your optimized process

      3.2

      Communicate organizational change

      This step will walk you through the following activities:

      • Select receptive managers to work with during your pilot
      • Define the scope of your pilot and determine logistics
      • Plan to obtain feedback, document lessons learned, and create an action plan for any changes
      • Finalize Project Intake, Approval, and Prioritization SOP

      This step involves the following participants:

      • PMO Director / Portfolio Manager
      • Project Managers
      • Business Analysts

      Outcomes of this step

      • A pilot team
      • A process pilot plan that defines the scope, logistics, and process for retrospection
      • Project Backlog Manager job description
      • Finalized Project Intake, Approval, and Prioritization SOP for rollout

      Pilot your new processes to test feasibility and address issues before a full deployment

      Adopting the right set of practices requires a significant degree of change that necessitates buy-in from varied stakeholders throughout IT and the business.

      Rome wasn’t built in a day. Similarly, benefits of optimized project intake, approval, and prioritization process will not be realized overnight.

      Resist the urge to deploy a big-bang roll out of your new intake practices. The approach is ill advised for two main reasons:

      • It will put more of a strain on the implementation team in the near term, with a larger pool of end users to train and collect data from.
      • Putting untested practices in a department-wide spotlight could lead to mass confusion in the near-term and color the new processes in a negative light, leading to a loss of stakeholder trust and engagement right out-of-the-gate.

      Start with a pilot phase. Identify receptive lines of business and IT resources to work with, and leverage their insights to help iron out the kinks in your process before unveiling your practices to IT and all business users at large.

      This step will help you to:

      • Plan and execute a pilot of the processes we developed in Phase 2.
      • Incorporate the lessons learned from that pilot to strengthen your SOP and ease the communication process.

      Info-Tech Insight

      Engagement paves the way for smoother adoption. An “engagement” approach (rather than simply “communication”) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.

      Plan your pilot like you would any project to ensure it’s well defined and its goals are clearly articulated

      Use Info-Tech’s Intake Process Pilot Plan Template to help define the scope of your pilot and set appropriate goals for the test-run of your new processes.

      A process pilot is a limited scope of an implementation (constrained by time and resources involved) in order to test the viability and effectiveness of the process as it has been designed.

      • Investing time and energy into a pilot phase can help to lower implementation risk, enhance the details and steps within a process, and improve stakeholder relations prior to a full scale rollout.
      • More than a dry run, however, a pilot should be approached strategically, and planned out to limit the scope of it and achieve specific outcomes.
      • Leverage a planning document to ensure your process pilot is grounded in a common set of definitions, that the pilot is delivering value and insight, and that ultimately the pilot can serve as a starting point for a full-scale process implementation.

      Download Info-Tech’s Process Pilot Plan Template

      A screenshot of Info-Tech's Process Pilot Plan Template is shown.

      "The advantages to a pilot are several. First, risk is constrained. Pilots are closely monitored so if a problem does occur, it can be fixed immediately. Second, the people working in the pilot can become trainers as you roll the process out to the rest of the organization. Third, the pilot is another opportunity for skeptics to visit the pilot process and learn from those working in it. There’s nothing like seeing a new process working for people to change their minds."

      Daniel Madison

      Select receptive stakeholders to work with during your pilot

      3.1.1 Estimated Time: 20-60 minutes

      Info-Tech recommends selecting PPM stakeholders who are aware of your role and some of the challenges in project intake, approval, and prioritization to assist in the implementation process.

      1. If receptive PPM stakeholders are known, schedule a 15-minute meeting with them to inquire if they would be willing to be part of the pilot process.
      2. If receptive project managers are not known, use Info-Tech’s Stakeholder Engagement Workbook to conduct a formal selection process.
        1. Enter a list of potential participants for pilot in tab 3.
        2. Rate project managers in terms of influence, pilot interest, and potential deployment contribution within tab 4.
        3. Review tab 5 in the workbook. Receptive PPM stakeholders will appear in the top quadrants. Ideal PPM stakeholders for the pilot are located in the top right quadrant of the graph.

      A screenshot of Info-Tech's Stakeholder Engagement Workbook Tab 5 is shown.

      INPUT

      • Project portfolio management stakeholders (Activity 1.2.3)

      OUTPUT

      • Pilot project team

      Materials

      • Stakeholder Engagement Workbook
      • Process Pilot Plan Template

      Participants

      • PMO Director/ Portfolio Manager
      • CIO (optional)

      Document the PPM stakeholders involved in your pilot in Section 3 of Info-Tech’s Process Pilot Plan Template.

      Define the scope of your pilot and determine logistics

      3.1.2 Estimated Time: 60-90 minutes

      Use Info-Tech’s Process Pilot Plan Template to design the details of your pilot.

      Investing time into planning your pilot phase strategically will ensure a clear scope, better communications for those piloting the processes, and – overall – better, more actionable results for the pilot phase. The Pilot Plan Template is broken into five sections to assist in these goals:

      • Pilot Overview and Scope
      • Success and Risk Factors
      • Stakeholders Involved and Communications Plan
      • Pilot Retrospective and Feedback Protocol

      The duration of your pilot should go at least one prioritization period, e.g. one to two quarters.

      Estimates of time commitments should be captured for each stakeholder. During the retrospective at the end of the pilot you should capture actuals to help determine the time-cost of the process itself and measure its sustainability.

      Once the Plan Template is completed, schedule time to share and communicate it with the pilot team and executive sponsors of the process.

      While you should invest time in this planning document, continue to lean on the Intake, Approval, and Prioritization SOP throughout the pilot phase.

      INPUT

      • Sections 1 through 4 of the Process Pilot Plan Template

      OUTPUT

      • A process pilot plan

      Materials

      • Process Pilot Plan Template

      Participants

      • PMO Director / Portfolio Manager
      • Project Managers
      • Business Analysts
      • CIO (optional)

      Execute your pilot and prepare to make process revisions before the full rollout

      Hit play! Begin the process pilot and get familiar with the work routine and resource management solution.

      Some things to keep in mind during the pilot include:

      • Depending on the solution you are using, you will likely need to spend one day or less to populate the tool. During the pilot, measure the time and effort required to manage the data within the tool. Determine whether time and effort required is viable on an ongoing basis (i.e. can you do it every month or quarter) and has value.
      • Meet with the pilot team and other stakeholders regularly during the pilot, at least biweekly. Allow the team (and yourself) to speak honestly and openly about what isn’t working. The pilot is your chance to make things better.
      • Keep notes about what will need to change in the SOP. For major changes, you may have to tweak the process during the pilot itself. Update the process documents as needed and communicate the changes and why they’re being made. If required, update the scope of the pilot in the Pilot Plan Template.
      An example is shown on how to begin the process pilot and getting familiar with the work routine and resource management solution.

      Obtain feedback from the pilot group to improve your processes before a wider rollout

      3.1.3 Estimated Time: 30 minutes

      Pilot projects allow you to validate your assumptions and leverage lessons learned. During the planning of the pilot, you should have scheduled a retrospective meeting with the pilot team to formally assess strengths and weaknesses in the process you have drafted.

      • Schedule the retrospective shortly after the pilot is completed. Info-Tech recommends performing a Stop/Start/Continue meeting with pilot participants to obtain and capture feedback.
      • Have members of the meeting record any processes/activities on sticky notes that should:
        • Stop: because they are ineffective or not useful
        • Start: because they would be useful for the tool and have not been incorporated into current processes
        • Continue: because they are useful and positively contribute to intended process outcomes.

      An example of how to structure a Stop/Start/Continue activity on a whiteboard using sticky notes.

      An example of stop, start, and continue is activity is shown.

      INPUT

      • What’s working and what isn’t in the process

      OUTPUT

      • Ideas to improve process

      Materials

      • Whiteboard
      • Sticky notes
      • Process Pilot Plan Template

      Participants

      • Process owner (PMO director or portfolio owner)
      • Pilot team

      See the following slide for additional instructions.

      Document lessons learned and create an action plan for any changes to the processes

      3.1.4 Estimated Time: 30 minutes

      An example of stop, start, and continue is activity is shown.

      As a group, discuss everyone’s responses and organize according to top priority (mark with a 1) and lower priority/next steps (mark with a 2). At this point, you can also remove any sticky notes that are repetitive or no longer relevant.

      Once you have organized based on priority, be sure to come to a consensus with the group regarding which actions to take. For example, if the group agrees that they should “stop holding meetings weekly,” come to a consensus regarding how often meetings will be held, i.e. monthly.

      Priority Action Required Who is Responsible Implementation Date
      Stop: Holding meetings weekly Hold meetings monthly Jane Doe, PMO Next Meeting: August 1, 2017
      Start: Discussing backlog during meetings Ensure that backlog data is up to date for discussion on date of next meeting. John Doe, Portfolio Manager August 1, 2017

      Create an action plan for the top priority items that require changes (the Stops and Starts). Record in this slide, or your preferred medium. Be sure to include who is responsible for the action and the date that it will be implemented.

      Document the outcomes of the start/stop/continue and your action plan in Section 6 of Info-Tech’s Process Pilot Plan Template.

      Use Info-Tech’s Backlog Manager Job Description Template to help fill any staffing needs around data maintenance

      3.1 Project Backlog Manager Job Description

      You will need to determine responsibilities and accountabilities for portfolio management functions within your team.

      If you do not have a clearly identifiable portfolio manager at this time, you will need to clarify who will wear which hats in terms of facilitating intake and prioritization, high-level capacity awareness, and portfolio reporting.

      • Use Info-Tech’s Project Backlog Manager job description template to help clarify some of the required responsibilities to support your intake, approval, and prioritization strategy.
        • If you need to bring in an additional staff member to help support the strategy, you can customize the job description template to help advertise the position. Simply edit the text in grey within the template.
      • If you have other PPM tasks that you need to define responsibilities for, you can use the RASCI chart on the final tab of the PPM Strategy Development Tool.

      Download Info-Tech’s Project Backlog Manager job description template.

      A screenshot of Info-Tech's Project Backlog Manager template is shown.

      Finalize the Intake, Approval, and Prioritization SOP and prepare to communicate your processes

      Once you’ve completed the pilot process and made the necessary tweaks, you should finalize your Intake, Approval, and Prioritization SOP and prepare to communicate it.

      Update section 1.2, “Overall Process Workflow” in Info-Tech’s Project Intake, Approval, and Prioritization SOP Template with the new process flow.

      Revisit your SOP from Phase 2 and ensure it has been updated to reflect the process changes that were identified in activity 3.1.4.

      • If during the pilot process the data was too difficult or time consuming to maintain, revisit the dimensions you have chosen and choose dimensions that are easier to accurately maintain. Tweak your process steps in the SOP accordingly.
      • In the long term, if you are not observing any progress toward achieving your success criteria, revisit the impact analysis that we’ll prepare in step 3.2 and address some of these inhibitors to organizational change.

      Download Info-Tech’s Project Intake, Approval, and Prioritization SOP template.

      A screenshot of Info-Tech's Project Intake, Approval, and Prioritization SOP template.

      Info-Tech Best Practice

      Make your SOP high impact. SOPs are often at risk of being left unmaintained and languishing in disuse. Improve the SOP’s succinctness and usability by making it visual; consult Info-Tech’s blueprint, Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind.

      Step 3.2: Analyze the impact of organizational change through the eyes of PPM stakeholders to gain their buy-in

      PHASE 1 PHASE 2 PHASE 3

      1.1

      Define project valuation criteria

      1.2

      Envision process target state

      2.1

      Streamline intake

      2.2

      Right-size approval steps

      2.3

      Prioritize projects to fit resource capacity

      3.1

      Pilot your optimized process

      3.2

      Communicate organizational change

      This step will walk you through the following activities:

      • Analyze the stakeholder impact and responses to impending organizational change
      • Create message canvases for at-risk change impacts and stakeholders
      • Set the course of action for communicating changes to your stakeholders

      This step involves the following participants:

      • PMO Director / Portfolio Manager
      • Project Managers
      • Business Analysts

      Outcomes of this step

      • A thorough organizational change impact analysis, based on Info-Tech’s expertise in organizational change management
      • Message canvases and communication plan for your stakeholders
      • Go-live for the new intake, approval, and prioritization process

      Manage key PPM stakeholders and communicate changes

      • Business units: Projects are undertaken to provide value to the business. Senior management from business units must help define how project will be valued.
      • IT: IT must ensure that technical/practical considerations are taken into account when determining project value.
      • Finance: The CFO or designated representative will ensure that estimated project costs and benefits can be used to manage the budget.
      • PMO: PMO is the administrator of the project portfolio. PMO must provide coordination and support to ensure the process operates smoothly and its goals are realized.
      • Business analysts: BAs carry out the evaluation of project value. Therefore, their understanding of the evaluation criteria and the process as a whole are critical to the success of the process.
      • Project sponsors: Project sponsors are accountable for the realization of benefits for which projects are undertaken.

      Impacts will be felt differently by different stakeholders and stakeholder groups

      As you assess change impacts, keep in mind that no impact will be felt the same across the organization. Depth of impact can vary depending on the frequency (will the impact be felt daily, weekly, monthly?), the actions necessitated by it (e.g. will it change the way the job is done or is it simply a minor process tweak?), and the anticipated response of the stakeholder (support, resistance, indifference?).

      Use the Organizational Change Depth Scale below to help visualize various depths of impact. The deeper the impact, the tougher the job of managing change will be.

      Procedural Behavioral Interpersonal Vocational Cultural
      Procedural change involves changes to explicit procedures, rules, policies, processes, etc. Behavioral change is similar to procedural change, but goes deeper to involve the changing tacit or unconscious habits. Interpersonal change goes beyond behavioral change to involve changing relationships, teams, locations, reporting structures, and other social interactions. Vocational change requires acquiring new knowledge and skills, and accepting the loss or decline in the value or relevance of previously acquired knowledge and skills. Cultural change goes beyond interpersonal and vocational change to involve changing personal values, social norms, and assumptions about the meaning of good vs. bad or right vs. wrong.
      Example: providing sales reps with mobile access to the CRM application to let them update records from the field. Example: requiring sales reps to use tablets equipped with a custom mobile application for placing orders from the field. Example: migrating sales reps to work 100% remotely. Example: migrating technical support staff to field service and sales support roles. Example: changing the operating model to a more service-based value proposition or focus.

      Perform a change impact analysis to maximize the chances of adoption for the new intake process

      Invest time and effort to analyze the impact of change to create an actionable stakeholder communication plan that yields the desirable result: adoption.

      Info-Tech’s Drive Organizational Change from the PMO blueprint offers the OCM Impact Analysis Tool to helps document the change impact across multiple dimensions, enabling the project team to review the analysis with others to ensure that the most important impacts are captured.

      This tool has been customized for optimizing project intake, approval, and prioritization process to deliver the same result in a more streamlined way. The next several slides will take you through the activities to ultimately create an OCM message canvas and a communication plan for your key stakeholders.

      Download Info-Tech’s Intake and Prioritization Impact Analysis Tool.

      A screenshot of Info-Tech's Intake and Prioritization Impact Analysis Tool is shown.

      "As a general principle, project teams should always treat every stakeholder initially as a recipient of change. Every stakeholder management plan should have, as an end goal, to change recipients’ habits or behaviors."

      -PMI, 2015

      Set up the Intake Process and Prioritization Impact Analysis Tool

      3.2.1 Intake and Prioritization Impact Analysis Tool, Tab 2-3

      In Tab 2, enter your stakeholders’ names. Represent stakeholders as a group if you expect the impact of change on them to be reasonably uniform, as well as their anticipated responses. Otherwise, consider adding them as individuals or subgroups.

      A screenshot of Info-Tech's Intake and Prioritization Impact Analysis Tool, Tab 2 is shown.

      In Tab 3, enter whether you agree or disagree with each statement that represents an element of organizational change that be introduced as the newly optimized intake process is implemented.

      As a result of the change initiative in question:

      A screenshot of Info-Tech's Intake and Prioritization Impact Analysis Tool, Tab 3 is shown.

      Analyze the impact and the anticipated stakeholder responses of each change

      3.2.1 Intake and Prioritization Impact Analysis Tool, Tab 4: Impact Analysis Inputs

      Each change statement that you agreed with in Tab 3 are listed here in Tab 4 of the Intake and Prioritization Impact Analysis Tool. For each stakeholder, estimate and enter the following data:

      1. Frequency of the Impact: how often will the impact of the change be felt?
      2. Effort Associated with Impact: what is the demand on a stakeholder’s effort to implement the change?
      3. Anticipated Response: rate from enthusiastic response to active subversion. Honest and realistic estimates of anticipated responses are critical to the rest of the impact analysis.
      A screenshot of Info-Tech's Intake and Prioritization Impact Analysis Tool, Tab 4 is shown.

      Analyze the stakeholder impact and responses to impending organizational change as a group

      3.2.1 Estimated Time: 60-90 minutes

      Divide and conquer. Leverage the group to get through the seemingly daunting amount of work involved with impact analysis.

      1. Divide the activity participants into subgroups and assign a section of the impact analysis. It may be helpful to do one section together as a group to make sure everyone is roughly on the same page for assessing impact.
      2. Suggested ways to divide up the impact analysis include:

      • By change impact. This would be suitable when the process owners (or would-be process owners) are available and participating.
      • By stakeholders. This would be suitable for large organizations where the activity participants know some stakeholders better than others.

      Tip: use a spreadsheet tool that supports multi-user editing (e.g. Google Sheets, Excel Online).

    • Aggregate the completed work and benchmark one another’s analysis by reviewing them with the entire group.
    • INPUT

      • Organizational and stakeholder knowledge
      • Optimized intake process

      OUTPUT

      • Estimates of stakeholder-specific impact and response

      Materials

      • Intake and Prioritization Impact Analysis Tool

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts

      Info-Tech Insight

      Beware of bias. Groups are just as susceptible to producing overly optimistic or pessimistic analysis as individuals, just in different ways. Unrealistic change impact analysis will compromise your chances of arriving at a reasonable, tactful stakeholder communication plan.

      Examine your impact analysis report

      3.2.2 Intake and Prioritization Impact Analysis Tool, Tab 5: Impact Analysis Outputs

      These outputs are based on the impacts you analyzed in Tab 4 of the tool (Activity 3.2.1). They are organized in seven sections:

      1. Top Five Highest Risk Impacts, based on the frequency and effort inputs across all impacts.
      2. Overall Process Adoption Rating (top right), showing the overall difficulty of this change given likelihood/risk that the stakeholders involved will absorb the anticipated change impacts.
      3. Top Five Most Impacted Stakeholders, based on the frequency and effort inputs across all impacts.
      4. Top Five Process Supporters and;
      5. Top Five Process Resistors, based on the anticipated response inputs across all impacts.
      6. Impact Register (bottom right): this list breaks down each change’s likelihood of adoption.
      7. Potential Impacts to Watch Out For: this list compiles all of the "Don't Know" responses from Tab 3.
      A screenshot of Info-Tech's Intake and Prioritization Impact Analysis Tool, Tab 5 is shown. It shows Section 2. Overall process adoption rating. A screenshot of Info-Tech's Intake and Prioritization Impact Analysis Tool, Tab 5 is shown. It shows Section 6. Impact Register.

      Tailor messages for at-risk change impacts and stakeholders with Info-Tech’s Message Canvas

      3.2.2 Intake and Prioritization Impact Analysis Tool, Tab 6: Message Canvas

      Use Info-Tech’s Message Canvas on this tab to help rationalize and elaborate the change vision for each group.

      Elements of a Message Canvas

      • Why is there a need for this process change?
      • What will be new for this audience?
      • What will go away for this audience?
      • What will be meaningfully unchanged for this audience?
      • How will this change benefit this audience?
      • When and how will the benefits be realized for this audience?
      • What does this audience have to do for this change to succeed?
      • What does this audience have to stop doing for this change to succeed?
      • What should this audience continue doing?
      • What support will this audience receive to help manage the transition?
      • What should this audience expect to do/happen next?

      A screenshot of Info-Tech's Intake and Prioritization Impact Analysis Tool, Tab 6 is shown.

      Info-Tech Insight

      Change thy language, change thyself.

      Jargon, acronyms, and technical terms represent deeply entrenched cultural habits and assumptions.

      Continuing to use jargon or acronyms after a transition tends to drag people back to old ways of thinking and working.

      You don’t need to invent a new batch of buzzwords for every change (nor should you), but every change is an opportunity to listen for words and phrases that have lost their meaning through overuse and abuse.

      Create message canvases for at-risk change impacts and stakeholders as a group

      3.2.2 Estimated Time: 90-120 minutes

      1. Decide on the number of message canvases to complete. This will be based on the number of at-risk change impacts and stakeholders.
      2. Divide the activity participants into subgroups and assign a section of the message canvas. It may be helpful to do one section together as a group to make sure everyone is roughly on the same page for assessing impact.
      3. Aggregate the completed work and benchmark the message canvases amongst subgroups.

      Remember these guidelines to help your messages resonate:

      • People are busy and easily distracted. Tell people what they really need to know first, before you lose their attention.
      • Repetition is good. Remember the Aristotelian triptych: “Tell them what you’re going to tell them, then tell them, then tell them what you told them.”
      • Don’t use technical terms, jargon, or acronyms. Different groups in organizations tend to develop specialized vocabularies. Everybody grows so accustomed to using acronyms and jargon every day that it becomes difficult to notice how strange it sounds to outsiders. This is especially important when IT communicates with non-technical audiences. Don’t alienate your audience by talking at them in a strange language.
      • Test your message. Run focus groups or deliver communications to a test audience (which could be as simple as asking 2–3 people to read a draft) before delivering messages more broadly.

      – Info-Tech Blueprint, Drive Organizational Change from the PMO

      INPUT

      • Impact Analysis Outputs
      • Organizational and stakeholder knowledge

      OUTPUT

      • Estimates of stakeholder-specific impact and response

      Materials

      • Intake and Prioritization Impact Analysis Tool

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts

      Distill the message canvases into a comprehensive communication plan

      3.2.3 Intake and Prioritization Impact Analysis Tool, Tab 7: Communication Plan

      The communication plan creates an action plan around the message canvases to coordinate the responsibilities of delivering them, so the risks of “dropping the ball” on your stakeholders are minimized.

      A screenshot of Info-Tech's Intake and Prioritization Impact Analysis Tool, Tab 7: Communication is shown.

      1. Choose a change impact from a drop-down menu.

      2. Choose an intended audience...

      … and the message canvas to reference.

      3. Choose the method of delivery. It will influence how to craft the message for the stakeholder.

      4. Indicate who is responsible for creating and communicating the message.

      A screenshot of Info-Tech's Intake and Prioritization Impact Analysis Tool, Tab 7: Communication is shown.

      5. Briefly indicate goal of the communication and the likelihood of success.

      6. Record the dates to plan and track the communications that take place.

      Set the course of action for communicating changes to your stakeholders

      3.2.2 Estimated Time: 90-120 minutes

      1. Divide the activity participants into subgroups and assign communication topics to each group. There should be one communication topic for each change impact. Based on the message canvas, create a communication plan draft.
      2. Aggregate the completed work and benchmark the communication topic amongst subgroups.
      3. Share the finished communication plan with the rest of the working group. Do not share this file widely, but keep it private within the group.

      Identify critical points in the change curve:

      1. Honeymoon of “Uninformed Optimism”: There is usually tentative support and even enthusiasm for change before people have really felt or understood what it involves.
      2. Backlash of “Informed Pessimism” (leading to “Valley of Despair”): As change approaches or begins, people realize they’ve overestimated the benefits (or the speed at which benefits will be achieved) and underestimated the difficulty of change.
      3. Valley of Despair and beginning of “Hopeful Realism”: Eventually, sentiment bottoms out and people begin to accept the difficulty (or inevitability) of change.
      4. Bounce of “Informed Optimism”: People become more optimistic and supportive when they begin to see bright spots and early successes.
      5. Contentment of “Completion”: Change has been successfully adopted and benefits are being realized.

      Based on Don Kelley and Daryl Conner’s Emotional Cycle of Change.

      INPUT

      • Change impact analysis results
      • Message canvases
      • List of stakeholders

      OUTPUT

      • Communication Plan

      Materials

      • Intake and Prioritization Impact Analysis Tool

      Participants

      • PMO Director/ Portfolio Manager
      • Project Managers
      • Business Analysts

      Roll out the optimized intake, approval, and prioritization process, and continually monitor adoption and success

      As you implement your new project intake process, familiarize yourself with common barriers and challenges.

      There will be challenges to watch for in evaluating the effectiveness of your intake processes. These may include circumvention of process by key stakeholders, re-emergence of off-the-grid projects and low-value initiatives.

      As a quick and easy way to periodically assess your processes, consider the following questions:

      • Are you confident that all work in progress is being tracked via the project list?
      • Are your resources all currently working on high-value initiatives?
      • Since optimizing, have you been able to deliver (or are you on target to deliver) all that has been approved, with no initiatives in states of suspended animation for long periods of time?
      • Thanks to sufficient portfolio visibility and transparency into your capacity, have you been able to successfully decline requests that did not add value or that did not align with resourcing?

      If you answer “no” to any of these questions after a sufficient post-implementation period (approximately six to nine months, depending on the scope of your optimizing), you may need to tweak certain aspects of your processes or seek to align your optimization with a lower capability level in the short term.

      Small IT department struggles to optimize intake and to communicate new processes to stakeholders

      CASE STUDY

      Industry: Government

      Source: Info-Tech Client

      Challenge

      There is an IT department for a large municipal government. Possessing a relatively low level of PPM maturity, IT is in the process of establishing more formal intake practices in order to better track, and respond to, project requests. New processes include a minimalist request form (sent via email) coupled with more thorough follow-up from BAs and PMs to determine business value, ROI, and timeframes.

      Solution

      Even with new user-friendly processes in place, IT struggles to get stakeholders to adopt, especially with smaller initiatives. These smaller requests frequently continue to come in outside of the formal process and, because of this, are often executed outside of portfolio oversight. Without good, reliable data around where staff time is spent, IT lacks the authority to decline new requests.

      Results

      IT is seeking further optimization through better communication. They are enforcing discipline on stakeholders and reiterating that all initiatives, regardless of size, need to be directed through the process. IT is also training its staff to be more critical. “Don’t just start working on an initiative because a stakeholder asks.” With staff being more critical and directing requests through the proper queues, IT is getting better at tracking and prioritizing requests.

      "The biggest challenge when implementing the intake process was change management. We needed to shift our focus from responding to requests to strategically thinking about how requests should be managed. The intake process allows the IT Department to be transparent to customers and enables decision makers."

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

      Book a workshop with our Info-Tech analysts:

      A picture of an Info-Tech analyst is shown.

      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      3.1.1

      A screenshot of activity 3.1.1 is shown

      Select receptive stakeholders to work with during your pilot

      Identify the right team of supportive PPM stakeholders to carry out the process pilot. Strategies to recruit the right people outside the workshop will be discussed if appropriate.

      3.2.1

      A screenshot of activity 3.2.1 is shown.

      Analyze the stakeholder impact and responses to impending organizational change

      Carry out a thorough analysis of change impact in order to maximize the effectiveness of the communication strategy in support of the implementation of the optimized process.

      Insight breakdown

      Insight 1

      • The overarching goal of optimizing project intake, approval, and prioritization process is to maximize the throughput of the best projects. To achieve this goal, one must have a clear way to determine what are “the best” projects.

      Insight 2

      • Info-Tech’s methodology systemically fits the project portfolio into its triple constraint of stakeholder needs, strategic objectives, and resource capacity to effectively address the challenges of establishing organizational discipline for project intake.

      Insight 3

      • Engagement paves the way for smoother adoption. An “engagement” approach (rather than simply “communication”) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.

      Summary of accomplishment

      Knowledge Gained

      • Triple constraint model of project portfolio: stakeholder needs, strategic objectives, and resource capacity
      • Benefits of optimizing project intake, approval, and prioritization for managing a well-behaved project portfolio
      • Challenges of installing well-run project intake
      • Importance of piloting the process and communicating impacts to stakeholders

      Processes Optimized

      • Project valuation process: scorecard, weights
      • Project intake process: reception, triaging, follow-up
      • Project approval process: steps, accountabilities, deliverables
      • Project prioritization process: estimation of resource capacity for projects, project demand
      • Communication for organizational change

      Deliverables Completed

      • Optimized Project Intake, Approval, and Prioritization Process
      • Documentation of the optimized process in the form of a Standard Operating Procedure
      • Project valuation criteria, developed with Project Value Scorecard Development Tool and implemented through the Project Intake and Prioritization Tool
      • Standardized project request form with right-sized procedural friction
      • Standard for project level classification, implemented through the Project Intake Classification Matrix
      • Toolbox of deliverables for capturing information developed to inform decision makers for approval: Benefits Commitment Form, Technology Assessment Tool, Business Case Templates
      • Process pilot plan
      • Communication plan for organizational change, driven by a thorough analysis of change impacts on key stakeholders using the Intake and Prioritization Impact Analysis Tool

      Research contributors and experts

      Picture of Kiron D. Bondale

      Kiron D. Bondale, PMP, PMI - RMP

      Senior Project Portfolio & Change Management Professional

      A placeholder photo is shown here.

      Scot Ganshert, Portfolio Group Manager

      Larimer County, CO

      Picture of Garrett McDaniel

      Garrett McDaniel, Business Analyst II – Information Technology

      City of Boulder, CO

      A placeholder photo is shown here.

      Joanne Pandya, IT Project Manager

      New York Property Insurance Underwriters

      Picture of Jim Tom.

      Jim Tom, CIO

      Public Health Ontario

      Related Info-Tech research

      A screenshot of Info-Tech's Develop a Project Portfolio Management Strategy blueprint

      Develop a Project Portfolio Management Strategy blueprint"

      A screenshot of Info-Tech's Grow Your Own PPM Solution blueprint is shown.

      Grow Your Own PPM Solution

      A screenshot of Info-Tech's Balance Supply and Demand with Realistic Resource Management Practices blueprint is shown.

      Balance Supply and Demand with Realistic Resource Management Practices

      A screenshot of Info-Tech's Maintain an Organized Portfolio blueprint is shown.

      Maintain an Organized Portfolio

      A screenshot of Info-Tech's Manage a Minimum Viable PMO blueprint is shown.

      Manage a Minimum Viable PMO

      A screenshot of Info-Tech's Establish the Benefits Realization Process blueprint is shown.

      Establish the Benefits Realization Process

      A screenshot of Info-Tech's Manage an Agile Portfolio blueprint is shown.

      Manage an Agile Portfolio

      A screenshot of Info-Tech's Tailor Project Management Processes to Fit Your Projects blueprint is shown.

      Tailor Project Management Processes to Fit Your Projects

      A screenshot of Info-Tech's Project Portfolio Management Diagnostic Program blueprint is shown.

      Project Portfolio Management Diagnostic Program

      The Project Portfolio Management Diagnostic Program is a low-effort, high-impact program designed to help project owners assess and improve their PPM practices. Gather and report on all aspects of your PPM environment to understand where you stand and how you can improve.

      Bibliography

      Boston Consulting Group. “Executive Sponsor Engagement: Top Driver of Project and Program Success.” PMI, 2014. Web.

      Boston Consulting Group. “Winning Through Project Portfolio Management: the Practitioners’ Perspective.” PMI, 2015. Web.

      Bradberry, Travis. “Why The 8-Hour workday Doesn’t Work.” Forbes, 7 Jun 2016. Web.

      Cook, Scott. Playbook: Best Practices. Business Week

      Cooper, Robert, G. “Effective Gating: Make product innovation more productive by using gates with teeth.” Stage-Gate International and Product Development Institute. March/April 2009. Web.

      Epstein, Dan. “Project Initiation Process: Part Two.” PM World Journal. Vol. IV, Issue III. March 2015. Web.

      Evans, Lisa. “The Exact Amount of Time You Should Work Every Day.” Fast Company, 15 Sep. 2014. Web.

      Madison, Daniel. “The Five Implementation Options to Manage the Risk in a New Process.” BPMInstitute.org. n.d. Web.

      Merkhofer, Lee. “Improve the Prioritization Process.” Priority Systems, n.d. Web.

      Miller, David, and Mike Oliver. “Engaging Stakeholder for Project Success.” PMI, 2015. Web.

      Mind Tools. “Kelley and Conner’s Emotional Cycle of Change.” Mind Tools, n.d. Web.

      Mochal, Jeffrey and Thomas Mochal. Lessons in Project Management. Appress: September 2011. Page 6.

      Newcomer, Eric. “Getting Decisions to Stick.” Standish Group PM2go, 20 Oct 2017. Web.

      “PMI Today.” Newtown Square, PA: PMI, Oct 2017. Web.

      Project Management Institute. “Standard for Portfolio Management, 3rd ed.” Newtown Square, PA: PMI, 2013.

      Project Management Institute. “Pulse of the Profession 2017: Success Rates Rise.” PMI, 2017. Web.

      Transparent Choice. “Criteria for Project Prioritization.” n.p., n.d. Web.

      University of New Hampshire (UNH) Project Management Office. “University of New Hampshire IT Intake and Selection Process Map.” UNH, n.d. Web.

      Ward, John. “Delivering Value from Information Systems and Technology Investments: Learning from Success.” Information Systems Research Centre. August 2006. Web.

      Enable Omnichannel Commerce That Delights Your Customers

      • Buy Link or Shortcode: {j2store}534|cart{/j2store}
      • member rating overall impact: 9.5/10 Overall Impact
      • member rating average dollars saved: $17,249 Average $ Saved
      • member rating average days saved: 7 Average Days Saved
      • Parent Category Name: Customer Relationship Management
      • Parent Category Link: /customer-relationship-management
      • Today’s customers expect to be able to transact with you in the channels of their choice. The proliferation of e-commerce, innovations in brick-and-mortar retail, and developments in mobile commerce and social media selling mean that IT organizations are managing added complexity in drafting a strategy for commerce enablement.
      • The right technology stack is critical in order to support world-class e-commerce and brick-and-mortar interactions with customers.

      Our Advice

      Critical Insight

      • Support the right transactional channels for the right customers: there is no “one-size-fits-all” approach to commerce enablement – understand your customers to drive selection of the right transactional channels.
      • Don’t assume that “traditional” commerce channels have stagnated: IoT, customer analytics, and blended retail are reinvigorating brick-and-mortar selling.
      • Don’t buy best-of-breed; buy best-for-you. Base commerce vendor selection on your requirements and use cases, not on the vendor’s overall performance.

      Impact and Result

      • Leverage Info-Tech’s proven, road-tested approach to using personas and scenarios to build strong business drivers for your commerce strategy.
      • Before selecting and deploying technology solutions, create a cohesive channel matrix outlining which channels your organization will support with transactional capabilities.
      • Understand evolving trends in the commerce solution space, such as AI-driven product recommendations and integration with other essential enterprise applications (i.e. CRM and marketing automation platforms).
      • Understand and apply operational best practices such as content optimization and dynamic personalization to improve the conversion rate via your e-commerce channels.

      Enable Omnichannel Commerce That Delights Your Customers Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Enable Omnichannel Commerce Deck – A deck outlining the importance of creating a cohesive omnichannel framework to improve your customer experience.

      E-commerce channels have proliferated, and traditional brick-and-mortar commerce is undergoing reinvention. In order to provide your customers with a strong experience, it's imperative to create a strategy – and to deploy the right enabling technologies – that allow for robust multi-channel commerce. This storyboard provides a concise overview of how to do just that.

      • Enable Omnichannel Commerce That Delights Your Customers – Phases 1-2

      2. Create Personas to Drive Omnichannel Requirements Template – A template to identify key customer personas for e-commerce and other channels.

      Customer personas are archetypal representations of your key audience segments. This template (and populated examples) will help you construct personas for your omnichannel commerce project.

      • Create Personas to Drive Omnichannel Requirements Template
      [infographic]

      Further reading

      Enable Omnichannel Commerce That Delights Your Customers

      Create a cohesive, omnichannel framework that supports the right transactions through the right channels for the right customers.

      Analyst Perspective

      A clearly outlined commerce strategy is a necessary component of a broader customer experience strategy.

      This is a picture of Ben Dickie, Research Lead, Research – Applications at Info-Tech Research Group

      Ben Dickie
      Research Lead, Research – Applications
      Info-Tech Research Group

      “Your commerce strategy is where the rubber hits the road, converting your prospects into paying customers. To maximize revenue (and provide a great customer experience), it’s essential to have a clearly defined commerce strategy in place.

      A strong commerce strategy seeks to understand your target customer personas and commerce journey maps and pair these with the right channels and enabling technologies. There is not a “one-size-fits-all” approach to selecting the right commerce channels: while many organizations are making a heavy push into e-commerce and mobile commerce, others are seeking to differentiate themselves by innovating in traditional brick-and-mortar sales. Hybrid channel design now dominates many commerce strategies – using a blend of e-commerce and other channels to deliver the best-possible customer experience.

      IT leaders must work with the business to create a succinct commerce strategy that defines personas and scenarios, outlines the right channel matrix, and puts in place the right enabling technologies (for example, point-of-sale and e-commerce platforms).”

      Stop! Are you ready for this project?

      This Research Is Designed For:

      • IT leaders and business analysts supporting their commercial and marketing organizations in developing and executing a technology enablement strategy for e-commerce or brick-and-mortar commerce.
      • Any organization looking to develop a persona-based approach to identifying the right channels for their commerce strategy.

      This Research Will Help You:

      • Identify key personas and customer journeys for a brick-and-mortar and/or e-commerce strategy.
      • Select the right channels for your commerce strategy and build a commerce channel matrix to codify the results.
      • Review the “art of the possible” and new developments in brick-and-mortar and e-commerce execution.

      This Research Will Also Assist:

      • Sales managers, brand managers, and any marketing professional looking to build a cohesive commerce strategy.
      • E-commerce or POS project teams or working groups tasked with managing an RFP process for vendor selection.

      This Research Will Help Them:

      • Build a persona-centric commerce strategy.
      • Understand key technology trends in the brick-and-mortar and e-commerce space.

      Executive Summary

      Your Challenge

      Today’s customers expect to be able to transact with you in the channels of their choice.

      The proliferation of e-commerce, innovations in brick-and-mortar retail, and developments in mobile commerce and social media selling mean that IT organizations are managing added complexity in drafting a strategy for commerce enablement.

      The right technology stack is critical to support world-class e-commerce and brick-and-mortar interactions with customers.

      Common Obstacles

      Many organizations do not define strong, customer-centric drivers for dictating which channels they should be investing in for transactional capabilities.

      As many retailers look to move shopping experiences online during the pandemic, the impetus for having a strong e-commerce suite has markedly increased. The proliferation of commerce vendors has made it difficult to identify and shortlist the right solution, while the pandemic has also highlighted the importance of adopting new vendors quickly and efficiently: companies need to understand the top players in different commerce market landscapes.

      IT is receiving a growing number of commerce platform requests and must be prepared to speak intelligently about requirements and the “art of the possible.”

      Info-Tech’s Approach

      • Leverage Info-Tech’s proven, road-tested approach to using personas and scenarios to build strong business drivers for your commerce strategy.
      • Before selecting and deploying technology solutions, create a cohesive channel matrix outlining which channels your organization will support with transactional capabilities.
      • Understand evolving trends in the commerce solution space, such as AI-driven product recommendations and integration with other essential enterprise applications (i.e. customer relationship management [CRM] and marketing automation platforms).
      • Understand and apply operational best practices such as content optimization and dynamic personalization to improve the conversion rate via your e-commerce channels.

      Info-Tech Insight

      • Support the right transactional channels for the right customers: there is no “one-size-fits-all” approach to commerce enablement – understand your customers to drive selection of the right transactional channels.
      • Don’t assume that “traditional” commerce channels have stagnated: IoT, customer analytics, and blended retail are reinvigorating brick-and-mortar selling.
      • Don’t buy best-of-breed; buy best-for-you: base commerce vendor selection on your requirements and use cases, not on the vendor’s overall performance.

      A strong commerce strategy is an essential component of a savvy approach to customer experience management

      A commerce strategy outlines an organization’s approach to selling its products and services. A strong commerce strategy identifies target customers’ personas, commerce journeys that the organization wants to support, and the channels that the organization will use to transact with customers.

      Many commerce strategies encompass two distinct but complementary branches: a commerce strategy for transacting through traditional channels and an e-commerce strategy. While the latter often receives more attention from IT, it still falls on IT leaders to provide the appropriate enabling technologies to support traditional brick-and-mortar channels as well. Traditional channels have also undergone a digital renaissance in recent years, with forward-looking companies capitalizing on new technology to enhance customer experiences in their stores.

      Traditional Channels

      • Physical Stores (Brick and Mortar)
      • Kiosks or Pop-Up Stores
      • Telesales
      • Mail Orders
      • EDI Transactions

      E-Commerce Channels

      • E-Commerce Websites
      • Mobile Commerce Apps
      • Embedded Social Shopping
      • Customer Portals
      • Configure Price Quote Tool Sets (CPQ)
      • Hybrid Retail

      Info-Tech Insight

      To better serve their customers, many companies position themselves as “click-and-mortar” shops – allowing customers to transact at a store or online.

      Customers’ expectations are on the rise: meet them!

      Today’s consumers expect speed, convenience, and tailored experiences at every stage of the customer lifecycle. Successful organizations strive to support these expectations.

      58%
      of retail customers admitted that their expectations now are higher than they were a year ago (FinancesOnline).

      70%
      of consumers between the ages of 18 and 34 have increasing customer expectations year after year (FinancesOnline).

      69%
      of consumers now expect store associates to be armed with a mobile device to deliver value-added services, such as looking up product information and checking inventory (V12).

      73%
      of support leaders agree that customer expectations are increasing, but only…

      42%
      of support leaders are confident that they’re actually meeting those expectations.

      How can you be sure that you are meeting your customers’ expectations?

      1. Offer more personalization throughout the entire customer journey
      2. Practice quality customer service – ensure staff have up-to-date knowledge and offer quick resolution time for complaints
      3. Focus on offering low-effort experiences and easy-to-use platforms (i.e. “one-click buying”)
      4. Ensure your products and services perform well and do what they’re meant to do
      5. Ensure omnichannel availability – 9 in 10 consumers want a seamless omnichannel experience

      Info-Tech Insight

      Customers expect to interact with organizations through the channels of their choice. Now more than ever, you must enable your organization to provide tailored commerce and transactional experiences.

      Omnichannel commerce is the way of the future

      Create a strategy that embraces this reality with the right tools!

      Get ahead of the competition by doing omnichannel right! Devise a strategy that allows you to create and maintain a consistent, seamless commerce experience by optimizing operations with an omnichannel framework. Customers want to interact with you on their own terms, and it falls to IT to ensure that applications are in place to support and manage both traditional and e-commerce channels. There must also be consistency of copy, collateral, offers, and pricing between commerce channels.

      71%
      of consumers want a consistent experience across all channels, but only…

      29%
      say that they actually get it.

      (Source: Business 2 Community, 2020)

      Omnichannel is a “multichannel approach that aims to provide customers with a personalized, integrated, and seamless shopping experience across diverse touchpoints and devices.”
      Source: RingCentral, 2021

      IT is responsible for providing technology enablement of the commerce strategy: e-commerce platforms are a cornerstone

      An e-commerce platform is an enterprise application that provides end-to-end capabilities for allowing customers to purchase products or services from your company via an online channel (e.g. a traditional website, a mobile application, or an embedded link in a social media post). Modern e-commerce platforms are essential for delivering a frictionless customer journey when it comes to purchasing online.

      $6.388
      trillion dollars worth of sales will be conducted online by 2024 (eMarketer, 14 Jan. 2021).

      44%
      of all e-commerce transactions are expected to be completed via a mobile device by 2024 (Insider).

      21.8%
      of all sales will be made from online purchases by 2024 (eMarketer, 14 Jan. 2021).

      Strong E-Commerce Platforms Enable a Wide Range of Functional Areas:

      • Product Catalog Management
      • Web Content Delivery
      • Product Search Engine
      • Inventory Management
      • Shopping Cart Management
      • Discount and Coupon Management
      • Return Management and Reverse Logistics
      • Dynamic Personalization
      • Dynamic Promotions
      • Predictive Re-Targeting
      • Predictive Product Recommendations
      • Transaction Processing
      • Compliance Management
      • Commerce Workflow Management
      • Loyalty Program Management
      • Reporting and Analytics

      An e-commerce solution boosts the effectiveness and efficiency of your operations and drives top-line growth

      Take time to learn the capabilities of modern e-commerce applications. Understanding the “art of the possible” will help you to get the most out of your e-commerce platform.

      An e-commerce platform helps marketers and sales staff in three primary ways:

      1. It allows the organization to effectively and efficiently operate e-commerce operations at scale.
      2. It allows commercial staff to have a single system for managing and monitoring all commercial activity through online channels.
      3. It allows the organization to improve the customer-facing e-commerce experience, boosting conversions and top-line sales.

      A dedicated e-commerce platform improves the efficiency of customer-commerce operations

      • Workflow automation reduces the amount of time spent executing dynamic e-commerce campaigns.
      • The use of internal or third-party data increases conversion effectiveness from customer databases across the organization.

      Info-Tech Insight

      A strong e-commerce provides marketers with the data they need to produce actionable insights about their customers.

      Case Study

      INDUSTRY - Retail
      SOURCE - Salesforce (a)

      PetSmart improves customer experience by leveraging a new commerce platform in the Salesforce ecosystem

      PetSmart

      PetSmart is a leading retailer of pet products, with a heavy footprint across North America. Historically, PetSmart was a brick-and-mortar retailer, but it has placed a heavy emphasis on being a true multi-channel “click-and-mortar” retailer to ensure it maintains relevance against competitors like Amazon.

      E-Commerce Overhaul Initiative

      To improve its e-commerce capabilities, PetSmart recognized that it needed to consolidate to a single, unified e-commerce platform to realize a 360-degree view of its customers. A new platform was also required to power dynamic and engaging experiences, with appropriate product recommendations and tailored content. To pursue this initiative, the company settled on Salesforce.com’s Commerce Cloud product after an exhaustive requirements definition effort and rigorous vendor selection approach.

      Results

      After platform implementation, PetSmart was able to effortlessly handle the massive transaction volumes associated with Black Friday and Cyber Monday and deliver 1:1 experiences that boosted conversion rates.

      PetSmart standardized on the Commerce Cloud from Salesforce to great effect.

      This is an image of the journey from Discover & Engage to Retain & Advocate.

      Case Study

      Icebreaker exceeds customer expectations by using AI to power product recommendations

      INDUSTRY - Retail
      SOURCE - Salesforce (b)

      Icebreaker

      Icebreaker is a leading outerwear and lifestyle clothing company, operating six global websites and owning over 5,000 stores across 50 countries. Icebreaker is focused on providing its shoppers with accurate, real-time product suggestions to ensure it remains relevant in an increasingly competitive online market.

      E-Commerce Overhaul Initiative

      To improve its e-commerce capabilities, Icebreaker recognized that it needed to adopt a predictive recommendation engine that would offer its customers a more personalized shopping experience. This new system would need to leverage relevant data to provide both known and anonymous shoppers with product suggestions that are of interest to them. To pursue this initiative, Icebreaker settled on using Salesforce.com’s Commerce Cloud Einstein, a fully integrated AI.

      Results

      After integrating Commerce Cloud Einstein on all its global sites, Icebreaker was able to cross-sell and up-sell its merchandise more effectively by providing its shoppers with accurate product recommendations, ultimately increasing average order value.

      IT must also provide technology enablement for other channels, such as point-of-sale systems for brick-and-mortar

      Point-of-sale systems are the “real world” complement to e-commerce platforms. They provide functional capabilities for selling products in a physical store, including basic inventory management, cash register management, payment processing, and retail analytics. Many firms struggle with legacy POS environments that inhibit a modern customer experience.

      $27.338
      trillion dollars in retail sales are expected to be made globally in 2022 (eMarketer, 2022).

      84%
      of consumers believe that retailers should be doing more to integrate their online and offline channels (Invoca).

      39%
      of consumers are unlikely or very unlikely to visit a retailer’s store if the online store doesn’t provide physical store inventory information (V12).

      Strong Point-of-Sale Platforms Enable a Wide Range of Functional Areas:

      • Product Catalog Management
      • Discount Management
      • Coupon Management and Administration
      • Cash Management
      • Cash Register Reconciliation
      • Product Identification (Barcode Management)
      • Payment Processing
      • Compliance Management
      • Basic Inventory Management
      • Commerce Workflow Management
      • Exception Reporting and Overrides
      • Loyalty Program Management
      • Reporting and Analytics

      E-commerce and POS don’t live in isolation

      They’re key components of a well-oiled customer experience ecosystem!

      Integrate commerce solutions with other customer experience applications – and with ERP or logistics systems – to handoff transactions for order fulfilment.

      Having a customer master database – the central place where all up-to-the-minute data on a customer profile is stored – is essential for traditional and e-commerce success. Typically, the POS or e-commerce platform is not the system of record for the master customer profile: this information lives in a CRM platform or customer data warehouse. Conceptually, this system is at the center of the customer-experience ecosystem.

      Strong POS and e-commerce solutions orchestrate transactions but typically do not do the heavy lifting in terms of order fulfilment, shipping logistics, economic inventory management, and reverse logistics (returns). In an enterprise-grade environment, these activities are executed by an enterprise resource planning (ERP) solution – integrating your commerce systems with a back-end ERP solution is a crucial step from an application architecture point of view.

      This is an example of a customer experience ecosystem.  Core Apps (CRM, ERP): MMS Suite; E-Commerce; POS; Web CMS; Data Marts/BI Tools; Social Media Platforms

      Case Study

      INDUSTRY - Retail
      SOURCES - Amazon, n.d. CNET, 2020

      Amazon is creating a hybrid omnichannel experience for retail by introducing innovative brick-and-mortar stores

      Amazon

      Amazon began as an online retailer of books in the mid-1990s, and rapidly expanded its product portfolio to nearly every category imaginable. Often hailed as the foremost success story in online commerce, the firm has driven customer loyalty via consistently strong product recommendations and a well-designed site.

      Bringing Physical Retail Into the Digital Age

      Beginning in 2016 (and expanding in 2018), Amazon introduced Amazon Go, a next-generation grocery retailer, to the Seattle market. While most firms that pursue an e-commerce strategy traditionally come from a brick-and-mortar background, Amazon upended the usual narrative: the world’s largest online retailer opening physical stores to become a true omnichannel, “click-and-mortar” vendor. From the get-go, Amazon Go focused on innovating the physical retail experience – using cameras, IoT capabilities, and mobile technologies to offer “checkout-free” virtual shopping carts that automatically know what products customers take off the shelves and bill their Amazon accounts accordingly.

      Results

      Amazon received a variety of industry and press accolades for re-inventing the physical store experience and it now owns and operates seven separate store brands, with more still on the horizon.

      Case Study

      INDUSTRY - Retail
      SOURCES - Glossy, 2020

      Old Navy

      Old Navy is a clothing and accessories retail company that owns and operates over 1,200 stores across North America and China. Typically, Old Navy has relied on using traditional marketing approaches, but recently it has shifted to producing more digitally focused campaigns to drive revenue.

      Bringing Physical Retail Into the Digital Age

      To overcome pandemic-related difficulties, including temporary store closures, Old Navy knew that it had to have strong holiday sales in 2020. With the goal of stimulating retail sales growth and maximizing its pre-existing omnichannel capabilities, Old Navy decided to focus more of its holiday campaign efforts online than in years past. With this campaign centered on connected TV platforms, such as Hulu, and social media channels including Facebook, Instagram, and TikTok, Old Navy was able to take a more unique, fun, and good-humored approach to marketing.

      Results

      Old Navy’s digitally focused campaign was a success. When compared with third quarter sales figures from 2019, third quarter net sales for 2020 increased by 15% and comparable sales increased by 17%.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      What does a typical GI on this topic look like?

      Phase 1 Phase 2 Phase 3 Phase 4 Phase 5

      Call #1: Scope requirements, objectives, and your specific challenges.

      Call #2: Assess current maturity.

      Call #4: Identify relationship between current initiatives and capabilities.

      Call #6: Identify strategy risks.

      Call #8: Identify and prioritize improvements.

      Call #3: Identify target-state capabilities.

      Call #5: Create initiative profiles.

      Call #7: Identify required budget.

      Call #9: Summarize results and plan next steps.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

      Enable Omnichannel Commerce That Delights Your Customers – Project Overview

      1. Identify Critical Drivers for Your Omnichannel Commerce Strategy 2. Map Drivers to the Right Channels and Technologies
      Best Practice Toolkit

      1.1 Assess Personas and Scenarios

      1.2 Create Key Drivers and Metrics

      2.1 Build the Commerce Channel Matrix

      2.2 Review Technology and Trends Primer

      Guided Implementations
      • Validate customer personas.
      • Validate commerce scenarios.
      • Review key drivers and metrics.
      • Build the channel matrix.
      • Discuss technology and trends.
      Onsite Workshop

      Module 1:

      Module 2:

      Identify Critical Drivers for Your Omnichannel Commerce Strategy

      Map Drivers to the Right Channels and Technologies

      Phase 1 Outcome:

      Phase 2 Outcome:

      An initial shortlist of customer-centric drivers for your channel strategy and supporting metrics.

      A completed commerce channel matrix tailored to your organization, and a snapshot of enabling technologies and trends.

      Phase 1

      Identify Critical Drivers for Your Omnichannel Commerce Strategy

      1.1 Assess Personas and Scenarios

      1.2 Create Key Drivers and Metrics

      Enable Omnichannel Commerce That Delights Your Customers

      Step 1.1

      Assess Personas and Scenarios

      This step will walk you through the following activities:

      1.1.1 Build key customer personas for your commerce strategy.

      1.1.2 Create commerce scenarios (journey maps) that you need to enable.

      Identify Critical Drivers for Your Omnichannel Commerce Strategy

      This step involves the following participants:

      • Business stakeholders (Sales, Marketing)
      • IT project team

      Outcomes of this step:

      • Critical customer personas
      • Key traditional and e-commerce scenarios

      Use customer personas to picture who will be using your commerce channels and guide scenario design and key drivers

      What Are Personas?

      Personas are detailed descriptions of the targeted audience of your e-commerce presence. Effective personas:

      • Express and focus on the major needs and expectations of the most important user groups.
      • Give a clear picture of the typical user’s behavior.
      • Aid in uncovering universal features and functionality.
      • Describe real people with backgrounds, goals, and values.

      Source: Usability.gov, n.d.

      Why Are Personas Important?

      Personas help:

      • Focus the development of commerce platform features on the immediate needs of the intended audience.
      • Detail the level of customization needed to ensure content is valuable to the user.
      • Describe how users may behave when certain audio and visual stimulus are triggered from the website.
      • Outline the special design considerations required to meet user accessibility needs.

      Key Elements of a Persona:

      • Persona Group (e.g. executives)
      • Demographics (e.g. nationality, age, language spoken)
      • Purpose of Using Commerce Channels (e.g. product search versus ready to transact)
      • Typical Behaviors and Tendencies (e.g. goes to different websites when cannot find products in 20 seconds)
      • Technological Environment of User (e.g. devices, browsers, network connection)
      • Professional and Technical Skills and Experiences (e.g. knowledge of websites, area of expertise)

      Use Info-Tech’s guidelines to assist in the creation of personas

      How many personas should I create?

      The number of personas that should be created is based on the organizational coverage of your commerce strategy. Here are some questions you should ask:

      • Do the personas cover a majority of your revenues or product lines?
      • Is the number manageable for your project team to map out?

      How do I prioritize which personas to create?

      The identified personas should generate the most revenue – or provide a significant opportunity – for your business. Here are some questions that you should ask:

      • Are the personas prioritized based on the revenue they generate for the business?
      • Is the persona prioritization process considering both the present and future revenues the persona is generating?

      Sample: persona for e-commerce platform

      Example

      Persona quote: “After I call the company about the widget, I would usually go onto the company’s website and look at further details about the product. How am I supposed to do so when it is so hard to find the company’s website on everyday search engines, such as Google, Yahoo, or Bing?”

      Michael is a middle-aged manager working in the financial district. He wants to buy the company’s widgets for use in his home, but since he is distrusting of online shopping, he prefers to call the company’s call center first. Afterwards, if Michael is convinced by the call center representative, he will look at the company’s website for further research before making his purchase.

      Michael does not have a lot of free time on his hands, and tries to make his free time as relaxing as possible. Due to most of his work being client-facing, he is not in front of a computer most of the time during his work. As such, Michael does not consider himself to be skilled with technology. Once he makes the decision to purchase, Michael will conduct online transactions and pay most delivery costs due to his shortage of time.

      Needs:

      • Easy-to-find website and widget information.
      • Online purchasing and delivery services.
      • Answer to his questions about the widget.
      • To maintain contact post-purchase for easy future transactions.

      Info-Tech Tip

      The quote attached to a persona should be from actual quotes that your customers have used when you reviewed your voice of the customer (VoC) surveys or focus groups to drive home the impact of their issues with your company.

      1.1.1 Activity: Build personas for your key customers that you’ll need to support via traditional and e-commerce channels

      1 hour

      1. In two to four groups, list all the major, target customer personas that need to be built. In doing so, consider the people who interact with your e-commerce site (or other channels) most often.
      2. Build a demographic profile for each customer persona. Include information such as age, geographic location, occupation, and annual income.
      3. Augment the persona with a psychographic profile. Consider the goals and objectives of each customer persona and how these might inform buyer behaviors.
      4. Introduce your group’s personas to the entire group, in a round-robin fashion, as if you are introducing your persona at a party.
      5. Summarize the personas in a persona map. Rank your personas according to importance and remove any duplicates.
      6. Use Info-Tech’s Create Personas to Drive Omnichannel Requirements Template to assist.

      Info-Tech Insight

      Persona building is typically used for understanding the external customer; however, if you need to gain a better understanding of the organization’s internal customers (those who will be interacting with the e-commerce platform), personas can also be built for this purpose. Examples of useful internal personas are sales managers, brand managers, and customer service directors.

      1.1.1 Activity: Build personas for your key customers that you’ll need to support via traditional and e-commerce channels (continued)

      Input

      • Customer demographics and psychographics

      Output

      • List of prioritized customer personas

      Materials

      • Whiteboard
      • Markers

      Participants

      • Project team

      Build use-case scenarios to model the transactional customer journey and inform drivers for your commerce strategy

      A use-case scenario is a story or narrative that helps explore the set of interactions that a customer has with an organization. Scenario mapping will help identify key business and technology drivers as well as more granular functional requirements for POS or e-commerce platform selection.

      A GOOD SCENARIO…

      • Describes specific task(s) that need to be accomplished.
      • Describes user goals and motivations.
      • Describes interactions with a compelling but not overwhelming amount of detail.
      • Can be rough, as long as it provokes ideas and discussion.

      SCENARIOS ARE USED TO...

      • Provide a shared understanding about what a user might want to do and how they might want to do it.
      • Help construct the sequence of events that are necessary to address in your user interface(s).

      TO CREATE GOOD SCENARIOS…

      • Keep scenarios high level, not granular, in nature.
      • Identify as many scenarios as possible. If you’re time constrained, try to develop two to three key scenarios per persona.
      • Sketch each scenario out so that stakeholders understand the goal of the scenario.

      1.1.2 Exercise: Build commerce user scenarios to understand what you want your customers to do from a transactional viewpoint

      1 hour

      Example

      Simplified E-Commerce Workflow Purchase Products

      This image contains an example of a Simplified E-Commerce Workflow Purchase Products

      Step 1.2

      Create Key Drivers and Metrics

      This step will walk you through the following activities:

      • Create the business drivers you need to enable with your commerce strategy.
      • Enumerate metrics to track the efficacy of your commerce strategy.

      Identify Critical Drivers for Your Omnichannel Commerce Strategy

      This step involves the following participants:

      • Business stakeholders (Sales, Marketing)
      • IT project team

      Outcomes of this step:

      • Business drivers for the commerce strategy
      • Metrics and key performance indicators for the commerce strategy

      1.2 Finish elaboration of your scenarios and map them to your personas: identify core business drivers for commerce

      1.5 hours

      1. List all commerce scenarios required to satisfy the immediate needs of your personas.
        1. Does the use-case scenario address commonly felt user challenges?
        2. Can the scenario be used by those with changing behaviors and tendencies?
      2. Look for recurring themes in use-case scenarios (for example, increasing average transaction cost through better product recommendations) and identify business drivers: drivers are common thematic elements that can be found across multiple scenarios. These are the key principles for your commerce strategy.
      3. Prioritize your use cases by leveraging the priorities of your business drivers.

      Example

      This is an example of how step 1.2 can help you identify business drivers

      1.2 Finish elaboration of your scenarios and map them to your personas: identify core business drivers for commerce (continuation)

      Input

      • User personas

      Output

      • List of use cases
      • Alignment of use cases to business objectives

      Materials

      • Whiteboard
      • Markers

      Participants

      • Business Analyst
      • Developer
      • Designer

      Show the benefits of commerce solution deployment with metrics aimed at both overall efficacy and platform adoption

      The ROI and perceived value of the organization’s e-commerce and POS solutions will be a critical indication of the success of the suite’s selection and implementation.

      Commerce Strategy and Technology Adoption Metrics

      EXAMPLE METRICS

      Commerce Performance Metrics

      Average revenue per unique transaction

      Quantity and quality of commerce insights

      Aggregate revenue by channel

      Unique customers per channel

      Savings from automated processes

      Repeat customers per channel

      User Adoption and Business Feedback Metrics

      User satisfaction feedback

      User satisfaction survey with technology

      Business adoption rates

      Application overhead cost reduction

      Info-Tech Insight

      Even if e-commerce metrics are difficult to track right now, the implementation of a dedicated e-commerce platform brings access to valuable customer intelligence from data that was once kept in silos.

      Phase 2

      Map Drivers to the Right Channels and Technologies

      2.1 Build the Commerce Channel Matrix

      2.2 Review Technology and Trends Primer

      Enable Omnichannel Commerce That Delights Your Customers

      Step 2.1

      Build the Commerce Channel Matrix

      This step will walk you through the following activities:

      • Based on your business drivers, create a blended mix of e-commerce channels that will suit your organization’s and customers’ needs.

      Map Drivers to the Right Channels and Technologies

      This step involves the following participants:

      • Business stakeholders (Sales, Marketing)
      • IT project team

      Outcomes of this step:

      • Commerce channel map

      Pick the transactional channels that align with your customer personas and enable your target scenarios and drivers

      Traditional Channels

      E-Commerce Channels

      Hybrid Channels

      Physical stores (brick and mortar) are the mainstay of retailers selling tangible goods – some now also offer intangible service delivery.

      E-commerce websites as exemplified by services like Amazon are accessible by a browser and deliver both goods and services.

      Online ordering/in-store fulfilment is a model whereby customers can place orders online but pick the product up in store.

      Telesales allows customers to place orders over the phone. This channel has declined in favor of mobile commerce via smartphone apps.

      Mobile commerce allows customers to shop through a dedicated, native mobile application on a smartphone or tablet.

      IoT-enabled smart carts/bags allow customers to shop in store, but check-out payments are handled by a mobile application.

      Mail order allows customers to send (”snail”) mail orders. A related channel is fax orders. Both have diminished in favor of e-commerce.

      Social media embedded shopping allows customers to order products directly through services such as Facebook.

      Info-Tech Insight

      Your channel selections should be driven by customer personas and scenarios. For example, social media may be extensively employed by some persona types (i.e. millennials) but see limited adoption in other demographics or use cases (i.e. B2B).

      2.1 Activity: Build your commerce channel matrix

      30 minutes

      1. Inventory which transactional channels are currently used by your firm (segment by product lines if variation exists).
      2. Interview product leaders, sales leaders, and marketing managers to determine if channels support transactional capabilities or are used for marketing and service delivery.
      3. Review your customer personas, scenarios, and drivers and assess which of the channels you will use in the future to sell products and services. Document below.

      Example: Commerce Channel Map

      Product Line A Product Line B Product Line C
      Currently Used? Future Use? Currently Used? Future Use? Currently Used? Future Use?
      Store Yes Yes No No No No
      Kiosk Yes No No No No No
      E-Commerce Site/Portal No Yes Yes Yes Yes Yes
      Mobile App No No Yes Yes No Yes
      Embedded Social Yes Yes Yes Yes Yes Yes

      Input

      • Personas, scenarios, and driver

      Output

      • Channel map

      Materials

      • Whiteboard
      • Markers

      Participants

      • Project team

      Step 2.2

      Review Technology and Trends Primer

      This step will walk you through the following activities:

      • Review the scope of e-commerce and POS solutions and understand key drivers impacting e-commerce and traditional commerce.

      Map Drivers to the Right Channels and Technologies

      This step involves the following participants:

      • Business stakeholders (Sales, Marketing)
      • IT project team

      Outcomes of this step:

      • Understanding of key technologies
      • Understanding of key trends

      Application spotlight: e-commerce platforms

      How It Enables Your Strategy

      • Modern e-commerce platforms provide capabilities for end-to-end orchestration of online commerce experiences, from product site deployment to payment processing.
      • Some e-commerce platforms are purpose-built for business-to-business (B2B) commerce, emphasizing customer portals and EDI features. Other e-commerce vendors place more emphasis on business-to-consumer (B2C) capabilities, such as product catalog management and executing transactions at scale.
      • There has been an increasing degree of overlap between traditional web experience management solutions and the e-commerce market; for example, in 2018, Adobe acquired Magento to augment its overall web experience offering within Adobe Experience Manager.
      • E-commerce platforms typically fall short when it comes to order fulfilment and logistics; this piece of the puzzle is typically orchestrated via an ERP system or logistics management module.
      • This research provides a starting place for defining e-commerce requirements and selection artefacts.

      Key Trends

      • E-commerce vendors are rapidly supporting a variety of form factors and integration with other channels such as social media. Mobile is sufficiently popular that some vendors and industry commentators refer to it as “m-commerce” to differentiate app-based shopping experiences from those accessed through a traditional browser.
      • Hybrid commerce is driving more interplay between e-commerce solutions and POS.

      E-Commerce KPIs

      Strong e-commerce applications can improve:

      • Bounce Rates
      • Exit Rates
      • Lead Conversion Rates
      • Cart Abandonment Rates
      • Re-Targeting Efficacy
      • Average Cart Size
      • Average Cart Value
      • Customer Lifetime Value
      • Aggregate Reach/Impressions

      Familiarize yourself with the e-commerce market

      How it got here

      Initial Traction as the Dot-Com Era Came to Fruition

      Unlike some enterprise application markets, such as CRM, the e-commerce market appeared almost overnight during the mid-to-late nineties as the dot-com explosion fueled the need to have reliable solutions for executing transactions online.

      Early e-commerce solutions were less full-fledged suites than they were mediums for payment processing and basic product list management. PayPal and other services like Digital River were pioneers in the space, but their functionality was limited vis-à-vis tools such as web content management platforms, and their ability to amalgamate and analyze the data necessary for dynamic personalization and re-targeting was virtually non-existent.

      Rapidly Expanding Scope of Functional Capabilities as the Market Matured

      As marketers became more sophisticated and companies put an increased focus on customer experience and omnichannel interaction, the need arose for platforms that were significantly more feature rich than their early contemporaries. In this context, vendors such as Shopify and Demandware stepped into the limelight, offering far richer functionality and analytics than previous offerings, such as asset management, dynamic personalization, and the ability to re-target customers who abandoned their carts.

      As the market has matured, there has also been a series of acquisitions of some players (for example, Demandware by Salesforce) and IPOs of others (i.e. Shopify). Traditional payment-oriented services like PayPal still fill an important niche, while newer entrants like Square seek to disrupt both the e-commerce market and point-of-sale solutions to boot.

      Familiarize yourself with the e-commerce market

      Where it’s going

      Support for a Proliferation of Form Factors and Channels

      Modern e-commerce solutions are expanding the number of form factors (smartphones, tablets) they support via both responsive design and in-app capabilities. Many platforms now also support embedded purchasing options in non-owned channels (for example, social media). With the pandemic leading to a heightened affinity for online shopping, the importance of fully using these capabilities has been further emphasized.

      AI and Machine Learning

      E-commerce is another customer experience domain ripe for transformation via the potential of artificial intelligence. Machine learning algorithms are being used to enhance the effectiveness of dynamic personalization of product collateral, improve the accuracy of product recommendations, and allow for more effective re-targeting campaigns of customers who did not make a purchase.

      Merger of Online Commerce and Traditional Point-of-Sale

      Many e-commerce vendors – particularly the large players – are now going beyond traditional e-commerce and making plays into brick-and-mortar environments, offering point-of-sale capabilities and the ability to display product assets and customizations via augmented reality – truly blending the physical and virtual shopping experience.

      Emphasis on Integration with the Broader Customer Experience Ecosystem

      The big names in e-commerce recognize they don’t live on an island: out-of-the-box integrations with popular CRM, web experience, and marketing automation platforms have been increasing at a breakneck pace. Support for digital wallets has also become increasingly popular, with many vendors integrating contactless payment technology (i.e. Apple Pay) directly into their applications.

      E-Commerce Vendor Snapshot: Part 1

      Mid-Market E-Commerce Solutions

      This image contains the logos for the following Companies: Magento; Spryker; Bigcommerce; Woo Commerce; Shopify

      E-Commerce Vendor Snapshot: Part 2

      Large Enterprise and Full-Suite E-Commerce Platforms

      This image contains the logos for the following Companies: Salesforce commerce cloud; Oracle Commerce Cloud; Adobe Commerce Cloud; Sitecore; Sap Hybris Commerce

      Speak with category experts to dive deeper into the vendor landscape

      • Fact-based reviews of business software from IT professionals.
      • Product and category reports with state-of-the-art data visualization.
      • Top-tier data quality backed by a rigorous quality assurance process.
      • User-experience insight that reveals the intangibles of working with a vendor.

      Software Reviews is powered by Info-Tech

      Technology coverage is a priority for Info-Tech, and SoftwareReviews provides the most comprehensive unbiased data on today’s technology. The insights of our expert analysts provide unparalleled support to our members at every step of their buying journey.

      CLICK HERE to access SoftwareReviews Comprehensive software reviews to make better IT decisions.

      We collect and analyze the most detailed reviews on enterprise software from real users to give you an unprecedented view into the product and vendor before you buy.

      Evaluate software category leaders through vendor rankings and awards

      SoftwareReviews

      This is an image of the data quarant report

      The Data Quadrant is a thorough evaluation and ranking of all software in an individual category to compare platforms across multiple dimensions.

      This is an image of the data quarant report chart

      Vendors are ranked by their Composite Score, based on individual feature evaluations, user satisfaction rankings, vendor capability comparisons, and likeliness to recommend the platform.

      This is a image of the Emotional Footprint Report

      The Emotional Footprint is a powerful indicator of overall user sentiment toward the relationship with the vendor, capturing data across five dimensions.

      This is a image of the Emotional Footprint Report chart

      Vendors are ranked by their Customer Experience (CX) Score, which combines the overall Emotional Footprint rating with a measure of the value delivered by the solution.

      Leading B2B E-Commerce Platforms

      As of February 2022

      Data Quadrant

      This image contains a screenshot of the Data Quadrant chart for B2B E-commerce

      Emotional Footprint

      This image contains a screenshot of the Emotional Footprint chart for B2B E-commerce

      Leading B2C E-Commerce Platforms

      As of February 2022

      Data Quadrant

      This image contains a screenshot of the Data Quadrant chart for B2C E-commerce

      Emotional Footprint

      This image contains a screenshot of the Emotional Footprint chart for B2C E-commerce

      Application spotlight: point-of-sale solutions

      How It Enables Your Strategy

      • Point-of-sale solutions provide capabilities for cash register/terminal management, transaction processing, and lightweight inventory management.
      • Many POS vendors also offer products that have the ability to create orders from EDI, phone, or fax channels.
      • An increasing emphasis has been placed on retail analytics by POS vendors – providing reporting and analysis tools to help with inventory planning, promotion management, and product recommendations.
      • Integration of POS systems with a central customer data warehouse or other system of record for customer information allows for the ability to build richer customer profiles and compare shopping habits in physical stores against other transactional channels that are offered.
      • POS vendors often offer (or integrate with) loyalty management solutions to track, manage, and redeem loyalty points. See this note on loyalty management systems.
      • Legacy and/or homegrown POS systems tend to be an area of frustration for customer experience management modernization.

      Key Trends

      • POS solutions are moving from “cash-register-only” solutions to encompass mobile POS form factors like smartphones and tablets. Vendors such as Square have experienced tremendous growth in opening up the market via “mPOS” platforms that have lower costs to entry than the traditional hardware needed to support full-fledged POS solutions.
      • This development puts robust POS toolsets in the hands of small and medium businesses that otherwise would be priced out of the market.

      POS KPIs

      Strong POS applications can improve:

      • Customer Data Collection
      • Inventory or Cash Shrinkage
      • Cost per Transaction
      • Loyalty Program Administration Costs
      • Cycle Time for Transaction Execution

      Point-of-Sales Vendor Snapshot: Part 1

      Mid-Market POS Solutions

      This image contains the following company Logos: Square; Shopify; Vend; Heartland|Retail

      Point-of-Sales Vendor Snapshot: Part 2

      Large Enterprise POS Platforms

      This image contains the following Logos: Clover; Oracle Netsuite; RQ Retail Management; Salesforce Commerce Cloud; Korona

      Leading Retail POS Systems

      As of February 2022

      Data Quadrant

      This is an image of the Data Quadrant Chart for the Leading Retail Pos Systems

      Emotional Footprint

      This is an image of the Emotional Footprint chart for the Leading Retail POS Systems

      Summary of Accomplishment

      Knowledge Gained

      • Commerce channel framework
      • Customer affinities
      • Commerce channel overview
      • Commerce-enabling technologies

      Processes Optimized

      • Persona definition for commerce strategy
      • Persona channel shortlist

      Deliverables Completed

      • Customer personas
      • Commerce user scenarios
      • Business drivers for traditional commerce and e-commerce
      • Channel matrix for omnichannel commerce

      Bibliography

      “25 Amazing Omnichannel Statistics Every Marketer Should Know (Updated for 2021).” V12, 29 June 2021. Accessed 12 Jan. 2022.

      “Amazon Go.” Amazon, n.d. Web.

      Andersen, Derek. “33 Statistics Retail Marketers Need to Know in 2021.” Invoca, 19 July 2021. Accessed 12 Jan. 2022.

      Andre, Louie. “115 Critical Customer Support Software Statistics: 2022 Market Share Analysis & Data.” FinancesOnline, 14 Jan. 2022. Accessed 25 Jan. 2022.

      Chuang, Courtney. “The future of support: 5 key trends that will shape customer care in 2022.” Intercom, 10 Jan. 2022. Accessed 11 Jan. 2022.

      Cramer-Flood, Ethan. “Global Ecommerce Update 2021.” eMarketer, 13 Jan. 2021. Accessed 12 Jan. 2022.

      Cramer-Flood, Ethan. “Spotlight on total global retail: Brick-and-mortar returns with a vengeance.” eMarketer, 3 Feb. 2022. Accessed 12 Apr. 2022.

      Fox Rubin, Ben. “Amazon now operates seven different kinds of physical stores. Here's why.” CNET, 28 Feb. 2020. Accessed 12 Jan. 2022.

      Krajewski, Laura. “16 Statistics on Why Omnichannel is the Future of Your Contact Center and the Foundation for a Top-Notch Competitive Customer Experience.” Business 2 Community, 10 July 2020. Accessed 11 Jan. 2022.

      Manoff, Jill. “Fun and convenience: CEO Nany Green on Old Navy’s priorities for holiday.” Glossy, 8 Dec. 2020. Accessed 12 Jan. 2022.

      Meola, Andrew. “Rise of M-Commerce: Mobile Ecommerce Shopping Stats & Trends in 2021.” Insider, 30 Dec. 2020. Accessed 12 Jan. 2022.

      “Outdoor apparel retailer Icebreaker uses AI to exceed shopper expectations.” Salesforce, n.d.(a). Accessed 20 Jan. 2022.

      “Personas.” Usability.gov., n.d. Web. 28 Aug. 2018.

      “PetSmart – Why Commerce Cloud?” Salesforce, n.d.(b). Web. 30 April 2018.

      Toor, Meena. “Customer expectations: 7 Types all exceptional researchers must understand.” Qualtrics, 3 Dec. 2020. Accessed 11 Jan. 2022.

      Westfall, Leigh. “Omnichannel vs. multichannel: What's the difference?” RingCentral, 10 Sept. 2021. Accessed 11 Jan. 2022.

      “Worldwide ecommerce will approach $5 trillion this year.” eMarketer, 14 Jan. 2021. Accessed 12 Jan. 2022.

      How to build a Service Desk Chatbot POC

      • Buy Link or Shortcode: {j2store}16|cart{/j2store}
      • Related Products: {j2store}16|crosssells{/j2store}
      • member rating overall impact: 9.7/10
      • member rating average dollars saved: 11,197
      • member rating average days saved: 8
      • Parent Category Name: Service Desk
      • Parent Category Link: /service-desk

      The challenge

      Build a chatbot that creates value for your business

       

      • Ensure your chatbot meets your business needs.
      • Bring scalability to your customer service delivery in a cost-effective manner.
      • Measure your chatbot objectives with clear metrics.
      • Pre-determine your ticket categories to use during the proof of concept.

      Our advice

      Insight

      • Build your chatbot to create business value. Whether increasing service or resource efficiency, keep value creation in mind when making decisions with your proof of concept.

      Impact and results 

      • When implemented effectively, chatbots can help save costs, generate new revenue, and ultimately increase customer satisfaction for external and internal-facing customers.

      The roadmap

      Read our concise Executive Brief to find out why you building a chatbot proof of concept is a good idea, review our methodology, and understand the four ways we can support you to successfully complete this project. Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      Start here

      Form your chatbot strategy.

      Build the right metrics to measure the success of your chatbot POC

      • Chatbot ROI Calculator (xls)
      • Chatbot POC Metrics Tool (xls)

      Build the foundation for your chatbot.

      Architect the chatbot to maximize business value

      • Chatbot Conversation Tree Library

      Continue to improve your chatbot.

      Now take your chatbot proof of concept to production

      • Chatbot POC RACI (doc)
      • Chatbot POC Implementation Roadmap (xls)
      • Chatbot POC Communication Plan (doc)Chatbot ROI Calculator (xls)

      Slash Spending by Optimizing Your Software Maintenance and Support

      • Buy Link or Shortcode: {j2store}217|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Vendor Management
      • Parent Category Link: /vendor-management
      • Perpetual software maintenance (SW M&S) is an annual budget cost that increases almost yearly. You don’t really know if there is value in it, if its required by the vendor, or if there are opportunities for cost savings.
      • Most organizations never reap the full benefits of software M&S. They blindly send renewal fees to the vendor every year without validating their needs or the value of the maintenance. In addition, your vendor maintenance may be under contract and you aren’t sure what the obligations are for both parties.

      Our Advice

      Critical Insight

      • Analyzing the benefits contained within a vendor’s software M&S will provide the actual cost value of the M&S and whether there are critical support requirements vs. “nice to have” benefits.
      • Understanding the value and your requirement for M&S will allow you to make an informed decision on how best to optimize and reduce your annual software M&S spend.
      • Use a holistic approach when looking to reduce your software M&S spend. Review the entire portfolio for targeted reduction that will result in short- and long-term savings.
      • When targeting vendors to negotiate M&S price or coverage reduction, engaging them three to six months in advance of renewal will provide you with more time to effectively negotiate and not fall to the pressure of time.

      Impact and Result

      • Reduce annual costs for software maintenance and support.
      • Complete a value of investment (VOI) analysis of your software M&S for strategic vendors.
      • Maximize value of the software M&S by using all the benefits being paid for.
      • Right-size support coverage for your requirements.
      • Prioritize software vendors to target for cost reduction and optimization.

      Slash Spending by Optimizing Your Software Maintenance and Support Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out how to prioritize your software vendors and effectively target M&S for reduction, optimization, or elimination.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Evaluate

      Evaluate what software maintenance you are spending money.

      • Slash Spending by Optimizing Your Software Maintenance and Support – Phase 1: Evaluate
      • Software M&S Inventory and Prioritization Tool

      2. Establish

      Establish your software M&S requirements and coverage.

      • Slash Spending by Optimizing Your Software Maintenance and Support – Phase 2: Establish
      • Software Vendor Classification Tool

      3. Optimize

      Optimize your M&S spend, reduce or eliminate, where applicable.

      • Slash Spending by Optimizing Your Software Maintenance and Support – Phase 3: Optimize
      • Software M&S Value of Investment Tool
      • Software M&S Cancellation Decision Guide
      • Software M&S Executive Summary Template
      • Software M&S Cancellation Support Template
      [infographic]

      Identify and Manage Financial Risk Impacts on Your Organization

      • Buy Link or Shortcode: {j2store}218|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Vendor Management
      • Parent Category Link: /vendor-management
      • As vendors become more prevalent in organizations, organizations increasingly need to understand and manage the potential financial impacts of vendors’ actions.
      • It is only a matter of time until a vendor mistake impacts your organization. Make sure you are prepared to manage the adverse financial consequences.

      Our Advice

      Critical Insight

      • Identifying and managing a vendor’s potential financial impact requires multiple people in the organization across several functions – and those people all need educating on the potential risks.
      • Organizational leadership is often unaware of decisions on organizational risk appetite and tolerance, and they assume there are more protections in place against risk impact than there truly are.

      Impact and Result

      • Vendor management practices educate organizations on the different potential financial impacts that vendors may incur and suggest systems to help manage them.
      • Prioritize and classify your vendors with quantifiable, standardized rankings.
      • Prioritize focus on your high-risk vendors.
      • Standardize your processes for identifying and monitoring vendor risks to manage financial impacts with our Financial Risk Impact Tool.

      Identify and Manage Financial Risk Impacts on Your Organization Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Identify and Manage Financial Risk Impact on Your Organization Deck – Use the research to better understand the negative financial impacts of vendor actions.

      Use this research to identify and quantify the potential financial impacts of vendors’ poor performance. Use Info-Tech’s approach to look at the financial impact from various perspectives to better prepare for issues that may arise.

      • Identify and Manage Financial Risk Impacts on Your Organization Storyboard

      2. “What If” Financial Risk Impact Tool – Use this tool to help identify and quantify the financial impacts of negative vendor actions.

      By playing the “what if” game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

      • Financial Risk Impact Tool
      [infographic]

      Further reading

      Identify and Manage Financial Risk Impacts on Your Organization

      Good vendor management practices help organizations understand the costs of negative vendor actions.

      Analyst Perspective

      Vendor actions can have significant financial consequences for your organization.

      Photo of Frank Sewell, Research Director, Vendor Management, Info-Tech Research Group.

      Vendors are becoming more influential and essential to the operation of organizations. Often the sole risk consideration of a business is whether the vendor meets a security standard, but vendors can negatively impact organizations’ budgets in various ways. Fortunately, though inherent risk is always present, organizations can offset the financial impacts of high-risk vendors by employing due diligence in their vendor management practices to help manage the overall risks.

      Frank Sewell
      Research Director, Vendor Management
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      As vendors become more prevalent in organizations, organizations increasingly need to understand and manage the potential financial impacts of vendors’ actions.

      It is only a matter of time until a vendor mistake impacts your organization. Make sure you are prepared to manage the adverse financial consequences.

      Common Obstacles

      Identifying and managing a vendor’s potential financial impact requires multiple people in the organization across several functions – and those people all need educating on the potential risks.

      Organizational leadership is often unaware of decisions on organizational risk appetite and tolerance, and they assume there are more protections in place against risk impact than there truly are.

      Info-Tech’s Approach

      Vendor management practices educate organizations on the different potential financial impacts that vendors may incur and suggest systems to help manage them.

      Prioritize and classify your vendors with quantifiable, standardized rankings.

      Prioritize focus on your high-risk vendors.

      Standardize your processes for identifying and monitoring vendor risks to manage financial impacts with our Financial Risk Impact Tool.

      Info-Tech Insight

      Companies without good vendor management risk initiatives will take on more risk than they should. Solid vendor management practices are imperative –organizations must evolve to ensure that vendors deliver services according to performance objectives and that risks are managed accordingly.

      Info-Tech’s multi-blueprint series on vendor risk assessment

      There are many individual components of vendor risk beyond cybersecurity.

      Cube with each multiple colors on each face, similar to a Rubix cube, and individual components of vendor risk branching off of it: 'Financial', 'Reputational', 'Operational', 'Strategic', 'Security', and 'Regulatory & Compliance'.

      This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.

      Out of scope:
      This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.

      Financial risk impact

      Potential losses to the organization due to financial risks

      In this blueprint, we’ll explore financial risks and their impacts.

      Identifying negative actions is paramount to assessing the overall financial impact on your organization, starting in the due diligence phase of the vendor assessment and continuing throughout the vendor lifecycle.

      Cube with each multiple colors on each face, similar to a Rubix cube, and the vendor risk component 'Financial' highlighted.

      Unbudgeted financial risk impact

      The costs of adverse vendor actions, such as a breach or an outage, are increasing. By knowing these potential costs, leaders can calculate how to avoid them throughout the lifecycle of the relationship.

      Loss of business represents the largest share of the breach

      38%

      Avg. $1.59M
      Global average cost of a vendor breach

      $4.2M

      Percentage of breaches in 2020 caused by business associates

      40.2%

      23.2% YoY
      (year over year)
      (Source: “Cost of a Data Breach Report 2021,” IBM, 2021) (Source: “Vendor Risk Management – A Growing Concern,” Stern Security, 2021)

      Example: Hospital IT System Outage

      Hospitals often rely on vendors to manage their data center environments but rarely understand the downstream financial impacts if that vendor fails to perform.

      For example, a vendor implements a patch out of cycle with no notice to the IT group. Suddenly all IT systems are down. It takes 12 hours for the IT teams to return systems to normal. The downstream impacts are substantial.

      • There is no revenue capture during outage (patient registration, payments).
        • The financial loss is significant, impacting cash on hand and jeopardizing future projects.
      • Clinicians cannot access the electronic health record (EHR) system and shift to downtime paper processes.
        • This can cause potential risks to patient health, such as unknown drug interactions.
        • This could also incur lawsuits, fines, and penalties.
      • Staff must manually add the paper records into the EHR after the incident is corrected.
        • Staff time is lost on creating paper records and overtime is required to reintroduce those records into EMR.
      • Staff time and overtime pay on troubleshooting and solving issues take away from normal operations and could cause delays, having downstream effects on the timing of other projects.

      Insight Summary

      Assessing financial impacts is an ongoing, educative, and collaborative multidisciplinary process that vendor management initiatives are uniquely designed to coordinate and manage for organizations.

      Insight 1 Vendors are becoming more and more crucial to organizations’ overall operations, and most organizations have a poor understanding of the potential impacts they represent.

      Is your vendor solvent? Do they have enough staff to accommodate your needs? Has their long-term planning been affected by changes in the market? Are they unique in their space?

      Insight 2 Financial impacts from other risk types deserve just as much focus as security alone, if not more.

      Examples include penalties and fines, loss of revenue due to operational impacts, vendor replacement costs, hidden costs in poorly understood contracts, and lack of contractual protections.

      Insight 3 There is always an inherent risk in working with a vendor, but organizations should financially quantify how much each risk may impact their budget.

      A significant concern for organizations is quantifying different types of risks. When a risk occurs, the financial losses are often poorly understood, with unbudgeted financial impacts.

      Three stages of vendor financial risk assessment

      Assess risk throughout the complete vendor lifecycle

      1. Pre-Relationship Due Diligence: The initial pre-relationship due diligence stage is a crucial point to establish risk management practices. Vendor management practices ensure that a potential vendor’s risk is categorized correctly by facilitating the process of risk assessment.
      2. Monitor & Manage: Once the relationship is in place, organizations should enact ongoing management efforts to ensure they are both getting their value from the vendor and appropriately addressing any newly identified risks.
      3. Termination: When the termination of the relationship arrives, the organization should validate that adequate protections that were established while forming a contract in the pre-relationship stage remain in place.

      Inherent risks from negative actions are pervasive throughout the entire vendor lifecycle. Collaboratively understanding those risks and working together to put proper management in place enables organizations to get the most value out of the relationship with the least amount of risk.

      Flowchart for 'Assessing Financial Risk Impacts', beginning with 'New Vendor' to 'Sourcing' to the six components of 'Vendor Management'. After a gamut of assessments such as ''What If' Game' one can either 'Accept' to move on to 'Pre-Relationship', 'Monitor & Manage', and eventually to 'Termination', or not accept and circle back to 'Sourcing'.

      Stage 1: Pre-relationship assessment

      Do these as part of your due diligence

      • Review and negotiate contract terms and conditions.
        • Ensure that you have the protections to make you whole in the event of an incident, in the event that another entity purchases the vendor, and throughout the entire lifecycle of your relationship with the vendor.
        • Make sure to negotiate your post-termination protections in the initial agreement.
      • Perform a due-diligence financial assessment.
        • Make sure the vendor is positioned in the market to be able to service your organization.
      • Perform an initial risk assessment.
        • Identify and understand all potential factors that may cause financial impacts to your organization.
        • Include total cost of ownership (TCO) and return of investment (ROI) as potential impact offsets.
      • Review case studies – talk to other customers.
        • Research who else has worked with the vendor to get “the good, the bad, and the ugly” stories to form a clear picture of a potential relationship with the vendor.
      • Use proofs of concept.
        • It is essential to know how the vendor and their solutions will work in the environment before committing resources and to incorporate them into organizational strategic plans.
      • Limit vendors’ ability to increase costs over the years. It is not uncommon for a long-term relationship to become more expensive than a new one over time when the increases are unmanaged.
      • Vendor audits can be costly and a significant distraction to your staff. Make sure to contractually limit them.
      • Many vendors enjoy significant revenue from unclear deliverables and vague expectations that lead to change requests at unknown rates – clarifying expectations and deliverables and demanding negotiated rate sheets before engagement will save budget and strengthen the relationship.

      Visit Info-Tech’s VMO ROI Calculator and Tracker

      The “what if” game

      1-3 hours

      Input: List of identified potential risk scenarios scored by likelihood and financial impact, List of potential management of the scenarios to reduce the risk

      Output: Comprehensive financial risk profile on the specific vendor solution

      Materials: Whiteboard/flip charts, Financial Risk Impact Tool to help drive discussion

      Participants: Vendor Management – Coordinator, IT Operations, Legal/Compliance/Risk Manager, Finance/Procurement

      Vendor management professionals are in an excellent position to collaboratively pull together resources across the organization to determine potential risks. By playing the “what if” game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

      1. Break into smaller groups (or if too small, continue as a single group).
      2. Use the Financial Risk Impact Tool to prompt discussion on potential risks. Keep this discussion flowing organically to explore all potential risks but manage the overall process to keep the discussion on track.
      3. Collect the outputs and ask the subject matter experts for management options for each one in order to present a comprehensive risk strategy. You will use this to educate senior leadership so that they can make an informed decision to accept or reject the solution.

      Download the Financial Risk Impact Tool

      Stage 2.1: Monitor the financial risk

      Ongoing monitoring activities

      Never underestimate the value of keeping the relationship moving forward.

      Examples of items and activities to monitor include;

      Stock photo of a worker being trained on a computer.
      • Fines
      • Data leaks
      • Performance
      • Credit monitoring
      • Viability/solvency
      • Resource capacity
      • Operational impacts
      • Regulatory penalties
      • Increases in premiums
      • Security breaches (infrastructure)

      Info-Tech Insight

      Many organizations do not have the resources to dedicate to annual risk assessments of all vendors.

      Consider timing ongoing risk assessments to align with contract renewal, when you have the most leverage with the vendor.

      Visit Info-Tech’s Risk Register Tool

      Stage 2.2: Manage the financial risk

      During the lifecycle of the vendor relationship

      • Renew risk assessments annually.
      • Focus your efforts on highly ranked risks.
      • Is there a new opportunity to negotiate?
      • Identify and classify individual vendor risk.
      • Are there better existing contracts in place?
      • Review financial health checks at the same time.
      • Monitor and schedule contract renewals and new service/module negotiations.
      • Perform business alignment meetings to reassess the relationship.
      • Ongoing operational meetings should be supplemental, dealing with day-to-day issues.
      • Develop performance metrics and hold vendors accountable to established service levels.
      Stock image of a professional walking an uneven line over the words 'Risk Management'.

      Stage 3: Termination

      An essential and often overlooked part of the vendor lifecycle is the relationship after termination

      • The risk of a vendor keeping your data for “as long as they want” is high.
        • Data retention becomes a “forever risk” in today’s world of cyber issues if you do not appropriately plan.
      • Ensure that you always know where data resides and where people are allowed to access that data.
        • If there is a regulatory need to house data only in specific locations, ensure that it is explicit in agreements.
      • Protect your data through language in initial agreements that covers what needs to happen when the relationship with the vendor terminates.
        • Typically, all the data that the vendor has retained is returned and/or destroyed at your sole discretion.
      Stock image of a sign reading 'Closure'.

      Related Info-Tech Research

      Stock photo of two co-workers laughing. Design and Build an Effective Contract Lifecycle Management Process
      • Achieve measurable savings in contract time processing, financial risk avoidance, and dollar savings
      • Understand how to identify and mitigate risk to save the organization time and money.
      Stock image of reports and file folders. Identify and Reduce Agile Contract Risk
      • Manage Agile contract risk by selecting the appropriate level of protections for an Agile project.
      • Focus on the correct contract clauses to manage Agile risk.
      Stock photo of three co-workers gathered around a computer screen. Jump Start Your Vendor Management Initiative
      • Vendor management must be an IT strategy. Solid vendor management is an imperative – IT organizations must develop capabilities to ensure that services are delivered by vendors according to service level objectives and that risks are mitigated according to the organization's risk tolerance.
      • Gain visibility into your IT vendor community. Understand how much you spend with each vendor and rank their criticality and risk to focus on the vendors you should be concentrating on for innovative solutions.

      Build Your Security Operations Program From the Ground Up

      • Buy Link or Shortcode: {j2store}263|cart{/j2store}
      • member rating overall impact: 9.7/10 Overall Impact
      • member rating average dollars saved: $56,299 Average $ Saved
      • member rating average days saved: 43 Average Days Saved
      • Parent Category Name: Security Processes & Operations
      • Parent Category Link: /security-processes-and-operations
      • Analysts cannot monitor and track events coming from multiple tools because they have no visibility into the threat environment.
      • Incident management takes away time from problem management because processes are ad hoc and the continuous monitoring, collection, and analysis of massive volumes of security event data is responsive rather than tactical.
      • Organizations are struggling to defend against and prevent threats while juggling business, compliance, and consumer obligations.

      Our Advice

      Critical Insight

      • Security operations is no longer a center but a process. The need for a physical security hub has evolved into the virtual fusion of prevention, detection, analysis, and response efforts. When all four functions operate as a unified process, your organization will be able to proactively combat changes in the threat landscape.
      • Raw data without correlation is a waste of time, money, and effort. A SIEM on its own will not provide this contextualization and needs configuration. Prevention, detection, analysis, and response processes must contextualize threat data and supplement one another – true value will only be realized once all four functions operate as a unified process.
      • If you are not communicating, then you are not secure. Collaboration eliminates siloed decisions by connecting people, processes, and technologies. You leave less room for error, consume fewer resources, and improve operational efficiency with a transparent security operations process.

      Impact and Result

      • A centralized security operations process actively transforms security events and threat information into actionable intelligence, driving security prevention, detection, analysis, and response processes that address the increasing sophistication of cyberthreats while guiding continuous improvement.
      • This blueprint will walk through the steps of developing a flexible and systematic security operations program relevant to your organization.

      Build Your Security Operations Program From the Ground Up Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should build a security operations program, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish your foundation

      Determine how to establish the foundation of your security operations.

      • Build Your Security Operations Program From the Ground Up – Phase 1: Establish Your Foundation
      • Information Security Pressure Analysis Tool

      2. Assess your current state

      Assess the maturity of your prevention, detection, analysis, and response processes.

      • Build Your Security Operations Program From the Ground Up – Phase 2: Assess Your Current State
      • Security Operations Roadmap Tool

      3. Design your target state

      Design a target state and improve your governance and policy solutions.

      • Build Your Security Operations Program From the Ground Up – Phase 3: Design Your Target State
      • Security Operations Policy

      4. Develop an implementation roadmap

      Make your case to the board and develop a roadmap for your prioritized security initiatives.

      • Build Your Security Operations Program From the Ground Up – Phase 4: Develop an Implementation Roadmap
      • In-House vs. Outsourcing Decision-Making Tool
      • Security Operations MSSP RFP Template
      • Security Operations Project Charter Template
      • Security Operations RACI Tool
      • Security Operations Metrics Summary Document
      [infographic]

      Workshop: Build Your Security Operations Program From the Ground Up

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish Your Foundation

      The Purpose

      Identify security obligations and the security operations program’s pressure posture.

      Assess current people, process, and technology capabilities.

      Determine foundational controls and complete system and asset inventory.

      Key Benefits Achieved

      Identified the foundational elements needed for planning before a security operations program can be built

      Activities

      1.1 Define your security obligations and assess your security pressure posture.

      1.2 Determine current knowledge and skill gaps.

      1.3 Shine a spotlight on services worth monitoring.

      1.4 Assess and document your information system environment.

      Outputs

      Customized security pressure posture

      Current knowledge and skills gaps

      Log register of essential services

      Asset management inventory

      2 Assess Current Security Operations Processes

      The Purpose

      Identify the maturity level of existing security operations program processes.

      Key Benefits Achieved

      Current maturity assessment of security operations processes

      Activities

      2.1 Assess the current maturity level of the existing security operations program processes.

      Outputs

      Current maturity assessment

      3 Design a Target State

      The Purpose

      Design your optimized target state.

      Improve your security operations processes with governance and policy solutions.

      Identify and prioritize gap initiatives.

      Key Benefits Achieved

      A comprehensive list of initiatives to reach ideal target state

      Optimized security operations with repeatable and standardized policies

      Activities

      3.1 Complete standardized policy templates.

      3.2 Map out your ideal target state.

      3.3 Identify gap initiatives.

      Outputs

      Security operations policies

      Gap analysis between current and target states

      List of prioritized initiatives

      4 Develop an Implementation Roadmap

      The Purpose

      Formalize project strategy with a project charter.

      Determine your sourcing strategy for in-house or outsourced security operations processes.

      Assign responsibilities and complete an implementation roadmap.

      Key Benefits Achieved

      An overarching and documented strategy and vision for your security operations

      A thorough rationale for in-house or outsourced security operations processes

      Assigned and documented responsibilities for key projects

      Activities

      4.1 Complete a security operations project charter.

      4.2 Determine in-house vs. outsourcing rationale.

      4.3 Identify dependencies of your initiatives and prioritize initiatives in phases of implementation.

      4.4 Complete a security operations roadmap.

      Outputs

      Security operations project charter

      In-house vs. outsourcing rationale

      Initiatives organized according to phases of development

      Planned and achievable security operations roadmap

      Sustain and Grow the Maturity of Innovation in Your Enterprise

      • Buy Link or Shortcode: {j2store}91|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Innovation
      • Parent Category Link: /innovation
      • Customers are not waiting – they are insisting on change now. The recent litany of business failures and the ongoing demand for improved services means that “not in my backyard” will mean no backyard.
      • Positive innovation is about achieving tomorrow’s success today, where everyone is a leader and ideas and people can flourish – in every sector.

      Our Advice

      Critical Insight

      • Many innovation programs are not delivering value at a time when change is constant and is impacting both public and private sector organizations.
      • Organizations are not well-positioned in terms of leadership skills to advance their innovation programs.
      • Unlock your innovation potential by looking at your innovation projects on both a macro and micro level.
      • Innovation capacity is directly linked with creativity; allow your employees' creativity to flourish using Info-Tech’s positive innovation techniques.
      • Innovations need to be re-harvested each year in order to maximize your return on investment.

      Impact and Result

      • From an opportunity perspective, create an effective innovation program that spawns more innovations, realizes benefits from existing assets not fully being leveraged, and lays the groundwork for enhanced products and services.
      • This complementary toolkit and method (to existing blueprints/research) guides you to assess the “aspiration level” of innovations and the innovation program, assess the resources/capabilities that an entity has to date employed in its innovation program, and position IT for success to achieve the strategic objectives of the enterprise.

      Sustain and Grow the Maturity of Innovation in Your Enterprise Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should formalize processes to improve your innovation program, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Scope and define

      Understand your current innovation capabilities and create a mandate for the future of your innovation program.

      • Sustain and Grow the Maturity of Innovation in Your Enterprise – Phase 1: Scope and Define
      • Innovation Program Mandate and Terms of Reference Template
      • Innovation Program Overview Presentation Template
      • Innovation Assessment Tool

      2. Assess and aspire

      Assess opportunities for your innovation program on a personnel and project level, and provide direction on how to improve along these dimensions.

      • Sustain and Grow the Maturity of Innovation in Your Enterprise – Phase 2: Assess and Aspire
      • Appreciative Inquiry Questionnaire

      3. Implement and inspire

      Formalize the innovation improvements you identified earlier in the blueprint by mapping them to your IT strategy.

      • Sustain and Grow the Maturity of Innovation in Your Enterprise – Phase 3: Implement and Inspire
      • Innovation Planning Tool
      [infographic]

      Workshop: Sustain and Grow the Maturity of Innovation in Your Enterprise

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Pre-Work

      The Purpose

      Gather data that will be analyzed in the workshop.

      Key Benefits Achieved

      Information gathered with which analysis can be performed.

      Activities

      1.1 Do an inventory of innovations/prototypes underway.

      1.2 High-level overview of all existing project charters, and documentation of innovation program.

      1.3 Poll working group or key stakeholders in regards to scope of innovation program.

      Outputs

      Up-to-date inventory of innovations/prototypes

      Document review of innovation program and its results to date

      Draft scope of the innovation program and understanding of the timelines

      2 Scope and Define

      The Purpose

      Scope the innovation program and gain buy-in from major stakeholders.

      Key Benefits Achieved

      Buy-in from IT steering committee for innovation program improvements.

      Activities

      2.1 Establish or re-affirm values for the program.

      2.2 Run an initial assessment of the organization’s innovation potential (macro level).

      2.3 Set/reaffirm scope and budget for the program.

      2.4 Define or refine goals and outcomes for the program.

      2.5 Confirm/re-confirm risk tolerance of organization.

      2.6 Update/document innovation program.

      2.7 Create presentation to gain support from the IT steering committee.

      Outputs

      Innovation program and terms of reference

      Presentation on organization innovation program for IT steering committee

      3 Assess and Aspire

      The Purpose

      Analyze the current performance of the innovation program and identify areas for improvement.

      Key Benefits Achieved

      Identify actionable items that can be undertaken in order to improve the performance of the innovation program.

      Activities

      3.1 Assess your level of innovation per innovation project (micro level).

      3.2 Update the risk tolerance level of the program.

      3.3 Determine if your blend of innovation projects is ideal.

      3.4 Re-prioritize your innovation projects (if needed).

      3.5 Plan update to IT steering committee.

      3.6 Assess positive innovation assessment of team.

      3.7 Opportunity analysis of innovation program and team.

      Outputs

      Positive innovation assessment

      Re-prioritized innovation projects

      Updated presentation for IT steering committee

      4 Implement and Inspire

      The Purpose

      Formalize the innovation program by tying it into the IT strategy.

      Key Benefits Achieved

      A formalized innovation program that is closely tied to the IT strategy.

      Activities

      4.1 Update business context in terms of impact on IT implications.

      4.2 Update IT strategy in terms of impact and benefits of innovation program.

      4.3 Update/create innovation program implementation plan.

      4.4 Plan update for IT steering committee.

      Outputs

      Updated business context

      Updated IT strategy

      Innovation implementation plan, including roadmap

      Updated presentation given to IT steering committee

      pricing

      • TymansGroupVideosExcerpt: BasicFor freelancers$19/ month 10 presentations/monthSupport at $25/hour1 campaign/month Choose plan StandardFor medium sized teams$29/ month 50 presentations/month5 hours of free support10 campaigns/month Choose plan EnterpriseFor large companies$79/ month Unlimited presentationsUnlimited supportUnlimited campaigns Choose plan

      Pricing

      Our pricing options will be available soon for simple download,

      In the meantime, please book a free discovery call. No cost, no sales pitch.

      Continue reading

      Develop APIs That Work Properly for the Organization

      • Buy Link or Shortcode: {j2store}525|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: $1,133,999 Average $ Saved
      • member rating average days saved: 23 Average Days Saved
      • Parent Category Name: Requirements & Design
      • Parent Category Link: /requirements-and-design
      • CIOs have trouble integrating new technologies (e.g. mobile, cloud solutions) with legacy applications, and lack standards for using APIs across the organization.
      • Organizations produce APIs that are error-prone, not consistently configured, and not maintained effectively.
      • Organizations are looking for ways to increase application quality and code reusability to improve development throughput using web APIs.
      • Organizations are looking for opportunities to create an application ecosystem which can expose internal services across the organization and/or to external third parties and business partners.

      Our Advice

      Critical Insight

      • Organizations are looking to go beyond current development practices to provide scalable and reusable web services.
      • Web API development is a tactical competency that is important to enabling speed of development, quality of applications, reusability, innovation, and business alignment.
      • Design your web API as a product that promotes speed of development and service reuse.
      • Optimize the design, development, testing, and monitoring of your APIs incrementally and iteratively to cover all use cases in the long term.

      Impact and Result

      • Create a repeatable process to improve the quality, reusability, and governance of your web APIs.
      • Define the purpose of your API and the common uses cases that it will service.
      • Understand what development techniques are required to develop an effective web API based on Info-Tech’s web API framework.
      • Continuously reiterate your web API to demonstrate to business stakeholders the value your web API provides.

      Develop APIs That Work Properly for the Organization Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should develop APIs, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Examine the opportunities web APIs can enable

      Assess the opportunities of web APIs.

      • Develop APIs That Work Properly for the Organization – Phase 1: Examine the Opportunities Web APIs Can Enable

      2. Design and develop a web API

      Design and develop web APIs that support business processes and enable reusability.

      • Develop APIs That Work Properly for the Organization – Phase 2: Design and Develop a Web API
      • Web APIs High-Level Design Requirements Template
      • Web API Design Document Template

      3. Test the web API

      Accommodate web API testing best practices in application test plans.

      • Develop APIs That Work Properly for the Organization – Phase 3: Test the Web API
      • Web API Test Plan Template

      4. Monitor and continuously optimize the web API

      Monitor the usage and value of web APIs and plan for future optimizations and maintenance.

      • Develop APIs That Work Properly for the Organization – Phase 4: Monitor and Continuously Optimize the Web API
      • Web API Process Governance Template
      [infographic]

      Workshop: Develop APIs That Work Properly for the Organization

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Examine the Opportunities Web APIs Can Enable

      The Purpose

      Gauge the importance of web APIs for achieving your organizational needs.

      Understand how web APIs can be used to achieve below-the-line and above-the-line benefits.

      Be aware of web API development pitfalls. 

      Key Benefits Achieved

      Understanding the revenue generation and process optimization opportunities web APIs can bring to your organization.

      Knowledge of the current web API landscape. 

      Activities

      1.1 Examine the opportunities web APIs can enable.

      Outputs

      2 Design & Develop Your Web API

      The Purpose

      Establish a web API design and development process.

      Design scalable web APIs around defined business process flows and rules.

      Define the web service objects that the web APIs will expose. 

      Key Benefits Achieved

      Reusable web API designs.

      Identification of data sets that will be available through web services.

      Implement web API development best practices. 

      Activities

      2.1 Define high-level design details based on web API requirements.

      2.2 Define your process workflows and business rules.

      2.3 Map the relationships among data tables through ERDs.

      2.4 Define your data model by mapping the relationships among data tables through data flow diagrams.

      2.5 Define your web service objects by effectively referencing your data model.

      Outputs

      High-level web API design.

      Business process flow.

      Entity relationship diagrams.

      Data flow diagrams.

      Identification of web service objects.

      3 Test Your Web API

      The Purpose

      Incorporate APIs into your existing testing practices.

      Emphasize security testing with web APIs.

      Learn of the web API testing and monitoring tool landscape.

      Key Benefits Achieved

      Creation of a web API test plan.

      Activities

      3.1 Create a test plan for your web API.

      Outputs

      Web API Test Plan.

      4 Monitor and Continuously Optimize Your Web API

      The Purpose

      Plan for iterative development and maintenance of web APIs.

      Manage web APIs for versioning and reuse.

      Establish a governance structure to manage changes to web APIs. 

      Key Benefits Achieved

      Implement web API monitoring and maintenance best practices.

      Establishment of a process to manage future development and maintenance of web APIs. 

      Activities

      4.1 Identify roles for your API development projects.

      4.2 Develop governance for web API development.

      Outputs

      RACI table that accommodates API development.

      Web API operations governance structure.

      Govern Shared Services

      • Buy Link or Shortcode: {j2store}459|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Operations Management
      • Parent Category Link: /i-and-o-process-management
      • IT managers have come under increasing pressure to cut costs, and implementing shared services has become a popular demand from the business.
      • Business unit resistance to a shared services implementation can derail the project.
      • Shared services rearranges responsibilities within existing IT departments, potentially leaving no one accountable for project success and causing cost overruns and service performance failures.

      Our Advice

      Critical Insight

      • Over one-third of shared services implementations increase IT costs, due to implementation failures. Ineffective governance plays a major role in the breakdown of shared services, particularly when it does not overcome stakeholder resistance or define clear areas of responsibility.
      • Effective governance of a shared services implementation requires the IT leader to find the optimal combination of independence and centralization for the shared service provider.
      • Three primary models exist for governing shared services: entrepreneurial, mandated, and market-based. Each one occupies a different location in the trade-off of independence and centralization. The optimal model for a specific situation depends on the size of the organization, the number of participants, the existing trend towards centralization, and other factors.

      Impact and Result

      • Find the optimal governance model for your organization by weighing the different likely benefits and costs of each path.
      • Assign appropriate individual responsibilities to participants, so you can effectively scope your service offering and fund your implementation.
      • Support the governance effort effectively using published Info-Tech tools and templates.

      Govern Shared Services Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Understand each of the governance models and what each entails

      Build a plan for governing an implementation.

      • Storyboard: Govern Shared Services
      • None

      2. Choose the optimal approach to shared services governance

      Maximize the net benefit conferred by governance.

      • Shared Services Governance Strategy Roadmap Tool
      [infographic]

      Implement and Optimize Application Integration Governance

      • Buy Link or Shortcode: {j2store}361|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Enterprise Integration
      • Parent Category Link: /enterprise-integration
      • Enterprises begin integrating their applications without recognizing the need for a managed and documented governance model.
      • Application Integration (AI) is an inherently complex concept, involving the communication among multiple applications, groups, and even organizations; thus developing a governance model can be overwhelming.
      • The options for AI Governance are numerous and will vary depending on the size, type, and maturity of the organization, adding yet another layer of complexity.

      Our Advice

      Critical Insight

      • Governance is essential with integrated applications. If you are planning to integrate your applications, you should already be considering a governance model.
      • Proper governance requires oversight into chains of responsibility, policy, control mechanisms, measurement, and communication.
      • People and process are key. Technology options to aid in governance of integrated apps exist, but will not greatly contribute to the success of AI.

      Impact and Result

      • Assess your capabilities and determine which area of governance requires the most attention to achieve success in AI.
      • Form an Integration Center of Competency to oversee AI governance to ensure compliance and increase success.
      • Conduct ongoing training with your personnel to ensure up-to-date skills and end user understanding.
      • Frequently revisit your AI governance strategy to ensure alignment with business goals.

      Implement and Optimize Application Integration Governance Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Implement and optimize Application Integration Governance

      Know where to start and where to focus your attention in the implementation of an AI governance strategy.

      • Storyboard: Implement and Optimize Application Integration Governance

      2. Assess the organization's capabilities in AI Governance

      Assess your current and target states in AI Governance.

      • Application Integration Governance Gap Analysis Tool

      3. Create an Integration Center of Competency

      Have a governing body to oversee AI Governance.

      • Integration Center of Competency Charter Template

      4. Establish AI Governance principles and guidelines

      Create a basis for the organization’s AI governance model.

      • Application Integration Policy and Principles Template

      5. Create an AI service catalog

      Keep record of services and interfaces to reduce waste.

      • Integration Service Catalog Template
      [infographic]

      We may not be able to show you this

      We may not be able to show you this just yet.
      Our deeper, more detailed content is reserved for Tymans Group clients. 

      If you are interested in retaining our services or would really like access, please contact us. 

      Review and Improve Your IT Policy Library

      • Buy Link or Shortcode: {j2store}193|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $34,724 Average $ Saved
      • member rating average days saved: 14 Average Days Saved
      • Parent Category Name: IT Governance, Risk & Compliance
      • Parent Category Link: /it-governance-risk-and-compliance
      • Your policies are out of date, disorganized, and complicated. They don’t reflect current regulations and don’t actually mitigate your organization’s current IT risks.
      • Your policies are difficult to understand, aren’t easy to find, or aren’t well monitored and enforced for compliance. As a result, your employees don’t care about your policies.
      • Policy issues are taking up too much of your time and distracting you from the real issues you need to address.

      Our Advice

      Critical Insight

      A dynamic and streamlined policy approach will:

      1. Right-size policies to address the most critical IT risks.
      2. Clearly lay out a step-by-step process to complete daily tasks in compliance.
      3. Obtain policy adherence without having to be “the police.”

      To accomplish this, the policy writer must engage their audience early to gather input on IT policies, increase policy awareness, and gain buy-in early in the process.

      Impact and Result

      • Develop more effective IT policies. Clearly express your policy goals and objectives, standardize the approach to employee problem solving, and write policies your employees will actually read.
      • Improve risk coverage. Ensure full coverage on the risk landscape, including legal regulations, and establish a method for reporting, documenting, and communicating risks.
      • Improve employee compliance. Empathize with your employees and use policy to educate, train, and enable them instead of restricting them.

      Review and Improve Your IT Policy Library Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out how to write better policies that mitigate the risks you care about and get the business to follow them, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Assess

      Assess your risk landscape and design a plan to update your policy network based on your most critical risks.

      • Review and Improve Your IT Policy Library – Phase 1: Assess
      • Policy Management RACI Chart Template
      • Policy Management Tool
      • Policy Action Plan

      2. Draft and implement

      Use input from key stakeholders to write clear, consistent, and concise policies that people will actually read and understand. Then publish them and start generating policy awareness.

      • Review and Improve Your IT Policy Library – Phase 2: Draft and Implement
      • Policy Template
      • Policy Communication Plan Template

      3. Monitor, enforce, revise

      Use your policies to create a compliance culture in your organization, set KPIs, and track policy effectiveness.

      • Review and Improve Your IT Policy Library – Phase 3: Monitor, Enforce, Revise
      [infographic]

      Workshop: Review and Improve Your IT Policy Library

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish & Assess

      The Purpose

      Identify the pain points associated with IT policies.

      Establish the policy development process.

      Begin formulating a plan to re-design the policy network.

      Key Benefits Achieved

      Establish the policy process.

      Highlight key issues and pain points regarding policy.

      Assign roles and responsibilities.

      Activities

      1.1 Introduce workshop.

      1.2 Identify the current pain points with policy management.

      1.3 Establish high-level goals around policy management.

      1.4 Select metrics to measure achievement of goals.

      1.5 Create an IT policy working group (ITPWG).

      1.6 Define the scope and purpose of the ITPWG.

      Outputs

      List of issues and pain points for policy management

      Set of six to ten goals for policy management

      Baseline and target measured value

      Amended steering committee or ITPWG charter

      Completed RACI chart

      Documented policy development process

      2 Assess Your Risk Landscape & Map Policies to Risks; Create a Policy Action Plan

      The Purpose

      Identify key risks.

      Develop an understanding of which risks are most critical.

      Design a policy network that best mitigates those risks.

      Key Benefits Achieved

      Use a risk-driven approach to decide which policies need to be written or updated first.

      Activities

      2.1 Identify risks at a high level.

      2.2 Assess each identified risk scenario on impact and likelihood.

      2.3 Map current and required policies to risks.

      2.4 Assess policy effectiveness.

      2.5 Create a policy action plan.

      2.6 Select policies to be developed during workshop.

      Outputs

      Ranked list of IT’s risk scenarios

      Prioritized list of IT risks (simplified risk register)

      Policy action plan

      3 Develop Policies

      The Purpose

      Outline what key features make a policy effective and write policies that mitigate the most critical IT risks.

      Key Benefits Achieved

      Write policies that work and get them approved.

      Activities

      3.1 Define the policy audience, constraints, and in-scope and out-of-scope requirements for a policy.

      3.2 Draft two to four policies

      Outputs

      Drafted policies

      4 Create a Policy Communication and Implementation Plan and Monitor & Reassess the Portfolio

      The Purpose

      Build an understanding of how well the organization’s value creation activities are being supported.

      Key Benefits Achieved

      Identify an area or capability that requires improvement.

      Activities

      4.1 Review draft policies and update if necessary.

      4.2 Create a policy communication plan.

      4.3 Select KPIs.

      4.4 Review root-cause analysis techniques.

      Outputs

      Final draft policies

      Policy communications plan

      KPI tracking log

      Build a Data Architecture Roadmap

      • Buy Link or Shortcode: {j2store}124|cart{/j2store}
      • member rating overall impact: 8.8/10 Overall Impact
      • member rating average dollars saved: $8,846 Average $ Saved
      • member rating average days saved: 23 Average Days Saved
      • Parent Category Name: Data Management
      • Parent Category Link: /data-management
      • Data architecture involves many moving pieces requiring coordination to provide greatest value from data.
      • Data architects are at the center of this turmoil and must be able to translate high-level business requirements into specific instructions for data workers using complex data models.
      • Data architects must account for the constantly growing data and application complexity, more demanding needs from the business, an ever-increasing number of data sources, and a growing need to integrate components to ensure that performance isn’t compromised.

      Our Advice

      Critical Insight

      • Data architecture needs to evolve with the changing business landscape. There are four common business drivers that put most pressure on archaic architectures. As a result, the organization’s architecture must be flexible and responsive to changing business needs.
      • Data architecture is not just about models. Viewing data architecture as just technical data modeling can lead to structurally unsound data that does not serve the business.
      • Data is used differently across the layers of an organization’s data architecture, and the capabilities needed to optimize use of data change with it. Architecting and managing data from source to warehousing to presentation requires different tactics for optimal use.

      Impact and Result

      • Have a framework in place to identify the appropriate solution for the challenge at hand. Our three-phase practical approach will help you build a custom and modernized data architecture.
        • Identify and prioritize the business drivers in which data architecture changes would create the largest overall benefit, and determine the corresponding data architecture tiers that need to be addressed.
        • Discover the best-practice trends, measure your current state, and define the targets for your data architecture tactics.
        • Build a cohesive and personalized roadmap for restructuring your data architecture. Manage your decisions and resulting changes.

      Build a Data Architecture Roadmap Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why your organization should optimize its data architecture as it evolves with the drivers of the business to get the most from its data.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Prioritize your data architecture with business-driven tactics

      Identify the business drivers that necessitate data architecture improvements, then create a tactical plan for optimization.

      • Build a Business-Aligned Data Architecture Optimization Strategy – Phase 1: Prioritize Your Data Architecture With Business-Driven Tactics
      • Data Architecture Driver Pattern Identification Tool
      • Data Architecture Optimization Template

      2. Personalize your tactics to optimize your data architecture

      Analyze how you stack up to Info-Tech’s data architecture capability model to uncover your tactical plan, and discover groundbreaking data architecture trends and how you can fit them into your action plan.

      • Build a Business-Aligned Data Architecture Optimization Strategy – Phase 2: Personalize Your Tactics to Optimize Your Data Architecture
      • Data Architecture Tactical Roadmap Tool
      • Data Architecture Trends Presentation

      3. Create your tactical data architecture roadmap

      Optimize your data architecture by following tactical initiatives and managing the resulting change brought on by those optimization activities.

      • Build a Business-Aligned Data Architecture Optimization Strategy – Phase 3: Create Your Tactical Data Architecture Roadmap
      • Data Architecture Decision Template
      [infographic]

      Workshop: Build a Data Architecture Roadmap

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify the Drivers of the Business for Optimizing Data Architecture

      The Purpose

      Explain approach and value proposition.

      Review the common business drivers and how the organization is driving a need to optimize data architecture.

      Understand Info-Tech’s five-tier data architecture model.

      Determine the pattern of tactics that apply to the organization for optimization.

      Key Benefits Achieved

      Understanding of the current data architecture landscape.

      Priorities for tactical initiatives in the data architecture practice are identified.

      Target state for the data quality practice is defined.

      Activities

      1.1 Explain approach and value proposition.

      1.2 Review the common business drivers and how the organization is driving a need to optimize data architecture.

      1.3 Understand Info-Tech’s five-tier data architecture model.

      1.4 Determine the pattern of tactics that apply to the organization for optimization.

      Outputs

      Five-tier logical data architecture model

      Data architecture tactic plan

      2 Determine Your Tactics For Optimizing Data Architecture

      The Purpose

      Define improvement initiatives.

      Define a data architecture improvement strategy and roadmap.

      Key Benefits Achieved

      Gaps, inefficiencies, and opportunities in the data architecture practice are identified.

      Activities

      2.1 Create business unit prioritization roadmap.

      2.2 Develop subject area project scope.

      2.3 Subject area 1: data lineage analysis, root cause analysis, impact assessment, business analysis

      Outputs

      Business unit prioritization roadmap

      Subject area scope

      Data lineage diagram

      3 Create a Strategy for Data Quality Project 2

      The Purpose

      Define improvement initiatives.

      Define a data quality improvement strategy and roadmap.

      Key Benefits Achieved

      Improvement initiatives are defined.

      Improvement initiatives are evaluated and prioritized to develop an improvement strategy.

      A roadmap is defined to depict when and how to tackle the improvement initiatives.

      Activities

      3.1 Create business unit prioritization roadmap.

      3.2 Develop subject area project scope.

      3.3 Subject area 1: data lineage analysis, root cause analysis, impact assessment, business analysis.

      Outputs

      Business unit prioritization roadmap

      Subject area scope

      Data lineage diagram

      Further reading

      Build a Data Architecture Roadmap

      Optimizing data architecture requires a plan, not just a data model.

      ANALYST PERSPECTIVE

      Integral to an insight-driven enterprise is a modern and business-driven data environment.

      “As business and data landscapes change, an organization’s data architecture needs to be able to keep pace with these changes. It needs to be responsive so as to not only ensure the organization continues to operate efficiently but that it supports the overall strategic direction of the organization.

      In the dynamic marketplace of today, organizations are constantly juggling disruptive forces and are finding the need to be more proactive rather than reactive. As such, organizations are finding their data to be a source of competitive advantage where the data architecture has to be able to not only support the increasing amount, sources, and rate at which organizations are capturing and collecting data but also be able to meet and deliver on changing business needs.

      Data architecture optimization should, therefore, aid in breaking down data silos and creating a more shared and all-encompassing data environment for better empowering the business.” (Crystal Singh, Director, Research, Data and Information Practice, Info-Tech Research Group)

      Our understanding of the problem

      This Research Is Designed For:
      • Data architects or their equivalent, looking to optimize and improve the efficiency of the capture, movement and storage of data for a variety of business drivers.
      • Enterprise architects looking to improve the backbone of the holistic approach of their organization’s structure.
      This Research Will Help You:
      • Identify the business drivers that are impacted and improved by best-practice data architecture.
      • Optimize your data architecture using tactical practices to address the pressing issues of the business to drive modernization.
      • Align the organization’s data architecture with the grander enterprise architecture.
      This Research Will Also Assist:
      • CIOs concerned with costs, benefits, and the overall structure of their organizations data flow.
      • Database administrators tasked with overseeing crucial elements of the data architecture.
      This Research Will Help Them:
      • Get a handle on the current situation of data within the organization.
      • Understand how data architecture affects the operations of the data sources within the enterprise.

      Executive summary

      Situation

      • The data architecture of a modern organization involves many moving pieces requiring coordination to provide greatest value from data.
      • Data architects are at the center of this turmoil and must be able to translate high-level business requirements into specific instructions for data workers using complex data models.

      Complication

      • Data architects must account for the constantly growing data and application complexity, and more demanding needs from the business.
      • There is an ever-increasing number of data sources and a growing need to integrate components to ensure that performance isn’t compromised.
      • There isn’t always a clearly defined data architect role, yet the responsibilities must be filled to get maximum value from data.

      Resolution

      • To deal with these challenges, a data architect must have a framework in place to identify the appropriate solution for the challenge at hand.
        • Identify and prioritize the business drivers in which data architecture changes would create the largest overall benefit, and determine the corresponding data architecture tiers that need to be addressed to customize your solution.
        • Discover the best practice trends, measure your current state, and define the targets for your data architecture tactics.
        • Build a cohesive and personalized roadmap for restructuring your data architecture. Manage your decisions and resulting changes.

      Info-Tech Insight

      1. Data architecture is not just about models. Viewing data architecture as just technical data modeling can lead to a data environment that does not aptly serve or support the business. Identify the priorities of your business and adapt your data architecture to those needs.
      2. Changes to data architecture are typically driven by four common business driver patterns. Use these as a shortcut to understand how to evolve your data architecture.
      3. Data is used differently across the layers of an organization’s data architecture; therefore, the capabilities needed to optimize the use of data change with it. Architecting and managing data from source to warehousing to presentation requires different tactics for optimal use.

      Your data is the foundation of your organization’s knowledge and ability to make decisions

      Data should be at the foundation of your organization’s evolution.

      The transformational insights that executives are constantly seeking to leverage can be uncovered with a data practice that makes high quality, trustworthy information readily available to the business users who need it.

      50% Organizations that embrace data are 50% more likely to launch products and services ahead of their competitors. (Nesta, 2016)

      Whether hoping to gain a better understanding of your business or trying to become an innovator in your industry, any organization can get value from its data regardless of where you are in your journey to becoming a data-driven enterprise:

      Business Monitoring
      • Data reporting
      • Uncover inefficiencies
      • Monitor progress
      • Track inventory levels
      Business Insights
      • Data analytics
      • Expose patterns
      • Predict future trends
      Business Optimization
      • Data-based apps
      • Build apps to automate actions based on insights
      Business Transformation
      • Monetary value of data
      • Create new revenue streams
      (Journey to Data Driven Enterprise, 2015)

      As organizations seek to become more data driven, it is imperative to better manage data for its effective use

      Here comes the zettabyte era.

      A zettabyte is a billion terabytes. Organizations today need to measure their data size in zettabytes, a challenge that is only compounded by the speed at which the data is expected to move.

      Arriving at the understanding that data can be the driving force of your organization is just the first step. The reality is that the true hurdles to overcome are in facing the challenges of today’s data landscape.

      Challenges of The Modern Data Landscape
      Data at rest Data movement
      Greater amounts Different types Uncertain quality Faster rates Higher complexity

      “The data environment is very chaotic nowadays. Legacy applications, data sprawl – organizations are grappling with what their data landscape looks like. Where are our data assets that we need to use?” (Andrew Johnston, Independent Consultant)

      Solution

      Well-defined and structured data management practices are the best way to mitigate the limitations that derive from these challenges and leverage the most possible value from your data.

      Refer to Info-Tech’s capstone Create a Plan For Establishing a Business-Aligned Data Management Practice blueprint to understand data quality in the context of data disciplines and methods for improving your data management capabilities.

      Data architecture is an integral aspect of data management

      Data Architecture

      The set of rules, policies, standards, and models that govern and define the type of data collected and how it is used, stored, managed, and integrated within the organization and its database systems.

      In general, the primary objective of data architecture is the standardization of data for the benefit of the organization.

      54% of leading “analytics-driven” enterprises site data architecture as a required skill for data analytics initiatives. (Maynard 2015)

      MYTH

      Data architecture is purely a model of the technical requirements of your data systems.

      REALITY

      Data architecture is largely dependent on a human element. It can be viewed as “the bridge between defining strategy and its implementation”. (Erwin 2016)

      Functions

      A strong data architecture should:

      • Define, visualize, and communicate data strategy to various stakeholders.
      • Craft a data delivery environment.
      • Ensure high data quality.
      • Provide a roadmap for continuous improvement.

      Business value

      A strong data architecture will help you:

      • Align data processes with business strategy and the overall holistic enterprise architecture.
      • Enable efficient flow of data with a stronger focus on quality and accessibility.
      • Reduce the total cost of data ownership.

      Data architects must maintain a comprehensive view of the organization’s rapidly proliferating data

      The data architect:
      • Acts as a “translator” between the business and data workers to communicate data and technology requirements.
      • Facilitates the creation of the data strategy.
      • Manages the enterprise data model.
      • Has a greater knowledge of operational and analytical data use cases.
      • Recommends data management policies and standards, and maintains data management artifacts.
      • Reviews project solution architectures and identifies cross impacts across the data lifecycle.
      • Is a hands-on expert in data management and warehousing technologies.
      • Is not necessarily it’s own designated position, but a role that can be completed by a variety of IT professionals.

      Data architects bridge the gap between strategic and technical requirements:

      Visualization centering the 'Data Architect' as the bridge between 'Data Workers', 'Business', and 'Data & Applications'.

      “Fundamentally, the role of a data architect is to understand the data in an organization at a reasonable level of abstraction.” (Andrew Johnston, Independent Consultant)

      Many are experiencing the pains of poor data architecture, but leading organizations are proactively tackling these issues

      Outdated and archaic systems and processes limit the ability to access data in a timely and efficient manner, ultimately diminishing the value your data should bring.

      59%

      of firms believe their legacy storage systems require too much processing to meet today’s business needs. (Attivio, Survey Big Data decision Makers, 2016)

      48%

      of companies experience pains from being reliant on “manual methods and trial and error when preparing data.” (Attivio, Survey Big Data decision Makers, 2016)

      44%
      +
      22%

      44% of firms said preparing data was their top hurdle for analytics, with 22% citing problems in accessing data. (Data Virtualization blog, Data Movement Killed the BI Star, 2016)

      Intuitive organizations who have recognized these shortcomings have already begun the transition to modernized and optimized systems and processes.

      28%

      of survey respondents say they plan to replace “data management and architecture because it cannot handle the requirements of big data.” (Informatica, Digital Transformation: Is Your Data Management Ready, 2016)

      50%

      Of enterprises plan to replace their data warehouse systems and analytical tools in the next few years. (TDWI, End of the Data Warehouse as we know it, 2017)

      Leading organizations are attacking data architecture problems … you will be left behind if you do not start now!

      Once on your path to redesigning your data architecture, neglecting the strategic elements may leave you ineffective

      Focusing on only data models without the required data architecture guidance can cause harmful symptoms in your IT department, which will lead to organization-wide problems.

      IT Symptoms Due to Ineffective Data Architecture

      Poor Data Quality

      • Inconsistent, duplicate, missing, incomplete, incorrect, unstandardized, out of date, and mistake-riddled data can plague your systems.

      Poor Accessibility

      • Delays in accessing data.
      • Limits on who can access data.
      • Limited access to data remotely.

      Strategic Disconnect

      • Disconnect between owner and consumer of data.
      • Solutions address narrow scope problems.
      • System barriers between departments.
      Leads to Poor Organizational Conditions

      Inaccurate Insights

      • Inconsistent and/or erroneous operational and management reports.
      • Ineffective cross-departmental use of analytics.

      Ineffective Decision Making

      • Slow flow of information to executive decision makers.
      • Inconsistent interpretation of data or reports.

      Inefficient Operations

      • Limits to automated functionality.
      • Increased divisions within organization.
      • Regulatory compliance violations.
      You need a solution that will prevent the pains.

      Follow Info-Tech’s methodology to optimize data architecture to meet the business needs

      The following is a summary of Info-Tech’s methodology:

      1

      1. Prioritize your core business objectives and identify your business driver.
      2. Learn how business drivers apply to specific tiers of Info-Tech’s five-tier data architecture model.
      3. Determine the appropriate tactical pattern that addresses your most important requirements.
      Visualization of the process described on the left: Business drivers applying to Info-Tech's five-tier data architecture, then determining tactical patterns, and eventually setting targets of your desired optimized state.

      2

      1. Select the areas of the five-tier architecture to focus on.
      2. Measure current state.
      3. Set the targets of your desired optimized state.

      3

      1. Roadmap your tactics.
      2. Manage and communicate change.
      A roadmap leading to communication.

      Info-Tech will get you to your optimized state faster by focusing on the important business issues

      First Things First

      1. Info-Tech’s methodology helps you to prioritize and establish the core strategic objectives behind your goal of modernizing data architecture. This will narrow your focus to the appropriate areas of your current data systems and processes that require the most attention.

      Info-Tech has identified these four common drivers that lead to the need to optimize your data architecture.

      • Becoming More Data Driven
      • Regulations and Compliance
      • Mergers and Acquisitions
      • New Functionality or Business Rule

      These different core objectives underline the motivation to optimize data architecture, and will determine your overall approach.

      Use the five-tier architecture to provide a consumable view of your data architecture

      Every organization’s data system requires a unique design and an assortment of applications and storage units to fit their business needs. Therefore, it is difficult to paint a picture of an ideal model that has universal applications. However, when data architecture is broken down in terms of layers or tiers, there exists a general structure that is seen in all data systems.

      Info-Tech's Five Tier Data Architecture. The five tiers being 'Sources' which includes 'Apps', 'Excel and other documents', and 'Access database(s)'; 'Integration and Translation' the 'Movement and transformation of data'; 'Warehousing' which includes 'Data Lakes & Warehouse(s) (Raw Data)'; 'Analytics' which includes 'Data Marts', 'Data Cube', 'Flat Files', and 'BI Tools'; and 'Presentation' which includes 'Reports' and 'Dashboards'.

      Thinking of your data systems and processes in this framework will allow you to see how different elements of the architecture relate to specific business operations.

      1. This blueprint will demonstrate how the business driver behind your redesign requires you to address specific layers of the five-tier data architecture.
      1. Once you’ve aligned your business driver to the appropriate data tiers, this blueprint will provide you with the best practice tactics you should apply to achieve an optimized data architecture.

      Use the five-tier architecture to prioritize tactics to improve your data architecture in line with your pattern

      Info-Tech’s Data Architecture Capability Model
      Info-Tech’s Data Architecture Capability Model featuring the five-tier architecture listing 'Core Capabilities' and 'Advanced Capabilities' within each tier, and a list of 'Cross Capabilities' which apply to all tiers.
      1. Based on your business driver, the relevant data tiers, and your organization’s own specific requirements you will need to establish the appropriate data architecture capabilities.
      2. This blueprint will help you measure how you are currently performing in these capabilities…
      3. And help you define and set targets so you can reach your optimized state.
      1. Once completed, these steps will be provided with the information you will need to create a comprehensive roadmap.
      2. Lastly, this blueprint will provide you with the tools to communicate this plan across your organization and offer change management guidelines to ensure successful adoption.
      Info-Tech Insight

      Optimizing data architecture requires a tactical approach, not a passive approach.

      The demanding task of optimization requires the ability to heavily prioritize. After you have identified why, determine how using our pre-built roadmap to address the four common drivers.

      Do not forget: data architecture is not a standalone concept; it fits into the more holistic design of enterprise architecture

      Data Architecture in Alignment

      Data architecture can not be designed to simply address the focus of data specialists or even the IT department.

      It must act as a key component in the all encompassing enterprise architecture and reflect the strategy and design of the entire business.

      Data architecture collaborates with application architecture in the delivery of effective information systems, and informs technology architecture on data related infrastructure requirements/considerations

      Please refer to the following blueprints to see the full picture of enterprise architecture:

      A diagram titled 'Enterprise Architecture' with multiple forms of architecture interacting with each other. At the top is 'Business Architecture' which feeds into 'Data Architecture' and 'Application Architecture' which feed into each other, and influence 'Infrastructure Architecture' and 'Security Architecture'.
      Adapted from TOGAF
      Refer to Phase C of TOGAF and Bizbok for references to the components of business architecture that are used in data architecture.

      Info-Tech’s data architecture optimization methodology helped a monetary authority fulfill strict regulatory pressures

      CASE STUDY

      Industry: Financial
      Source: Info-Tech Consulting
      Symbol for 'Monetary Authority Case Study'. Look for this symbol as you walk through the blueprint for details on how Info-Tech Consulting assisted this monetary authority.

      Situation: Strong external pressures required the monetary authority to update and optimize its data architecture.

      The monetary authority is responsible for oversight of the financial situation of a country that takes in revenue from foreign incorporation. Due to increased pressure from international regulatory bodies, the monetary authority became responsible for generating multiple different types of beneficial ownership reports based on corporation ownership data within 24 hours of a request.

      A stale and inefficient data architecture prevented the monetary authority from fulfilling external pressures.

      Normally, the process to generate and provide beneficial ownership reports took a week or more. This was due to multiple points of stale data architecture, including a dependence on outdated legacy systems and a broken process for gathering the required data from a mix of paper and electronic sources.

      Provide a structured approach to solving the problem

      Info-Tech helped the monetary authority identify the business need that resulted from regulatory pressures, the challenges that needed to be overcome, and actionable tactics for addressing the needs.

      Info-Tech’s methodology was followed to optimize the areas of data architecture that address the business driver.

      • External Requirements
      • Business Driver
          Diagnose Data Architecture Problems
        • Outdated architecture (paper, legacy systems)
        • Stale data from other agencies
        • Incomplete data
            Data Architecture Optimization Tactics
          1. Optimized Source Databases
          2. Improved Integration
          3. Data Warehouse Optimization
          4. Data Marts for Reports
          5. Report Delivery Efficiency

      As you walk through this blueprint, watch for additional case studies that walk through the details of how Info-Tech helped this monetary authority.

      This blueprint’s three-step process will help you optimize data architecture in your organization

      Phase 1
      Prioritize Your Data Architecture With Business-Driven Tactics
      Phase 2
      Personalize Your Tactics to Optimize Your Data Architecture
      Phase 3
      Create Your Tactical Data Architecture Roadmap
      Step 1: Identify Your Business Driver for Optimizing Data Architecture
      • Learn about what data architecture is and how it must evolve with the drivers of the business.
      • Determine the business driver that your organization is currently experiencing.
      • Data Architecture Driver Pattern Identification Tool

      Step 2: Determine Actionable Tactics to Optimize Data Architecture
      • Create your data architecture optimization plan to determine the high-level tactics you need to follow.
      • Data Architecture Optimization Template

      Step 1: Measure Your Data Architecture Capabilities
      • Determine where you currently stand in the data architecture capabilities across the five-tier data architecture.
      • Data Architecture Tactical Roadmap Tool

      Step 2: Set a Target for Data Architecture Capabilities
      • Identify your targets for the data architecture capabilities.
      • Data Architecture Tactical Roadmap Tool

      Step 3: Identify the Tactics that Apply to Your Organization
      • Understand the trends in the field of data architecture and how they can help to optimize your environment.
      • Data Architecture Trends Presentation

      Step 1: Personalize Your Data Architecture Roadmap
      • Personalize the tactics across the tiers that apply to you to build your personalized roadmap.
      • Data Architecture Tactical Roadmap Tool

      Step 2: Manage Your Data Architecture Decisions and the Resulting Changes
      • Document the changes in the organization’s data architecture.
      • Data architecture involves change management – learn how data architects should support change management in the organization.
      • Data Architecture Decision Template

      Use these icons to help direct you as you navigate this research

      Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.

      A small monochrome icon of a wrench and screwdriver creating an X.

      This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project.

      A small monochrome icon depicting a person in front of a blank slide.

      This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Build a Business-Aligned Data Architecture Optimization Strategy – project overview

      PHASE 1
      Prioritize Your Data Architecture With Business-Driven Tactics
      PHASE 2
      Personalize Your Tactics to Optimize Your Data Architecture
      PHASE 3
      Create Your Tactical Data Architecture Roadmap
      Supporting Tool icon

      Best-Practice Toolkit

      1.1 Identify Your Business Driver for Optimizing Data Architecture

      1.2 Determine Actionable Tactics to Optimize Data Architecture

      2.1 Measure Your Data Architecture Capabilities

      2.2 Set a Target for Data Architecture Capabilities

      2.3 Identify the Tactics that Apply to Your Organization

      3.1 Personalize Your Data Architecture Roadmap

      3.2 Manage Your Data Architecture Decisions and the Resulting Changes

      Guided Implementations

      • Understand what data architecture is, how it aligns with enterprise architecture, and how data architects support the needs of the business.
      • Identify the business drivers that necessitate the optimization of the organization’s data architecture.
      • Create a tactical plan to optimize data architecture across Info-Tech’s five-tier logical data architecture model.
      • Understand Info-Tech’s tactical data architecture capability model and measure the current state of these capabilities at the organization.
      • Determine the target state of data architecture capabilities.
      • Understand the trends in the field of data architecture and identify how they can fit into your environment.
      • Use the results of the data architecture capability gap assessment to determine the priority of activities to populate your personalized data architecture optimization roadmap.
      • Understand how to manage change as a data architect or equivalent.
      Associated Activity icon

      Onsite Workshop

      Module 1:
      Identify the Drivers of the Business for Optimizing Data Architecture
      Module 2:
      Create a Tactical Plan for Optimizing Data Architecture
      Module 3:
      Create a Personalized Roadmap for Data Architecture Activities

      Workshop overview

      Contact your account representative or email Workshops@InfoTech.com for more information.

      Preparation

      Workshop Day 1

      Workshop Day 2

      Workshop Day 3

      Workshop Day 4

      Workshop Day 5

      Organize and Plan Workshop Identify the Drivers of the Business for Optimizing Data Architecture Determine the Tactics For Optimizing Data Architecture Create Your Roadmap of Optimization Activities Create Your Personalized Roadmap Create a Plan for Change Management

      Morning Activities

      • Finalize workshop itinerary and scope.
      • Identify workshop participants.
      • Gather strategic documentation.
      • Engage necessary stakeholders.
      • Book interviews.
      • 1.1 Explain approach and value proposition.
      • 1.2 Review the common business drivers and how the organization is driving a need to optimize data architecture.
      • 2.1 Create your data architecture optimization plan.
      • 2.2 Interview key business stakeholders for input on business drivers for data architecture.
      • 3.1 Align with the enterprise architecture by interviewing the enterprise architect for input on the data architecture optimization roadmap.
      • 4.1 As a group, determine the roadmap activities that are applicable to your organization and brainstorm applicable initiatives.
      • 5.1 Use the Data Architecture Decision Documentation Template to document key decisions and updates.

      Afternoon Activities

      • 1.3 Understand Info-Tech’s Five-Tier Data Architecture.
      • 1.4 Determine the pattern of tactics that apply to the organization for optimization.
      • 2.3 With input from the business and enterprise architect, determine the current data architecture capabilities.
      • 3.3 With input from the business and enterprise architect, determine the target data architecture capabilities.
      • 4.2 Determine the timing and effort of the roadmap activities.
      • 5.2 Review best practices for change management.
      • 5.3 Present roadmap and findings to the business stakeholders and enterprise architect.

      Deliverables

      • Workshop Itinerary
      • Workshop Participant List
      1. Five-Tier Logical Data Architecture Model
      2. Data Architecture Tactic Plan
      1. Five-Tier Data Architecture Capability Model
      1. Data Architecture Tactical Roadmap
      1. Data Architecture Tactical Roadmap
      1. Data Architecture Decision Template

      Build a Business-Aligned Data Architecture Optimization Strategy

      PHASE 1

      Prioritize Your Data Architecture With Business-Driven Tactics

      Phase 1 outline

      Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 1: Prioritize Your Data Architecture With Business-Driven Tactics

      Proposed Time to Completion: 2 weeks
      Step 1.1: Identify Your Business Driver for Optimizing Data Architecture Step 1.2: Determine Actionable Tactics to Optimize Data Architecture
      Start with an analyst kick-off call:
      • Understand what data architecture is, what it is not, and how it fits into the broader enterprise architecture program.
      • Determine the drivers that fuel the need for data architecture optimization.
      Review findings with analyst:
      • Understand the Five-Tier Data Architecture Model and how the drivers of the business inform your priorities across this logical model of data architecture.
      Then complete these activities…
      • Complete the Data Architecture Driver Pattern Identification Tool.
      Then complete these activities…
      • Create a tactical data architecture optimization plan based on the business driver input.
      With these tools & templates:
      • Data Architecture Driver Pattern Identification Tool
      With these tools & templates:
      • Data Architecture Optimization Template

      Phase 1 Results & Insights

      • Data Architecture is not just about data models. The approach that Phase 1 guides you through will help to not only plan where you need to focus your efforts as a data architect (or equivalent) but also give you guidance in how you should go about optimizing the holistic data architecture environment based on the drivers of the business.

      Phase 1 will help you create a strategy to optimize your data architecture using actionable tactics

      In this phase, you will determine your focus for optimizing your data architecture based on the business drivers that are commonly felt by most organizations.

      1. Identify the business drivers that necessitate data architecture optimization efforts.
      2. Understand Info-Tech’s Five-Tier Data Architecture, a logical architecture model that will help you prioritize tactics for optimizing your data architecture environment.
      3. Identify tactics for optimizing the organization’s data architecture across the five tiers.

      “To stay competitive, we need to become more data-driven. Compliance pressures are becoming more demanding. We need to add a new functionality.”

      Info-Tech’s Five-Tier Data Architecture:

      1. Data Sources
      2. Data Integration and Translation
      3. Data Warehousing
      4. Data Analytics
      5. Data Presentation

      Tactical plan for Data Architecture Optimization

      Phase 1, Step 1: Identify Your Business Driver for Optimizing Data Architecture

      PHASE 1

      1.1 1.2
      Identify Your Business Driver for Optimizing Data Architecture Determine Actionable Tactics to Optimize Data Architecture

      This step will walk you through the following activities:

      • Understand how data architecture fits into the organization’s larger enterprise architecture.
      • Understand what data architecture is and how it should be driven by the business.
      • Identify the driver that is creating a need for data architecture optimization.

      This step involves the following participants:

      • Data Architect
      • Enterprise Architect

      Outcomes of this step

      • A starting point for the many responsibilities of the data architect role. Balancing business and technical requirements can be challenging, and to do so you need to first understand what is driving the need for data architecture improvements.
      • Holistic understanding of the organization’s architecture environment, including enterprise, application, data, and technology architectures and how they interact.

      Data architecture involves planning, communication, and understanding of technology

      Data Architecture

      A description of the structure and interaction of the enterprise’s major types and sources of data, logical data assets, physical data assets, and data management resources (TOGAF 9).

      The subject area of data management that defines the data needs of the enterprise and designs the master blueprints to meet those needs (DAMA DMBOK, 2009).

      IBM (2007) defines data architecture as the design of systems and applications that facilitate data availability and distribution across the enterprise.

      Definitions vary slightly across major architecture and management frameworks.

      However, there is a general consensus that data architecture provides organizations with:

      • Alignment
      • Planning
      • Road mapping
      • Change management
      • A guide for the organization’s data management program

      Data architecture must be based on business goals and objectives; developed within the technical strategies, constraints, and opportunities of the organization in support of providing a foundation for data management.

      Current Data Management
      • Alignment
      • Planning
      • Road mapping
      Goal for Data Management

      Info-Tech Insight

      Data Architecture is not just data models. Data architects must understand the needs of the business, as well as the existing people and processes that already exist in the organization to effectively perform their job.

      Review how data architecture fits into the broader architectural context

      A flow diagram starting with 'Business Processes/Activities' to 'Business Architecture' which through a process of 'Integration' flows to 'Data Architecture' and 'Application Architecture', the latter of which also flows into to the former, and they both flow into 'Technology Architecture' which includes 'Infrastructure' and 'Security'.

      Each layer of architecture informs the next. In other words, each layer has components that execute processes and offer services to the next layer. For example, data architecture can be broken down into more granular activities and processes that inform how the organization’s technology architecture should be arranged.

      Data does not exist on its own. It is informed by business architecture and used by other architectural domains to deliver systems, IT services, and to support business processes. As you build your practice, you must consider how data fits within the broader architectural framework.

      The Zachman Framework is a widely used EA framework; within it, data is identified as the first domain.

      The framework aims to standardize artifacts (work-products) within each architectural domain, provides a cohesive view of the scope of EA and clearly delineates data components. Use the framework to ensure that your target DA practice is aligned to other domains within the EA framework.

      'The Zachman Framework for Enterprise Architecture: The Enterprise Ontology', a complicated framework with top and bottom column headers and left and right row headers. Along the top are 'Classification Names': 'What', 'How', 'Where', 'Who', 'When', and 'Why'. Along the bottom are 'Enterprise Names': 'Inventory Sets', 'Process Flows', 'Distribution Networks', 'Responsibility Assignments', 'Timing Cycles', and 'Motivation Intentions'. Along the left are 'Audience Perspectives': 'Executive Perspective', 'Business Mgmt. Perspective', 'Architect Perspective', 'Engineer Perspective', 'Technician Perspective', and 'Enterprise Perspective'. Along the right are 'Model Names': 'Scope Contexts', 'Business Concepts', 'System Logic', 'Technology Physics', 'Tool Components', and 'Operations Instances'.
      (Source: Zachman International)

      Data architects operate in alignment with the other various architecture groups

      Data architects operate in alignment with the other various architecture groups, with coordination from the enterprise architect.

      Enterprise Architect
      The enterprise architect provides thought leadership and direction to domain architects.

      They also maintain architectural standards across all the architectural domains and serve as a lead project solution architect on the most critical assignments.

      • Business Architect
        A business subject matter expert who works with the line-of-business team to assist in business planning through capability-based planning.
      • Security Architect
        Plays a pivotal role in formulating the security strategy of the organization, working with the business and CISO/security manager. Recommends and maintains security standards, policies, and best practices.
      • Infrastructure Architect
        Recommends and maintains standards across the compute, storage, and network layers of the organization. Reviews project solution architectures to ensure compliance with infrastructure standards, regulations, and target state blueprints.
      • Application Architect
        Manages the business effectiveness, satisfaction, and maintainability of the application portfolio. Conduct application architecture assessments to document expected quality attribute standards, identify hotspots, and recommend best practices.
      • Data Architect
        Facilitates the creation of data strategy and has a greater understanding of operational and analytical data use cases. Manages the enterprise data model which includes all the three layers of modelling - conceptual, logical, and physical. Recommends data management policies and standards, and maintains data management artefacts. Reviews project solution architectures and identifies cross impacts across the data lifecycle.

      As a data architect, you must maintain balance between the technical and the business requirements

      The data architect role is integral to connecting the long-term goals of the business with how the organization plans to manage its data for optimal use.

      Data architects need to have a deep experience in data management, data warehousing, and analytics technologies. At a high level, the data architect plans and implements an organization’s data, reporting, and analytics roadmap.

      Some of the role’s primary duties and responsibilities include:

      1. Data modeling
      2. Reviewing existing data architecture
      3. Benchmark and improve database performance
      4. Fine tune database and SQL queries
      5. Lead on ETL activities
      6. Validate data integrity across all platforms
      7. Manage underlying framework for data presentation layer
      8. Ensure compliance with proper reporting to bureaus and partners
      9. Advise management on data solutions

      Data architects bridge the gap between strategic and technical requirements:

      Visualization centering the 'Data Architect' as the bridge between 'Data Workers', 'Business', and 'Data & Applications'.

      “Fundamentally, the role of a data architect is to understand the data in an organization at a reasonable level of abstraction.” (Andrew Johnston, Independent Consultant)

      Info-Tech Insight

      The data architect role is not always clear cut. Many organizations do not have a dedicated data architect resource, and may not need one. However, the duties and responsibilities of the data architect must be carried out to some degree by a combination of resources as appropriate to the organization’s size and environment.

      Understand the role of a data architect to ensure that essential responsibilities are covered in the organization

      A database administrator (DBA) is not a data architect, and data architecture is not something you buy from an enterprise application vendor.

      Data Architect Role Description

      • The data architect must develop (along with the business) a short-term and long-term vision for the enterprise’s data architecture.
      • They must be able to create processes for governing the identification, collection, and use of accurate and valid metadata, as well as for tracking data quality, completeness, and redundancy.
      • They need to create strategies for data security, backup, disaster recovery, business continuity, and archiving, and ensure regulatory compliance.

      Skills Necessary

      • Hands-on experience with data architecting and management, data mining, and large-scale data modeling.
      • Strong understanding of relational and non-relational data structures, theories, principles, and practices.
      • Strong familiarity with metadata management.
      • Knowledge of data privacy practices and laws.

      Define Policies, Processes, and Priorities

      • Policies
        • Boundaries of the data architecture.
        • Data architecture standards.
        • Data architecture security.
        • Responsibility of ownership for the data architecture and data repositories.
        • Responsibility for data architecture governance.
      • Processes
        • Data architecture communication.
        • Data architecture change management.
        • Data architecture governance.
        • Policy compliance monitoring.
      • Priorities
        • Align architecture efforts with business priorities.
        • Close technology gaps to meet service level agreements (SLAs).
        • Determine impacts on current or future projects.

      See Info-Tech’s Data Architect job description for a comprehensive description of the data architect role.

      Leverage data architecture frameworks to understand how the role fits into the greater Enterprise Architecture framework

      Enterprise data architectures are available from industry consortiums such as The Open Group (TOGAF®), and open source initiatives such as MIKE2.0.

      Logo for The Open Group.

      The Open Group TOGAF enterprise architecture model is a detailed framework of models, methods, and supporting tools to create an enterprise-level architecture.

      • TOGAF was first developed in 1995 and was based on the Technical Architecture Framework for Information Management (TAFIM) developed by the US Department of Defense.
      • TOGAF includes application, data, and infrastructure architecture domains providing enterprise-level, product-neutral architecture principles, policies, methods, and models.
      • As a member of The Open Group, it is possible to participate in ongoing TOGAF development initiatives.

      The wide adoption of TOGAF has resulted in the mapping of it to several other industry standards including CoBIT and ITIL.

      Logo for MIKE2.0.

      MIKE2.0 (Method for an Integrated Knowledge Environment), is an open source method for enterprise information management providing a framework for information development.

      • SAFE (Strategic Architecture for the Federated Enterprise) provides the technology solution framework for MIKE2.0
      • SAFE includes application, presentation, information, data, Infrastructure, and metadata architecture domains.

      Info-Tech Best Practice

      If an enterprise-level IT architecture is your goal, TOGAF is likely a better model. However, if you are an information and knowledge-based business then MIKE2.0 may be more relevant to your business.

      The data architect must identify what drives the need for data from the business to create a business-driven architecture

      As the business landscape evolves, new needs arise. An organization may undergo new compliance requirements, or look to improve their customer intimacy, which could require a new functionality from an application and its associated database.

      There are four common scenarios that lead to an organization’s need to optimize its data architecture and these scenarios all present unique challenges for a data architect:

      1. Becoming More Data Driven As organizations are looking to get more out of their data, there is a push for more accurate and timely data from applications. Data-driven decision making requires verifiable data from trustworthy sources. Result: Replace decisions made on gut or intuition with real and empirical data - make more informed and data-driven decisions.
      2. New Functionality or Business Rule In order to succeed as business landscapes change, organizations find themselves innovating on products or services and the way they do things. Changes in business rules, product or service offering, and new functionalities can subsequently demand more from the existing data architecture. Result: Prepare yourself to successfully launch new business initiatives with an architecture that supports business needs.
      3. Mergers and Acquisitions If an organization has recently acquired, been acquired, or is merging with another, the technological implications require careful planning to ensure a seamless fit. Application consolidation, retirement, data transfer, and integration points are crucial. Result: Leverage opportunities to incorporate and consolidate new synergistic assets to realize the ROI.
      4. Risk and Compliance Data in highly regulated organizations needs to be kept safe and secure. Architectural decisions around data impact the level of compliance within the organization. Result: Avoid the fear of data audits, regulatory violations, and privacy breaches.

      Info-Tech Best Practice

      These are not the only reasons why data architects need to optimize the organization’s data architecture. These are only four of the most common scenarios, however, other business needs can be addressed using the same concept as these four common scenarios.

      Use the Data Architecture Driver tool to identify your focus for data architecture

      Supporting Tool icon 1.1 Data Architecture Driver Pattern Identification Tool

      Follow Info-Tech’s process of first analyzing the needs of the business, then determining how best to architect your data based on these drivers. Data architecture needs to be able to rapidly evolve to support the strategic goals of the business, and the Data Architecture Driver Pattern Identification Tool will help you to prioritize your efforts to best do this.

      Tab 2. Driver Identification

      Objective: Objectively assess the most pressing business drivers.

      Screenshot of the Data Architecture Driver Pattern Identification Tool, tab 2.

      Tab 3. Tactic Pattern Plan, Section 1

      Purpose: Review your business drivers that require architectural changes in your environment.

      Screenshot of the Data Architecture Driver Pattern Identification Tool, tab 3, section 1.

      Tab 3. Tactic Pattern Plan, Section 2

      Purpose: Determine a list of tactics that will help you address the business drivers.

      Screenshot of the Data Architecture Driver Pattern Identification Tool, tab 3, section 2.

      Step
      • Evaluate business drivers to determine the data architecture optimization priorities and tactics.
      Step
      • Understand how each business driver relates to data architecture and how each driver gives rise to a specific pattern across the five-tier data architecture.
      Step
      • Review the list of high-level tactics presented to optimize your data architecture across the five tier architecture.

      Identify the drivers for improving your data architecture

      Associated Activity icon 1.1.1 1 hour

      INPUT: Data Architecture Driver tool assessment prompts.

      OUTPUT: Identified business driver that applies to your organization.

      Materials: Data Architecture Driver Pattern Identification Tool

      Participants: Data architect, Enterprise architect

      Instructions

      In Tab 2. Driver Identification of the Data Architecture Driver Pattern Identification Tool, assess the degree to which the organization is feeling the pains of the four most common business drivers:

      1. Is there a present or growing need for the business to be making data-driven decisions?
      2. Does the business want to explore a new functionality and hence require a new application?
      3. Is your organization acquiring or merging with another entity?
      4. Is your organization’s regulatory environment quick to change and require stricter reporting?

      Data architecture improvements need to be driven by business need.

      Screenshot of the Data Architecture Driver Pattern Identification Tool, tab 2 Driver Identification.
      Tab 2. Driver Identification

      “As a data architect, you have to understand the functional requirements, the non-functional requirements, then you need to make a solution for those requirements. There can be multiple solutions and multiple purposes. (Andrew Johnston, Independent Consultant)

      Interview the business to get clarity on business objectives and drivers

      Associated Activity icon 1.1.2 1 hour per interview

      INPUT: Sample questions targeting the activities, challenges, and opportunities of each business unit

      OUTPUT: Sample questions targeting the activities, challenges, and opportunities of each business unit

      Materials: Data Architecture Driver Pattern Identification Tool

      Participants: Data architect, Business representatives, IT representatives

      Identify 2-3 business units that demonstrate enthusiasm for or a positive outlook on improving how organizational data can help them in their role and as a unit.

      Conducting a deep-dive interview process with these key stakeholders will help further identify high-level goals for the data architecture strategy within each business unit. This process will help to secure their support throughout the implementation process by giving them a sense of ownership.

      Key Interview Questions:

      1. What are your primary activities? What do you do?
      2. What challenges do you have when completing your activities?
      3. How is poor data impacting your job?
      4. If [your selected domain]’s data is improved, what business issues would this help solve?

      Request background information and documentation from stakeholders regarding the following:

      • What current data management policies and processes exist (that you know of)?
      • Who are the data owners and end users?
      • Where are the data sources within the department stored?
      • Who has access to these data sources?
      • Are there existing or ongoing data issues within those data sources?

      Interview the enterprise architect to get input on the drivers of the business

      Associated Activity icon 1.1.3 2 hours

      INPUT: Data Architecture Driver tool assessment prompts.

      OUTPUT: Identified business driver that applies to your organization.

      Materials: Data Architecture Driver Pattern Identification Tool

      Participants: Data architect, Enterprise architect

      Data architecture improvements need to be driven by business need.

      Instructions

      As you work through Tab 2. Driver Identification of the Data Architecture Driver Pattern Identification Tool, consult with the enterprise architect or equivalent to assist you in rating the importance of each of the symptoms of the business drivers. This will help you provide greater value to the business and more aligned objectives.

      Screenshot of the Data Architecture Driver Pattern Identification Tool, tab 2 Driver Identification.
      Tab 2. Driver Identification

      Once you know what that need is, go to Step 2.

      Phase 1, Step 2: Establish Actionable Tactics to Optimize Data Architecture

      PHASE 1

      1.11.2
      Identify Your Business Driver for Optimizing Data ArchitectureDetermine Actionable Tactics to Optimize Data Architecture

      This step will walk you through the following activities:

      • Understand Info-Tech’s five-tier data architecture to begin focusing your architectural optimization.
      • Create your Data Architecture Optimization Template to plan your improvement tactics.
      • Prioritize your tactics based on the five-tier architecture to plan optimization.

      This step involves the following participants:

      • Data Architect
      • Enterprise Architect
      • DBAs

      Outcomes of this step

      • A tactical and prioritized plan for optimizing the organization’s data architecture according to the needs of the business.

      To plan a business-driven architecture, data architects need to keep the organization’s big picture in mind

      Remember… Architecting an organization involves alignment, planning, road mapping, design, and change management functions.

      Data architects must be heavily involved with:

      • Understanding the short- and long-term visions of the business to develop a vision for the organization’s data architecture.
      • Creating processes for governing the identification, collection, and use of accurate and valid data, as well as for tracking data quality, completeness, and redundancy.
      • They need to create strategies for data security, backup, disaster recovery, business continuity, and archiving, and ensure regulatory compliance.

      To do this, you need a framework. A framework provides you with the holistic view of the organization’s data environment that you can use to design short- and long-term tactics for improving the use of data for the needs of the business.

      Use Info-Tech’s five-tier data architecture to model your environment in a logical, consumable fashion.

      Info-Tech Best Practice

      The more complicated an environment is, the more need there is for a framework. Being able to pick a starting point and prioritize tasks is one of the most difficult, yet most essential, aspects of any architect’s role.

      The five tiers of an organization’s data architecture support the use of data throughout its lifecycle

      Info-Tech’s five-tier data architecture model summarizes an organization’s data environment at a logical level. Data flows from left to right, but can also flow from the presentation layer back to the warehousing layer for repatriation of data.

      Info-Tech's Five Tier Data Architecture. The five tiers being 'Sources' which includes 'App1 ', 'App2', 'Excel and other documents', 'Access database(s)', 'IOT devices', and 'External data feed(s) & social media'; 'Integration and Translation' which includes 'Solutions: SOA, Point to Point, Manual Loading, ESB , ETL, ODS, Data Hub' and 'Functions: Scrambling Masking Encryption, Tokenizing, Aggregation, Transformation, Migration, Modeling'; 'Warehousing' which includes 'Data Lakes & Warehouse(s) (Raw Data)', 'EIM, ECM, DAM', and 'Data Lakes & Warehouse(s) (Derived Data)'; 'Analytics' which includes 'Data Marts', 'Data Cube', 'Flat Files', 'BI Tools', and the 'Protected Zone: Data Marts - BDG Class Ref. MDM'; and 'Presentation' which includes 'Formulas', 'Thought Models', 'Reports', 'Dashboards', 'Presentations', and 'Derived Data (from analytics activities)'.

      Use the Data Architecture Optimization Template to build your improvement roadmap

      Supporting Tool icon 1.2 Data Architecture Optimization Template

      Download the Data Architecture Optimization Template.

      Overview

      Use this template to support your team in creating a tactical strategy for optimizing your data architecture across the five tiers of the organization’s architecture. This template can be used to document your organization’s most pressing business driver, the reasons for optimizing data architecture according to that driver, and the tactics that will be employed to address the shortcomings in the architecture.

      Sample of Info-Tech’s Data Architecture Optimization Template. Info-Tech’s Data Architecture Optimization Template Table of Contents
      1. Build Your Current Data Architecture Logical Model Use this section to document the current data architecture situation, which will provide context for your plan to optimize your data architecture.
      2. Optimization Plan Use this section to document the tactics that will be employed to optimize the current data architecture according to the tactic pattern identified by the business driver.

      Fill out as you go

      As you read about the details of the five-tier data architecture model in the following slides, start building your current logical data architecture model by filling out the sections that correspond to the various tiers. For example, if you identified that the most pressing business driver is becoming compliant with regulations, document the sources of data required for compliance, as well as the warehousing strategy currently being employed. This will help you to understand the organization’s data architecture at a logical level.

      Tier 1 represents all of the sources of your organization’s data

      Tier 1 of Info-Tech's Five Tier Data Architecture, 'Sources', which includes 'App1 ', 'App2', 'Excel and other documents', 'Access database(s)', 'IOT devices', and 'External data feed(s) & social media'.
      –› Data to integration layer

      Tier 1 is where the data enters the organization.

      All applications, data documents such as MS Excel spreadsheets, documents with table entries, manual extractions from other document types, user-level databases including MS Access and MySQL, other data sources, data feeds, big datasets, etc. reside here.

      This tier typically holds the siloed data that is so often not available across the enterprise because the data is held within department-level applications or systems. This is also the layer where transactions and operational activities occur and where data is first created or ingested.

      There are any number of business activities from transactions through business processes that require data to flow from one system to another, so it is often at this layer we see data created more than once, data corruption occurs, manual re-keying of data from system to system, and spaghetti-like point-to-point connections are built that are often fragile. This is usually the single most problematic area within an enterprise’s data environment. Application- or operational-level (siloed) reporting often occurs at this level.

      Info-Tech Best Practice

      An optimized Tier 1 has the following attributes:

      • Rationalized applications
      • Operationalized database administration
      • Databases governed, monitored, and maintained to ensure optimal performance

      Tier 2 represents the movement of data

      Tier 2 of Info-Tech's Five Tier Data Architecture, 'Integration and Translation', which includes 'Solutions: SOA, Point to Point, Manual Loading, ESB , ETL, ODS, Data Hub' and 'Functions: Scrambling Masking Encryption, Tokenizing, Aggregation, Transformation, Migration, Modeling'.
      –› Data to Warehouse Environment

      Find out more

      For more information on data integration, see Info-Tech’s Optimize the Organization’s Data Integration Practices blueprint.

      Tier 2 is where integration, transformation, and aggregation occur.

      Regardless of how you integrate your systems and data stores, whether via ETL, ESB, SOA, data hub, ODS, point-to-point, etc., the goal of this layer is to move data at differing speeds for one of two main purposes:

      1) To move data from originating systems to downstream systems to support integrated business processes. This ensures the data is pristine through the process and improves trustworthiness of outcomes and speed to task and process completion.

      2) To move data to Tier 3 - The Data Warehouse Architecture, where data rests for other purposes. This movement of data in its purest form means we move raw data to storage locations in an overall data warehouse environment reflecting any security, compliance and other standards in our choices for how to store.

      Also, this is where data is transformed for unique business purpose that will also be moved to a place of rest or a place of specific use. Data masking, scrambling, aggregation, cleansing and matching, and other data related blending tasks occur at this layer.

      Info-Tech Best Practice

      An optimized Tier 2 has the following attributes:

      • Business data glossary is leveraged
      • ETL is governed
      • ETL team is empowered
      • Data matching is facilitated
      • Canonical data model is present

      Tier 3 is where data comes together from all sources to be stored in a central warehouse environment

      Tier 3 is where data rests in long-term storage.

      This is where data rests (long-term storage) and also where an enterprise’s information, documents, digital assets, and any other content types are stored. This is also where derived and contrived data creations are stored for re-use, and where formulas, thought models, heuristics, algorithms, report styles, templates, dashboard styles, and presentations-layer widgets are all stored in the enterprise information management system.

      At this layer there may be many technologies and many layers of security to reflect data domains, classifications, retention, compliance, and other data needs. This is also the layer where data lakes exist as well as traditional relational databases, enterprise database systems, enterprise content management systems, and simple user-level databases.

      Info-Tech Best Practice

      An optimized Tier 3 has the following attributes:

      • Data warehouse is governed
      • Data warehouse operations and planning
      • Data library is comprehensive
      • Four Rosetta Stones of data are in place: BDG, data classification, reference data, master data.
      Data from integration layer –›
      Tier 3 of Info-Tech's Five Tier Data Architecture, 'Data Warehouse Environment' which includes 'Data Lakes & Warehouse(s) (Raw Data)', 'EIM, ECM, DAM'.
      –› Analytics

      Find out more

      For more information on Data Warehousing, see Info-Tech’s Build an Extensible Data Warehouse Foundation and Drive Business Innovation With a Modernized Data Warehouse Environment blueprints.

      Tier 4 is where knowledge and insight is born

      Tier 4 represents data being used for a purpose.

      This is where you build fit-for-purpose data sets (marts, cubes, flat files) that may now draw from all enterprise data and information sources as held in Tier 3. This is the first place where enterprise views of all data may be effectively done and with trust that golden records from systems of record are being used properly.

      This is also the layer where BI tools get their greatest use for performing analysis. Unlike Tier 3 where data is at rest, this tier is where data moves back into action. Data is brought together in unique combinations to support reporting, and analytics. It is here that the following enterprise analytic views are crafted:
      Exploratory, Inferential, Causal, Comparative, Statistical, Descriptive, Diagnostic, Hypothesis, Predictive, Decisional, Directional, Prescriptive

      Info-Tech Best Practice

      An optimized Tier 4 has the following attributes:

      • Reporting meets business needs
      • Data mart operations are in place
      • Governance of data marts, cubes, and BI tools in place
      Warehouse Environment –›
      Tier 4 of Info-Tech's Five Tier Data Architecture, 'Analytics', which includes 'Data Marts', 'Data Cube', 'Flat Files', and 'BI Tools'.
      –› Presentation

      Find out more

      For more information on BI tools and strategy, see Info-Tech’s Select and Implement a Business Intelligence and Analytics Solution and Build a Next Generation BI with a Game-Changing BI Strategy blueprints.

      The presentation layer, Tier 5, is where data becomes presentable information

      Tier 5 represents data in knowledge form.

      This is where the data and information combine in information insight mapping methods (presentations, templates, etc.). We craft and create new ways to slice and dice data in Tier 4 to be shown and shared in Tier 5.

      Templates for presenting insights are extremely valuable to an enterprise, both for their initial use, and for the ability to build deeper, more insightful analytics. Re-use of these also enables maximum speed for sharing, consuming the outputs, and collective understanding of these deeper meanings that is a critical asset to any enterprise. These derived datasets and the thought models, presentation styles, templates, and other derived and contrived assets should be repatriated into the derived data repositories and the enterprise information management systems respectively as shown in Tier 3.

      Find out more

      For more information on enterprise content management and metadata, see Info-Tech’s Develop an ECM Strategy and Break Open Your DAM With Intuitive Metadata blueprints.

      Tier 5 of Info-Tech's Five Tier Data Architecture, 'Presentation', which includes 'Formulas', 'Thought Models', 'Reports', 'Dashboards', 'Presentations', and 'Derived Data (from analytics activities)'. The 'Repatriation of data' feeds the derived data back into Warehousing.

      Info-Tech Best Practice

      An optimized Tier 5 has the following attributes:

      • Metadata creation is supervised
      • Metadata is organized
      • Metadata is governed
      • Content management capabilities are present

      Info-Tech Insight

      Repatriation of data and information is an essential activity for all organizations to manage organizational knowledge. This is the activity where information, knowledge, and insights that are stored in content form are moved back to the warehousing layer for long-term storage. Because of this, it is crucial to have an effective ECM strategy as well as the means to find information quickly and efficiently. This is where metadata and taxonomy come in.

      As a data architect, you must prioritize your focus according to business need

      Determine your focus.

      Now that you have an understanding of the drivers requiring data architecture optimization, as well as the current data architecture situation at your organization, it is time to determine the actions that will be taken to address the driver.

      1. Business driver

      Screenshot of Data Architecture Driver Pattern Identification Tool, Tab 2. Tactic Pattern Plan.
      Data Architecture Driver Pattern Identification Tool, Tab 2. Tactic Pattern Plan

      3. Documented tactic plan

      Data Architecture Optimization Template

      2. Tactics across the five tiers

      Another screenshot of Data Architecture Driver Pattern Identification Tool, Tab 2. Tactic Pattern Plan.

      The next four slides provide an overview of the priorities that accompany the four most common business drivers that require updates to a stale data architecture.

      Business driver #1: Adding a new functionality to an application can have wide impacts on data architecture

      Does the business wants to add a new application or supplement an existing application with a new functionality?

      Whether the business wants to gain better customer intimacy, achieve operational excellence, or needs to change its compliance and reporting strategy, the need for collecting new data through a new application or a new functionality within an existing application can arise. This business driver has the following attributes:

      • Often operational oriented and application driven.
      • An application is changed through an application version upgrade, migration to cloud, or application customization, or as a result of application rationalization or changes in the way that application data is generated.
      • However, not all new functionalities trigger this scenario. Non-data-related changes, such as a new interface, new workflows, or any other application functionality changes that do not involve data, will not have data architecture impacts.
      Stock photo of someone using a smartphone with apps.
      Modified icon for Tools & Templates. When this business driver arises, data architects should focus on optimizing architecture at the source tier and the integration of the new functionality. Tactics for this business driver should address the following pattern:
      Tiers 1 and 2 highlighted.

      Business driver #2: Organizations today are looking to become more data driven

      Does the business wants to better leverage its data?

      An organization can want to use its data for multiple reasons. Whether these reasons include improving customer experience or operational excellence, the data architect must ensure that the organization’s data aggregation environment, reporting and analytics, and presentation layer are assessed and optimized for serving the needs of the business.

      “Data-drivenness is about building tools, abilities, and, most crucially, a culture that acts on data.” (Carl Anderson, Creating a Data-Driven Organization)

      Tactics for this business driver should address the following pattern:
      Tiers 3, 4, and 5 highlighted.
      Modified icon for Tools & Templates. When this business driver arises, data architects should focus on optimizing architecture at the source tier and the integration of the new functionality.
      Stock photo of someone sitting at multiple computers with analytics screens open.
      • This scenario is typically project driven and analytical oriented.
      • The business is looking to leverage data and information by processing data through BI tools and self-service.
      • Example: The organization wants to include new third-party data, and needs to build a new data mart to provide a slice of data for analysis.

      Business driver #3: Risk and compliance demands can put pressure on outdated architectures

      Is there increasing pressure on the business to maintain compliance requirements as per regulations?

      An organization can want to use its data for multiple reasons. Whether these reasons include improving customer experience or operational excellence, the data architect must ensure that the organization’s data aggregation environment, reporting and analytics, and presentation layer are assessed and optimized for serving the needs of the business.

      There are different types of requirements:
      • Can be data-element driven. For example, PII, PHI are requirements around data elements that are associated with personal and health information.
      • Can be process driven. For example, some requirements restrict data read/write to certain groups.
      Stock photo of someone pulling a block out of a Jenga tower.
      Modified icon for Tools & Templates. When this business driver arises, data architects should focus on optimizing architecture where data is stored: at the sources, the warehouse environment, and analytics layer. Tactics for this business driver should address the following pattern:
      Tiers 1, 3, and 4 highlighted.

      Business driver #4: Mergers and acquisitions can require a restructuring of the organization’s data architecture

      Is the organization looking to acquire or merge with another organization or line of business?

      There are three scenarios that encompass the mergers and acquisitions business driver for data architecture:

      1. The organization acquires/merges with another organization and wants to integrate the data.
      2. The organization acquires/merges a subset of an organization (a line of business, for example) and wants to integrate the data.
      3. The organization acquires another organization for competitive purposes, and does not need to integrate the data.
      Regardless of what scenario your organization falls into, you must go through the same process of identifying the requirements for the new data:
      1. Understand what data you are getting.
        The business may acquire another organization for the data, for the technology, and/or for algorithms (for example). If the goal is to integrate the new data, you must understand if the data is unstructured, structured, how much data, etc.
      2. Plan for the integration of the new data into your environment.
        Do you have the expertise in-house to integrate the data? Database structures and systems are often mismatched (for example, acquired company could have an Oracle database whereas you are an SAP shop) and this may require expertise from the acquired company or a third party.
      3. Integrate the new data.
        Often, the extraction of the new data is the easy part. Transforming and loading the data is the difficult and costly part.
      “As a data architect, you must do due diligence of the acquired firm. What are the workflows, what are the data sources, what data is useful, what is useless, what is the value of the data, and what are the risks of embedding the data?” (Anonymous Mergers and Acquisitions Consultant)
      Modified icon for Tools & Templates. When this business driver arises, data architects should focus on optimizing architecture at the source tier, the warehousing layer, and analytics. Tiers 1, 3, and 4 highlighted.

      Determine your tier priority pattern and the tactics that you should address based on the business drivers

      Associated Activity icon 1.2.1 30 minutes

      INPUT: Business driver assessment

      OUTPUT: Tactic pattern and tactic plan

      Materials: Data Architecture Driver Pattern Identification Tool, Data Architecture Optimization Template

      Participants: Data architect, Enterprise architect

      Instructions
      1. After you have assessed the organization’s business driver on Tab 1. Driver Identification, move to Tab 2. Tactic Pattern Plan.
      2. Here, you will find a summary of the business driver that applies to you, as well as the tier priority pattern that will help you to focus your efforts for data architecture.
      3. Document the Tier Priority Pattern and associated tactics in Section 2. Optimization Plan of the Data Architecture Optimization Plan.
      Screenshot of Data Architecture Driver Tool.
      Data Architecture Driver Tool
      Arrow pointing right. Sample of Data Architecture Optimization Template
      Data Architecture Optimization Template

      Info-Tech Insight

      Our approach will help you to get to the solution of the organization’s data architecture problems as quickly as possible. However, keep in mind that you should still address the other tiers of your data architecture even if they are not part of the pattern we identified. For example, if you need to become more data driven, don’t completely ignore the sources and the integration of data. However, to deliver the most and quickest value, focus on tiers 3, 4, and 5.

      This phase helped you to create a tactical plan to optimize your data architecture according to business priorities

      Phase 1 is all about focus.

      Data architects and those responsible for updating an organization’s data architecture have a wide-open playing field with which to take their efforts. Being able to narrow down your focus and generate an actionable plan will help you provide more value to the organization quickly and get the most out of your data.

        Phase 1
        • Business Drivers
          • Tactic Pattern
            • Tactical Plan

      Now that you have your prioritized tactical plan, move to Phase 2. This phase will help you map these priorities to the essential capabilities and measure where you stack up in these capabilities. This is an essential step in creating your data architecture roadmap and plan for coming years to modernize the organization’s data architecture.

      To identify what the monetary authority needed from its data architecture, Info-Tech helped determine the business driver

      CASE STUDY

      Industry: Financial
      Source: Info-Tech Consulting
      Symbol for 'Monetary Authority Case Study'.

      Part 1

      Prior to receiving new external requirements, the monetary Authority body had been operating with an inefficient system. Outdated legacy systems, reports in paper form, incomplete reports, and stale data from other agencies resulted in slow data access. The new requirements demanded speeding up this process.

      Diagram comparing the 'Original Reporting' requirement of 'Up to 7 days' vs the 'New Requirement' of 'As soon as 1 hour'. The steps of reporting in that time are 'Report Request', 'Gather Data', and 'Make Report'.

      Although the organization understood it needed changes, it first needed to establish what were the business objectives, and which areas of their architecture they would need to focus on.

      The business driver in this case was compliance requirements, which directed attention to the sources, aggregation, and insights tiers.

      Tiers 1, 3, and 4 highlighted.

      Looking at the how the different tiers relate to certain business operations, the organization uncovered the best practise tactics to achieving an optimized data architecture.

      1. Source Tactics: 3. Warehousing Tactics: 4. Analytics Tactics:
      • Identify data sources
      • Ensure data quality
      • Properly catalogue data
      • Properly index data
      • Provide the means for data accessibility
      • Allow for data reduction/space for report building

      Once the business driver had been established, the organization was able to identify the specific areas it would eventually need to evaluate and remedy as needed.

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

      Book a workshop with our Info-Tech analysts:

      Photo of an Info-Tech analyst.
      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      1.1.1

      Sample of activity 1.1.1 'Identify the drivers for improving your data architecture'. Identify the business driver that will set the direction of your data architecture optimization plan.

      In this activity, the facilitator will guide the team in identifying the business driver that is creating the need to improve the organization’s data architecture. Data architecture needs to adapt to the changing needs of the business, so this is the most important step of any data architecture improvements.

      1.2.1

      Sample of activity 1.2.1 'Determine your tier priority pattern and the tactics that you should address based on the business drivers'. Determine the tactics that you will use to optimize data architecture.

      In this activity, the facilitator will help the team create a tactical plan for optimizing the organization’s data architecture across the five tiers of the logical model. This plan can then be followed when addressing the business needs.

      Build a Business-Aligned Data Architecture Optimization Strategy

      PHASE 2

      Personalize Your Tactics to Optimize Your Data Architecture

      Phase 2 will determine your tactics that you should implement to optimize your data architecture

      Business Drivers
      Each business driver requires focus on specific tiers and their corresponding capabilities, which in turn correspond to tactics necessary to achieve your goal.
      New Functionality Risk and Compliance Mergers and Acquisitions Become More Data Driven
      Tiers 1. Data Sources 2. Integration 3. Warehousing 4. Insights 5. Presentation
      Capabilities Current Capabilities
      Target Capabilities
      Example Tactics Leverage indexes, partitions, views, and clusters to optimize performance.

      Cleanse data source.

      Leverage integration technology.

      Identify matching approach priorities.

      Establish governing principles.

      Install performance enhancing technologies.

      Establish star schema and snowflake principles.

      Share data via data mart.

      Build metadata architecture:
      • Data lineage
      • Sharing
      • Taxonomy
      • Automatic vs. manual creation

      Phase 2 outline

      Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 2: Personalize Your Tactics to Optimize Your Data Architecture

      Proposed Time to Completion: 2 weeks
      Step 2.1: Measure Your Data Architecture Capabilities Step 2.2: Set a Target for Data Architecture Capabilities Step 2.3: Identify the Tactics That Apply to Your Organization
      Start with an analyst kick-off call:
      • Understand Info-Tech’s data architecture capability model to begin identifying where to develop tactics for optimizing your data architecture.
      Review findings with analyst:
      • Understand Info-Tech’s data architecture capability model to begin identifying where to develop tactics for optimizing your data architecture.
      Finalize phase deliverable:
      • Learn about the trends in data architecture that can be leveraged to develop tactics.
      Then complete these activities…
      • Measure your current state across the tiers of the capability model that will help address your business driver.
      Then complete these activities…
      • Measure your target state for the capabilities that will address your business driver.
      Then complete these activities…
      • Review the tactical roadmap that was created with guidance from the capability gap analysis.
      With these tools & templates:
      • Data Architecture Tactical Roadmap Tool
      With these tools & templates:
      • Data Architecture Tactical Roadmap Tool
      With these tools & templates:
      • Data Architecture Trends Presentation Template

      Phase 2 Results & Insights

      • Data architecture is not just data models. Understand the essential capabilities that your organization needs from its data architecture to develop a tactical plan for optimizing data architecture across its people, processes, and technology.

      Phase 2, Step 1: Measure Your Data Architecture Capabilities

      PHASE 2

      2.1 2.2 2.3
      Measure Your Data Architecture Capabilities Set a Target for Data Architecture Capabilities Identify the Tactics That Apply to Your Organization

      This step will walk you through the following activities:

      • As you walk through the data architecture capability model, measure your current state in each of the relevant capabilities.
      • Distinguish between essential and nice-to-have capabilities for your organization.

      This step involves the following participants:

      • Data Architect

      Outcomes of this step

      • A framework for generating a tactical plan for data architecture optimization.
      • Knowledge of the various trends in the data architecture field that can be incorporated into your plan.

      To personalize your tactical strategy, you must measure up your base data architecture capabilities

      What is a capability?

      Capabilities represent a mixture of people, technology, and processes. The focus of capability design is on the outcome and the effective use of resources to produce a differentiating capability or an essential supporting capability.

      To personalize your tactics, you have to understand what the essential capabilities are across the five tiers of an organization’s data architecture. Then, assess where you currently stand in these capabilities and where you need to go in order to build your optimization plan.

      'Capability' as a mixture of 'People', 'Technology', 'Process', and 'Assets'.

      Info-Tech’s data architecture capability model can be laid over the five-tier data architecture to understand the essential and advanced capabilities that an organization should have, and to build your tactical strategy for optimizing the organization’s data architecture across the tiers.

      Use Info-Tech’s data architecture capability model as a resource to assess and plan your personalized tactics

      Info-Tech’s data architecture capability model can be laid over the five-tier data architecture to understand the essential and advanced capabilities that an organization should have, and to build your tactical strategy for optimizing the organization’s data architecture across the tiers.

      Info-Tech’s Data Architecture Capability Model featuring the five-tier architecture listing 'Core Capabilities' and 'Advanced Capabilities' within each tier, and a list of 'Cross Capabilities' which apply to all tiers.

      Use the Data Architecture Tactical Roadmap Tool to create a tailored plan of action

      Supporting Tool icon 2.1.1 Data Architecture Tactical Roadmap Tool

      Instructions

      Use the Data Architecture Tactical Roadmap Tool as your central tool to develop a tactical plan of action to optimize the organization’s data architecture.

      This tool contains the following sections:

      1. Business Driver Input
      2. Capability Assessment
      3. Capability Gap Analysis
      4. Tactical Roadmap
      5. Metrics
      6. Initiative Roadmap

      INFO-TECH DELIVERABLE

      Sample of the Info-Tech deliverable Data Architecture Tactical Roadmap Tool.

      Benefits of using this tool:

      • Comprehensive documentation of data architecture capabilities present in leading organizations.
      • Generates an accurate architecture roadmap for your organization that is developed in alignment with the broader enterprise architecture and related architectural domains.

      To create a plan for your data architecture priorities, you must first understand where you currently stand

      Now that you understand the business problem that you are trying to solve, it is time to take action in solving the problem.

      The organization likely has some of the capabilities that are needed to solve the problem, but also a need to improve other capabilities. To narrow down the capabilities that you should focus on, first select the business driver that was identified in Phase 1 in Tab 1. Business Driver Input of the Data Architecture Tactical Roadmap Tool. This will customize the roadmap tool to deselect the capabilities that are likely to be less relevant to your organization.

      For Example: If you identified your business driver as “becoming more data-driven”, you will want to focus on measuring and building out the capabilities within Tiers 3, 4, and 5 of the capability model.

      Data Architecture Capability Model
      Info-Tech’s Data Architecture Capability Model with tiers 3, 4, and 5 highlighted.

      Note

      If you want to assess your organization for all of the capabilities across the data architecture capability model, select “Comprehensive Data Architecture Assessment” in Tab 1. Business Driver Input of the Data Architecture Tactical Roadmap Tool.

      Determine your current state across the related architecture tiers

      Associated Activity icon 2.1.2 1 hour

      INPUT: Current data architecture capabilities.

      OUTPUT: An idea of where you currently stand in the capabilities.

      Materials: Data Architecture Tactical Roadmap Tool

      Participants: Data architect, Enterprise architect, Business representatives

      Use the Data Architecture Tactical Roadmap Tool to evaluate the baseline and target capabilities of your practice in terms of how data architecture is approached and executed.

      Instructions
      1. Invite the appropriate stakeholders to participate in this exercise.
      2. On Tab 2. Practice Components, assess the current and target states of each capability on a scale of 1–5.
      3. Note: “Ad hoc” implies a capability is completed, but randomly, informally, and without a standardized method.
        These results will set the baseline against which you will monitor performance progress and keep track of improvements over time.
      To assess data architecture maturity, Info-Tech uses the Capability Maturity Model Integration (CMMI) program for rating capabilities on a scale of 1 to 5:

      1 = Initial/Ad hoc

      2 = Developing

      3 = Defined

      4 = Managed and Measurable

      5 = Optimized

      Info-Tech Insight

      Focus on Early Alignment. Assessing capabilities within specific people’s job functions can naturally result in disagreement or debate, especially between business and IT people. Objectively facilitate any debate and only finalize capability assessments when there is full alignment. Remind everyone that data architecture should ultimately serve business needs wherever possible.

      Phase 2, Step 2: Set a Target for Data Architecture Capabilities

      PHASE 2

      2.12.22.3
      Measure Your Data Architecture CapabilitiesSet a Target for Data Architecture CapabilitiesIdentify the Tactics That Apply to Your Organization

      This step will walk you through the following activities:

      • Determine your target state in each of the relevant capabilities.
      • Distinguish between essential and nice-to-have capabilities for your organization.

      This step involves the following participants:

      • Data Architect

      Outcomes of this step

      • A holistic understanding of where the organization’s data architecture currently sits, where it needs to go, and where the biggest gaps lie.

      To create a plan for your data architecture priorities, you must also understand where you need to get to in the future

      Keep the goal in mind by documenting target state objectives. This will help to measure the highest priority gaps in the organization’s data architecture capabilities.

      Example driver = Becoming more data driven Arrow pointing right. Info-Tech’s Data Architecture Capability Model with tiers 3, 4, and 5 highlighted. Arrow pointing right. Current Capabilities Arrow pointing right. Target Capabilities
      Gaps and Priorities
      Stock photo of a hand placing four shelves arranged as stairs. On the first step is a mini-cut-out of a person walking.

      Determine your future state across the relevant tiers of the data architecture capability model

      Associated Activity icon 2.2.1 2 hours

      INPUT: Current state of data architecture capabilities.

      OUTPUT: Target state of data architecture capabilities.

      Materials: Data Architecture Tactical Roadmap Tool

      Participants: Data architect

      The future of data architecture is now.

      Determine the state of data architecture capabilities that the organization needs to reach to address the drivers of the business.

      For example: If you identified your business driver as “becoming more data driven”, you will want to focus on the capabilities within Tiers 3, 4, and 5 of the capability model.

      Driver = Becoming more data driven Arrow pointing right. Info-Tech’s Data Architecture Capability Model with tiers 3, 4, and 5 highlighted. Arrow pointing right. Target Capabilities

      Identify where gaps in your data architecture capabilities lie

      Associated Activity icon 2.2.2 1 hour

      INPUT: Current and target states of data architecture capabilities.

      OUTPUT: Holistic understanding of where you need to improve data architecture capabilities.

      Materials: Data Architecture Tactical Roadmap Tool

      Participants: Data architect

      Visualization of gap assessment of data quality practice capabilities

      To enable deeper analysis on the results of your capability assessment, Tab 4. Capability Gap Analysis in the Data Architecture Tactical Roadmap Tool creates visualizations of the gaps identified in each of your practice capabilities and related data management practices. These diagrams serve as analysis summaries.

      Gap Assessment of Data Source Capabilities

      Sample of the Data Architecture Tactical Roadmap Tool, tab 4. Capability Gap Analysis.

      Use Tab 3. Data Quality Practice Scorecard to enhance your data quality project.

      1. Enhance your gap analyses by forming a relative comparison of total gaps in key practice capability areas, which will help in determining priorities.
      2. Put these up on display to improve discussion in the gap analyses and prioritization sessions.
      3. Improve the clarity and flow of your strategy template, final presentations, and summary documents by copying and pasting the gap assessment diagrams.

      Phase 2, Step 3: Identify the Tactics That Apply to Your Organization

      PHASE 2

      2.12.22.3
      Measure Your Data Architecture CapabilitiesSet a Target for Data Architecture CapabilitiesIdentify the Tactics That Apply to Your Organization

      This step will walk you through the following activities:

      • Before making your personal tactic plan, identify the trends in data architecture that can benefit your organization.
      • Understand Info-Tech’s data architecture capability model.
      • Initiate the Data Architecture Roadmap Tool to begin creating a roadmap for your optimization plan.

      This step involves the following participants:

      • Data Architect

      Outcomes of this step

      • A framework for generating a tactical plan for data architecture optimization.
      • Knowledge of the various trends in the data architecture field that can be incorporated into your plan.

      Capitalize on trends in data architecture before you determine the tactics that apply to you

      Stop here. Before you begin to plan for optimization of the organization’s data environment, get a sense of the sustainability and scalability of the direction of the organization’s data architecture evolution.

      Practically any trend in data architecture is driven by an attempt to solve one or more the common challenges of today’s tumultuous data landscape, otherwise known as “big data.” Data is being produced in outrageous amounts, at very high speeds, and in a growing number of types and structures.

      To meet these demands, which are not slowing down, you must keep ahead of the curve. Consider the internal and external catalysts that might fuel your organization’s need to modernize its data architecture:

      Big Data

      Data Storage

      Advanced analytics

      Unstructured data

      Integration

      Hadoop ecosystem

      The discussion about big data is no longer about what it is, but how do businesses of all types operationalize it.

      Is your organization currently capturing and leveraging big data?

      Are they looking to do so in the near future?

      The cloud

      The cloud offers economical solutions to many aspects of data architecture.

      Have you dealt with issues of lack of storage space or difficulties with scalability?

      Do you need remote access to data and tools?

      Real-time architecture

      Advanced analytics (machine learning, natural language processing) often require data in real-time. Consider Lambda and Kappa architectures.

      Has your data flow prevented you from automation, advanced analytics, or embracing the world of IoT?

      Graph databases

      Self-service data access allows more than just technical users to participate in analytics. NoSQL can uncover buried relationships in your data.

      Has your organization struggled to make sense of different types of unstructured data?

      Is ETL enough?

      What SQL is to NoSQL, ETL is to NoETL. Integration techniques are being created to address the high variety and high velocity of data.

      Have your data scientists wasted too much time and resources in the ETL stage?

      Read the Data Architecture Trends Presentation to understand the current cutting edge topics in data architecture

      Supporting Tool icon 2.1 Data Architecture Trends Presentation

      The speed at which new technology is changing is making it difficult for IT professionals to keep pace with best practices, let alone cutting edge technologies.

      The Info-Tech Data Architecture Trends Presentation provides a glance at some of the more significant innovations in technology that are driving today’s advanced data architectures.

      This presentation also explains how these trends relate to either the data challenges you may be facing, or the specific business drivers you are hoping to bring to your organization.

      Sample of the Data Architecture Trends Presentation.
      Data Architecture Trends Presentation

      Gaps between your current and future capabilities will help you to determine the tactics that apply to you

      Now that you know where the organization currently stands, follow these steps to begin prioritizing the initiatives:

      1. What are you trying to accomplish? Determine target states that are framed in quantifiable objectives that can be clearly communicated. The more specific the objectives are the better.
      2. Evaluate the “delta,” or difference between where the organization currently stands and where it needs to go. This will be expressed in terms of gap closure strategies, and will help clarify the initiatives that will populate the road map.
      3. Determine the relative business value of each initiative, as well as the relative complexities of successfully implementing them. These scores should be created with stakeholder input, and then plotted in an effort/transition quadrant map to determine where the quickest and most valuable wins lie.
      Current State Gap Closure Strategies Target State Data Architecture Tactical Roadmap
      • Organization objectives
      • Functional needs
      • Current operating models
      • Technology assets
      Initiatives involving:
      • Organizational changes
      • Functional changes
      • Technology changes
      • Process changes
      • Performance objectives (revenue growth, customer intimacy, growth of organization)
      • Operating model improvements
      • Prioritized, simplified, and compelling vision of how the organization will optimize data architecture

      (Source: “How to Build a Roadmap”)

      Info-Tech Insight

      Optimizing data architecture requires a tactical approach, not a passive approach. The demanding task of optimization requires the ability to heavily prioritize. After you have identified why, determine how using our pre-built roadmap to address the four common drivers.

      Each of the layers of an organization’s data architecture have associated challenges to optimization

      Stop! Before you begin, recognize these “gotchas” that can present roadblocks to creating an effective data architecture environment.

      Before diving headfirst into creating your tactical data architecture plan, documenting the challenges associated with each aspect of the organization’s data architecture can help to identify where you need to focus your energy in optimizing each tier. The following table presents the common challenges across the five tiers:

      Source Tier

      Integration Tier

      Warehousing Tier

      Analytics Tier

      Presentation Tier

      Inconsistent data models Performance issues Scalability of the data warehouse Data currency, flexibility Model interoperability
      Data quality measures: data accuracy, timeliness, accessibility, relevance Duplicated data Infrastructure needed to support volume of data No business context for using the data in the correct manner No business context for using the data in the correct manner
      Free-form field and data values beyond data domain Tokenization and other required data transformations Performance
      Volume
      Greedy consumers can cripple performance
      Insufficient infrastructure
      Inefficiencies in building the data mart Report proliferation/chaos (“kitchen sink dashboards”)
      Reporting out of source systems DB model inefficiencies
      Manual errors;
      Application usability
      Elasticity

      Create metrics before you plan to optimize your data architecture

      Associated Activity icon 2.2.3 1 hour

      INPUT: Tactics that will be used to optimize data architecture.

      OUTPUT: Metrics that can be used to measure optimization success.

      Materials: Data Architecture Tactical Roadmap Tool

      Participants: Data architect

      Metrics will help you to track your optimization efforts and ensure that they are providing value to the organization.

      There are two types of metrics that are useful for data architects to track and measure: program metrics and project metrics. Program metrics represent the activities that the data architecture program, which is the sum of multiple projects, should help to improve. Project metrics are the more granular metrics that track each project.

      Program Metrics

      • TCO of IT
        • Costs associated with applications, databases, data maintenance
        • Should decrease with better data architecture (rationalized apps, operationalized databases)
      • Cost savings:
        • Retiring a legacy system and associated databases
        • Consolidated licensing
        • Introducing shared services
      • Data systems under maintenance (maintenance burden)
      • End-user data requests fulfilled
      • Improvement of time of delivery of reports and insights

      Project Metrics

      • Percent of projects in alignment with EA
      • Percent of projects compliant with the EA governance process (architectural due diligence rate)
      • Reducing time to market for launching new products
        • Reducing human error rates
        • Speeding up order delivery
        • Reducing IT costs
        • Reducing severity and frequency of security incidents

      Use Tab 6. Metrics of the Data Architecture Tactical Roadmap Tool to document and track metrics associated with your optimization tactics.

      Use Info-Tech’s resources to build your data architecture capabilities

      The following resources from Info-Tech can be used to improve the capabilities that were identified as having a gap. Read more about the details of the five-tier architecture in the blueprints below:

      Data Governance

      Data architecture depends on effective data governance. Use our blueprint, Enable Shared Insights With an Effective Data Governance Engine to get more out of your architecture.

      Data Quality

      The key to maintaining high data quality is a proactive approach that requires you to establish and update strategies for preventing, detecting, and correcting errors. Find out more on how to improve data quality with Info-Tech’s blueprint, Restore Trust in Your Data Using a Business-Aligned Data Quality Management Approach.

      Master Data Management

      When you start your data governance program, you will quickly realize that you need an effective MDM strategy for managing your critical data assets. Use our blueprint, Develop a Master Data Management Strategy and Roadmap to Better Monetize Data to get started with MDM.

      Data Warehouse

      The key to maintaining high data quality is a proactive approach that requires you to establish and update strategies for preventing, detecting, and correcting errors. Find out more on how to improve data quality with Info-Tech’s blueprint, Drive Business Innovation With a Modernized Data Warehouse Environment.

      With the optimal tactics identified, the monetary authority uncovered areas needing improvement

      CASE STUDY

      Industry: Financial
      Source: Info-Tech Consulting
      Symbol for 'Monetary Authority Case Study'.

      Part 2

      After establishing the appropriate tactics based on its business driver, the monetary authority was able to identify its shortcomings and adopt resolutions to remedy the issues.

      Best Practice Tactic Current State Solution
      Tier 1 - Data Sources Identify data sources Data coming from a number of locations. Create data model for old and new systems.
      Ensure data quality Internal data scanned from paper and incomplete. Data cleansing and update governance and business rules for migration to new system.
      External sources providing conflicting data.
      Tier 3 - Data Warehousing Data catalogue Data aggregated incompletely. Built proper business data glossary for searchability.
      Indexing Data warehouse performance sub-optimal. Architected data warehouse for appropriate use (star schema).
      Tier 4 - Data Analytics Data accessibility Relevant data buried in warehouse. Build data marts for access.
      Data reduction Accurate report building could not be performed in current storage. Built interim solution sandbox, spin up SQL database.

      Establishing these solutions provided the organization with necessary information to build their roadmap and move towards implementing an optimized data architecture.

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

      Book a workshop with our Info-Tech analysts:

      Photo of a Info-Tech analyst.
      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      2.1.1 – 2.2.2

      Sample of activities 2.1.1 and 2.2.2, the first being 'Determine your current state across the related architecture tiers'. Evaluate your current capabilities and design your target data quality practice from two angles

      In this assessment and planning activity, the team will evaluate the current and target capabilities for your data architecture’s ability to meet business needs based on the essential capabilities across the five tiers of an organization’s architectural environment.

      2.2.3

      Sample of activity 2.2.3 'Create metrics before you plan to optimize your data architecture'. Create metrics to track the success of your optimization plan.

      The Info-Tech facilitator will guide you through the process of creating program and project metrics to track as you optimize your data architecture. This will help to ensure that the tactics are helping to improve crucial business attributes.

      Build a Business-Aligned Data Architecture Optimization Strategy

      PHASE 3

      Create Your Tactical Data Architecture Roadmap

      Phase 3 outline

      Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 3: Create Your Tactical Data Architecture Roadmap

      Proposed Time to Completion: 2 weeks
      Step 3.1: Personalize Your Data Architecture RoadmapStep 3.2: Manage Your Data Architecture Decisions and the Resulting Changes
      Start with an analyst kick-off call:
      • Review the tactical plan that addresses the business drivers by optimizing your data architecture in the relevant focus areas.
      Review findings with analyst:
      • Discuss and review the roadmap of optimization activities, including dependencies, timing, and ownership of activities.
      • Understand how change management is an integral aspect of any data architecture optimization plan.
      Then complete these activities…
      • Create your detailed data architecture initiative roadmap.
      Then complete these activities…
      • Create your Data Architecture Decision Template to document the changes that are going to be made to optimize your data architecture environment.
      • Review how change management fits into the data architecture improvement program.
      With these tools & templates:
      • Data Architecture Tactical Roadmap Tool
      With these tools & templates:
      • Data Architecture Decision Template

      Phase 3 Results & Insights

      • Phase 3 will help you to build a personalized roadmap and plan for optimizing data architecture in your organization. In carrying out this roadmap, changes will, by necessity, occur. Therefore, an integral aspect of a data architect’s role is change management. Use the resources included in Phase 3 to smoothen the change management process.

      Phase 3, Step 1: Personalize Your Data Architecture Roadmap

      PHASE 3

      3.1 3.2
      Personalize Your Data Architecture Roadmap Manage Your Data Architecture Decisions and the Resulting Changes

      This step will walk you through the following activities:

      • Determine the timing, effort, and ownership of the recommended optimization initiatives.
      • Brainstorm initiatives that are not yet on the roadmap but apply to you.

      This step involves the following participants:

      • Data Architect
      • DBAs
      • Enterprise Architect

      Outcomes of this step

      • A roadmap of specific initiatives that map to the tactical plan for optimizing your organization’s data architecture.
      • A plan for communicating high-level business objectives to data workers to address the issues of the business.

      Now that you have tactical priorities, identify the actionable steps that will lead you to an optimized data architecture

      Phase 1 and 2 helped you to identify tactics that address some of the most common business drivers. Phase 3 will bring you through the process of practically planning what those tactics look like in your organization’s environment and create a roadmap to plan how you will generate business value through optimization of your data architecture environment.

      Diagram of the three phases and the goals of each one. The first phase says 'Identify your data architecture business driver' and highlights 'Business Driver 3' out of four to focus on in Phase 2. Phase 2 says 'Optimization tactics across the five-tier logical data architecture' and identifies four of six 'Tactics' to use in Phase 3. Phase 3 is a 'Practical Roadmap of Initiatives' and utilizes a timeline of initiatives in which to apply the chosen tactics.

      Use the Data Architecture Tactic Roadmap Tool to personalize your roadmap

      Supporting Tool icon 3.1.1 Data Architecture Tactic Roadmap Tool
      Generating Your Roadmap
      1. On Tab 5. Tactic and Initiative Planning, you will find a list of tactics that correspond to every capability that applies to your chosen driver and where there is a gap. In addition, each tactic has a sequence of “Suggested Initiatives,” which represent the best-practice steps that you should take to optimize your data architecture according to your priorities and gaps.
      2. Customize this list of initiatives according to your needs.
      3. The Gantt chart is generated in Tab 7. Initiative Roadmap, and can be used to organize your plan and ensure that all of the essential aspects of optimizing data architecture are addressed.
      4. The roadmap can be used as an “executive brief” roadmap and as a communication tool for the business.
      Screenshot of the Data Architecture Tactic Roadmap Tool, Tab 5. Tactic and Initiative Planning.
      Tab 5. Tactic and Initiative Planning

      Screenshot of the Data Architecture Tactic Roadmap Tool, Tab 7. Initiative Roadmap.
      Tab 7. Initiative Roadmap

      Determine the details of your data architecture optimization activities

      Associated Activity icon 3.1.2 1 hour

      INPUT: Timing of initiatives for optimizing data architecture.

      OUTPUT: Optimization roadmap

      Materials: Data Architecture Tactic Roadmap Tool

      Participants: Data architect, Enterprise Architect

      Instructions

      1. With the list of suggested activities in place on Tab 5. Tactic and Initiative Planning, select whether or not the initiatives will be included in the roadmap. By default, all of the initiatives are set to “Yes.”
      2. Plan the sequence, starting time, and length of each initiative, as well as the assigned responsibility of the initiative in Tab 5. Tactic and Initiative Planning of the Data Architecture Tactic Roadmap Tool.
      3. The tool will a generate a Gantt chart based on the start and length of your initiatives.
      4. The Gantt chart is generated in Tab 7. Initiative Roadmap.
      Screenshot of the Data Architecture Tactic Roadmap Tool, Tab 5. Tactic and Initiative Planning. Tab 5. Tactic and Initiative Planning Screenshot of the Data Architecture Tactic Roadmap Tool, Tab 7. Initiative Roadmap. Tab 7. Initiative Roadmap

      Info-Tech Insight

      The activities that populate the roadmap can be taken as best practice activities. If you want an actionable, comprehensive, and prescriptive plan for optimizing your data architecture, fill in the timing of the activities and print the roadmap. This can serve as a rapid communication tool for your data architecture plan to the business and other architects.

      Optimizing data architecture relies on communication between the business and data workers

      Remember: Data architects bridge the gap between strategic and technical requirements of data.

      Visualization centering the 'Data Architect' as the bridge between 'Data Workers', 'Business', and 'Data & Applications'.

      Therefore, as you plan the data and its interactions with applications, it is imperative that you communicate the plan and its implications to the business and the data workers. Stock photo of coworkers communicating.
      Also remember: In Phase 1, you built your tactical data architecture optimization plan.
      Sample 1 of the Data Architecture Optimization Template. Sample 2 of the Data Architecture Optimization Template.
      Use this document to communicate your plan for data architecture optimization to both the business and the data workers. Socialize this document as a representation of your organization’s current data architecture as well as where it is headed in the future.

      Communicate your data architecture optimization plan to the business for approval

      Associated Activity icon 3.1.3 2 hours

      INPUT: Data Architecture Tactical Roadmap

      OUTPUT: Communication plan

      Materials: Data Architecture Optimization Template

      Participants: Data Architect, Business representatives, IT representatives

      Instructions

      Begin by presenting your plan and roadmap to the business units who participated in business interviews in activity 1.1.3 of Phase 1.

      If you receive feedback that suggests that you should make revisions to the plan, consult Info-Tech Research Group for suggestions on how to improve the plan.

      If you gain approval for the plan, communicate it to DBAs and other data workers.

      Iterative optimization and communication plan:
      Visualization of the Iterative optimization and communication plan. 'Start here' at 'Communicate Plan and Roadmap to the Business', and then continue in a cycle of 'Receive Approval or Suggested Modifications', 'Get Advice for Improvements to the Plan', 'Revise Plan', and back to the initial step until you receive 'Approval', then 'Present to Data Workers'.

      With a roadmap in place, the monetary authority followed a tactical and practical plan to repair outdated data architecture

      CASE STUDY

      Industry: Financial
      Source: Info-Tech Consulting
      Symbol for 'Monetary Authority Case Study'.

      Part 3

      After establishing the appropriate tactics based on its business driver, the monetary authority was able to identify its shortcomings and adopt resolutions to remedy the issues.

      Challenge

      A monetary authority was placed under new requirements where it would need to produce 6 different report types on its clients to a regulatory body within a window potentially as short as 1 hour.

      With its current capabilities, it could complete such a task in roughly 7 days.

      The organization’s data architecture was comprised of legacy systems that had poor searchability. Moreover, the data it worked with was scanned from paper, regularly incomplete and often inconsistent.

      Solution

      The solution first required the organization to establish the business driver behind the need to optimize its architecture. In this case, it would be compliance requirements.

      With Info-Tech’s methodology, the organization focused on three tiers: data sources, warehousing, and analytics.

      Several solutions were developed to address the appropriate lacking capabilities. Firstly, the creation of a data model for old and new systems. The implementation of governance principles and business rules for migration of any data. Additionally, proper indexing techniques and business data glossary were established. Lastly, data marts and sandboxes were designed for data accessibility and to enable a space for proper report building.

      Results

      With the solutions established, the monetary authority was given information it needed to build a comprehensive roadmap, and is currently undergoing the implementation of the plan to ensure it will experience its desired outcome – an optimized data architecture built with the capacity to handle external compliance requirements.

      Phase 3, Step 2: Manage Your Data Architecture Decisions and the Resulting Changes

      PHASE 3

      3.13.2
      Personalize Your Data Architecture RoadmapManage Your Data Architecture Decisions and the Resulting Changes

      This step will walk you through the following activities:

      • With a plan in place, document the major architectural decisions that have been and will be made to optimize data architecture.
      • Create a plan for change and release management, an essential function of the data architect role.

      This step involves the following participants:

      • Data Architect
      • Enterprise Architect

      Outcomes of this step

      • Resources for documenting and managing the inevitable change associated with updates to the organization’s data architecture environment.

      To implement data architecture changes, you must plan to accommodate the issues that come with change

      Once you have a plan in place, one the most challenging aspects of improving an organization is yet to come…overcoming change!

      “When managing change, the job of the data architect is to avoid unnecessary change and to encapsulate necessary change.

      You must provide motivation for simplifying change, making it manageable for the whole organization.” (Andrew Johnston, Independent Consultant)

      Stock photo of multiple hands placing app/website design elements on a piece of paper.

      Create roadmap

      Arrow pointing down.

      Communicate roadmap

      Arrow pointing down.

      Implement roadmap

      Arrow pointing down.

      Change management

      Use the Data Architecture Decision Template when architectural changes are made

      Supporting Tool icon 3.2 Data Architecture Decision Template
      Document the architectural decisions made to provide context around changes made to the organization’s data environment.

      The goal of this Data Architecture Decision Template is to provide data architects with a template for managing the changes that accompany major architectural decisions. As you work through the Build a Business-Aligned Data Architecture Optimization Strategy blueprint, you will create a plan for tactical initiatives that address the drivers of the business to optimize your data architecture. This plan will bring about changes to the organization’s data architecture that need change management considerations.

      Document any major changes to the organization’s data architecture that are required to evolve with the organization’s drivers. This will ensure that major architectural changes are documented, tracked, and that the context around the decision is maintained.

      “Environment is very chaotic nowadays – legacy apps, sprawl, ERPs, a huge mix and orgs are grappling with what our data landscape look like? Where are our data assets that we need to use?” (Andrew Johnston, Independent Consultant)

      Sample of the Data Architecture Decision Template.

      Use Info-Tech’s Data Architecture Decision Template to document any major changes in the organization’s data architecture.

      Leverage Info-Tech’s resources to smooth change management

      As changes to the architectural environment occur, data architects must stay ahead of the curve and plan the change management considerations that come with major architectural decisions.

      “When managing change, the job of the data architect is to avoid unnecessary change and to encapsulate necessary change.

      You must provide motivation for simplifying change, making it manageable for the whole organization.” (Andrew Johnston, Independent Consultant)

      See Info-Tech’s resources on change management to smooth changes:
      Banner for the blueprint set 'Optimize Change Management' with subtitle 'Turn and face the change with a right-sized change management process'.
      Sample of the Optimize Change Management blueprint.

      Change Management Blueprint

      Sample of the Change Management Roadmap Tool.

      Change Management Roadmap Tool

      Use Info-Tech’s resources for effective release management

      As changes to the architectural environment occur, data architects must stay ahead of the curve and plan the release management considerations around new hardware and software releases or updates.

      Release management is a process that encompasses the planning, design, build, configuration, and testing of hardware and software releases to create a defined set of release components (ITIL). Release activities can include the distribution of the release and supporting documentation directly to end users. See Info-Tech’s resources on Release Management to smooth changes:

      Banner for the blueprint set 'Take a Holistic View to Optimize Release Management' with subtitle 'Build trust by right-sizing your process using appropriate governance'.
      Samples of the Release Management blueprint.

      Release Management Blueprint

      Sample of the Release Management Process Standard Template.

      Release Management Process Standard Template

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

      Book a workshop with our Info-Tech analysts:

      Photo of a Info-Tech analyst.
      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      3.1.1

      Sample of activity 3.1.2 'Determine the timing of your data architecture optimization activities'. Create your personalized roadmap of activities.

      In this activity, the facilitator will guide the team in evaluating practice gaps highlighted by the assessment, and compare these gaps at face value so general priorities can be documented. The same categories as in 3.1.1 are considered.

      3.1.3

      Sample of activity 3.1.3 'Communicate your Data Architecture Optimization Plan to the business for approval'. Communicate your data architecture optimization plan.

      The facilitator will help you to identify the optimal medium and timing for communicating your plan for optimizing your data architecture.

      Insight breakdown

      Insight 1

      • Data architecture needs to evolve along with the changing business landscape. There are four common business drivers that put most pressure on archaic architectures. As a result, the organization’s architecture must be flexible and responsive to changing business needs.

      Insight 2

      • Data architecture is not just about models.
        Viewing data architecture as just technical data modeling can lead to structurally unsound data that does not serve the business.

      Insight 3

      • Data is used differently across the layers of an organization’s data architecture, and the capabilities needed to optimize use of data change with it. Architecting and managing data from source to warehousing to presentation requires different tactics for optimal use.

      Summary of accomplishment

      Knowledge Gained

      • An understanding of what data architecture is, how data architects can provide value to the organization, and how data architecture fits into the larger enterprise architecture picture.
      • The capabilities required for optimization of the organization’s data architecture across the five tiers of the logical data architecture model.

      Processes Optimized

      • Prioritization and planning of data architect responsibilities across the five tiers of the five-tier logical data architecture model.
      • Roadmapping of tactics that address the most common business drivers of the organization.
      • Architectural change management.

      Deliverables Completed

      • Data Architecture Driver Pattern Identification Tool
      • Data Architecture Optimization Template
      • Data Architecture Trends Presentation
      • Data Architecture Roadmap Tool
      • Data Architecture Decision Template

      Research contributors and experts

      Photo of Ron Huizenga, Senior Product Manager, Embarcadero Technologies, Inc. Ron Huizenga, Senior Product Manager
      Embarcadero Technologies, Inc.

      Ron Huizenga has over 30 years of experience as an IT executive and consultant in enterprise data architecture, governance, business process reengineering and improvement, program/project management, software development, and business management. His experience spans multiple industries including manufacturing, supply chain, pipelines, natural resources, retail, healthcare, insurance, and transportation.

      Photo of Andrew Johnston, Architect, Independent Consultant. Andrew Johnston, Architect Independent Consultant

      An independent consultant with a unique combination of managerial, commercial, and technical skills, Andrew specializes in the development of strategies and technical architectures that allow businesses to get the maximum benefit from their IT resources. He has been described by clients as a "broad spectrum" architect, summarizing his ability to engage in many problems at many levels.

      Research contributors

      Internal Contributors
      Logo for Info-Tech Research Group.
      • Steven J. Wilson, Senior Director, Research & Advisory Services
      • Daniel Ko, Research Manager
      • Bernie Gilles, Senior Director, Research & Advisory Services
      External Contributors
      Logo for Embarcadero.
      Logo for Questa Computing. Logo for Geha.
      • Ron Huizenga, Embercardo Technologies
      • Andrew Johnston, Independent Consultant
      • Darrell Enslinger, Government Employees Health Association
      • Anonymous Contributors

      Bibliography

      Allen, Mark. “Get the ETL Out of Here.” MarkLogic. Sep, 2016. Web. 25 Apr 2017.[http://www.marklogic.com/blog/get-the-etl-out-of-here/]

      Anadiotis, George. “Streaming hot: Real-time big data architecture matters.” ZDNet. Jan, 2017. Web. 25 Apr 2017. [http://www.zdnet.com/article/streaming-hot-real-time-big-data-architecture-matters/]

      Aston, Dan. “The Economic value of Enterprise Architecture and How to Show It.” Erwin. Aug, 2016. Web. 20 Apr 2017. [http://erwin.com/blog/economic-value-enterprise-architecture-show/]

      Baer, Tony. “2017 Trends to Watch: Big Data.” Ovum. Nov, 2016. Web. 25 Apr 2017.

      Bmc. “Benefits & Advantages of Hadoop.” Bmc. Web. 25 Apr 2017. [http://www.bmcsoftware.ca/guides/hadoop-benefits-business-case.html]

      Boyd, Ryan, et al. “Relational vs. Graph Data Modeling” DZone. Mar 2016. Web. 25 Apr 2017. [https://dzone.com/articles/relational-vs-graph-data-modeling]

      Brahmachar, Satya. “Theme To Digital Transformation - Journey to Data Driven Enterprise” Feb, 2015. Web. 20 Apr 2017. [http://satyabrahmachari-thought-leader.blogspot.ca/2015/02/i-smac-theme-to-digital-transformation.html]

      Capsenta. “NoETL.” Capsenta. Web. 25 Apr 2017. [https://capsenta.com/wp-content/uploads/2015/03/Capsenta-Booklet.pdf]

      Connolly, Shaun. “Implementing the Blueprint for Enterprise Hadoop” Hortonworks. Apr, 2014. Web. 25 Apr 2017. https://hortonworks.com/blog/implementing-the-blue...

      Forbes. “Cloud 2.0: Companies Move From Cloud-First To Cloud-Only.” Forbes. Apr, 2017. Web. 25 Apr 2017. [https://www.forbes.com/sites/vmware/2017/04/07/cloud-2-0-companies-move-from-cloud-first-to-cloud-only/#5cd9d94a4d5e]

      Forgeat, Julien. “Lambda and Kappa.” Ericsson. Nov 2015. Web 25 Apr 2017. [https://www.ericsson.com/research-blog/data-knowledge/data-processing-architectures-lambda-and-kappa/]

      Grimes, Seth. “Is It Time For NoETL?” InformationWeek. Mar, 2010. Web. 25 Apr 2017. [http://www.informationweek.com/software/information-management/is-it-time-for-noetl/d/d-id/1087813]

      Gupta, Manav. et al. “How IB‹ leads in building big data analytics solutions in the cloud.” IBM. Feb, 2016. Web. 25 Apr 2017. [https://www.ibm.com/developerworks/cloud/library/cl-ibm-leads-building-big-data-analytics-solutions-cloud-trs/index.html#N102DE]

      “How To Build A Roadmap.” Hub Designs Magazine. Web 25 Apr 2017. [https://hubdesignsmagazine.com/2011/03/05/how-to-build-a-roadmap/]

      IBM. “Top industry use cases for stream computing.” IBM. Oct, 2015. Web. 25 Apr 2017. [https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=IMW14704USEN]

      Mateos-Garcia, Juan, et al. “Skills Of The Datavores.” Nesta. July. 2015. Web. 8 Aug 2016. [https://www.nesta.org.uk/sites/default/files/skills_of_the_datavores.pdf].

      Maynard, Steven. “Analytics: Don’t Forget The Human Element” Forbes. 2015. Web. 20 Apr. 2017. [http://www.ey.com/Publication/vwLUAssets/EY-Forbes-Insights-Data-and-Analytics-Impact-Index-2015/$FILE/EY-Forbes-Insights-Data-and-Analytics-Impact-Index-2015.pdf]

      Neo4j. “From Relational to Neo4j.” Neo4j. Web. 25 Apr 2017. [https://neo4j.com/developer/graph-db-vs-rdbms/#_from_relational_to_graph_databases]

      NoETL “NoETL.” NoETL. Web. 25 Apr 2017. [http://noetl.org/]

      Nolan, Roger. “Digital Transformation: Is Your Data Management Ready?” Informatica. Jun, 2016. Web. 20 Apr 2017. [https://blogs.informatica.com/2016/06/10/digital-transformation-data-management-ready/#fbid=hmBYQgS6hnm]

      OpsClarity. “2016 State of Fast Data & Streaming Applications.” OpsClarity. Web. 25 Apr 2017. [https://www.opsclarity.com/wp-content/uploads/2016/07/2016FastDataSurvey.pdf]

      Oracle. “A Relational Database Overview.” Oracle. Web. 25 Apr 2017. [https://docs.oracle.com/javase/tutorial/jdbc/overview/database.html]

      Ponemon Institute LLC. “Big Data Cybersecurity Analytics Research Repor.t” Cloudera. Aug, 2016. Web. 25 Apr 2017. [https://www.cloudera.com/content/dam/www/static/documents/analyst-reports/big-data-cybersecurity-analytics-research-report.pdf]

      Sanchez, Jose Juan. “Data Movement Killed the BI Star.” DV Blog. May, 2016. Web. 20 Apr. 2017. [http://www.datavirtualizationblog.com/data-movement-killed-the-bi-star/]

      SAS. “Hadoop; What it is and why does it matter?” SAS. Web. 25 Apr 2017. [https://www.sas.com/en_ca/insights/big-data/hadoop.html#hadoopusers]

      Schumacher, Robin. “A Quick Primer on graph Databases for RDBMS Professionals.” Datastax. Jul, 2016. Web. 25 Apr 2017. [http://www.datastax.com/2016/07/quick-primer-on-graph-databases-for-rdbms-professionals]

      Swoyer, Steve. “It’s the End of the Data Warehouse as We Know It.” TDWI. Jan, 2017. Web. 20 Apr. 2017. [https://upside.tdwi.org/articles/2017/01/11/end-of-the-data-warehouse-as-we-know-it.aspx]

      Webber, Jim, and Ian Robinson. “The Top 5 Use Cases of Graph Databases.” Neo4j. 2015. Web. 25 Apr 2017. [http://info.neo4j.com/rs/773-GON-065/images/Neo4j_Top5_UseCases_Graph%20Databases.pdf]

      Zachman Framework. [https://www.zachman.com/]

      Zupan, Jane. “Survey of Big Data Decision Makers.” Attiv/o. May, 2016. Web. 20 Apr 2017. [https://www.attivio.com/blog/post/survey-big-data-decision-makers]

      Hire or Develop a World-Class CISO

      • Buy Link or Shortcode: {j2store}243|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Security Strategy & Budgeting
      • Parent Category Link: /security-strategy-and-budgeting
      • It is difficult to find a “unicorn”: a candidate who is already fully developed in all areas.
      • The role of the CISO has changed so much in the past three years, it is unclear what competencies are most important.
      • Current CISOs need to scope out areas of future development.

      Our Advice

      Critical Insight

      The new security leader must be strategic, striking a balance between being tactical and taking a proactive security stance. They must incorporate security into business practices from day one and enable secure adoption of new technologies and business practices.

      Impact and Result

      • Clarify the competencies that are important to your organizational needs and use them to find a candidate with those specific strengths.
      • If you are a current CISO, complete a self-assessment and identify your high-priority competency gaps so you can actively work to develop those areas.
      • Create an actionable plan to develop the CISO’s capabilities and regularly reassess these items to ensure constant improvement.

      Hire or Develop a World-Class CISO Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Hire of Develop a World-Class CISO Deck – A step-by-step guide on finding or developing the CISO that best fits your organization.

      Use this blueprint to hire or develop a world-class Chief Information Security Officer (CISO) with the competencies that suit your specific organizational needs. Once you have identified the right candidate, create a plan to develop your CISO.

      • Hire or Develop a World-Class CISO – Phases 1-4

      2. CISO Core Competency Evaluation Tool – Determine which competencies your organization needs and which competencies your CISO needs to work on.

      This tool will help you determine which competencies are a priority for your organizational needs and which competencies your CISO needs to develop.

      • CISO Core Competency Evaluation Tool

      3. CISO Stakeholder Power Map Template – Visualize stakeholder and CISO relationships.

      Use this template to identify stakeholders who are key to your security initiatives and to understand your relationships with them.

      • CISO Stakeholder Power Map Template

      4. CISO Stakeholder Management Strategy Template – Develop a strategy to improve stakeholder and CISO relationships.

      Create a strategy to cultivate your stakeholder relationships and manage each relationship in the most effective way.

      • CISO Stakeholder Management Strategy Template

      5. CISO Development Plan Template – Develop a plan to support a world-class CISO.

      This tool will help you create and implement a plan to remediate competency gaps.

      • CISO Development Plan Template

      Infographic

      Further reading

      Hire or Develop a World-Class CISO

      Find a strategic and security-focused champion for your business.

      Analyst Perspective

      Create a plan to become the security leader of tomorrow

      The days are gone when the security leader can stay at a desk and watch the perimeter. The rapidly increasing sophistication of technology, and of attackers, has changed the landscape so that a successful information security program must be elastic, nimble, and tailored to the organization’s specific needs.

      The Chief Information Security Officer (CISO) is tasked with leading this modern security program, and this individual must truly be a Chief Officer, with a finger on the pulses of the business and security processes at the same time. The modern, strategic CISO must be a master of all trades.

      A world-class CISO is a business enabler who finds creative ways for the business to take on innovative processes that provide a competitive advantage and, most importantly, to do so securely.

      Cameron Smith, Research Lead, Security and Privacy

      Cameron Smith
      Research Lead, Security & Privacy
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      • CEOs/CXOs are looking to hire or develop a senior security leader and aren’t sure where to start.
      • Conversely, security practitioners are looking to upgrade their skill set and are equally stuck in terms of what an appropriate starting point is.
      • Organizations are looking to optimize their security plans and move from a tactical position to a more strategic one.

      Common Obstacles

      • It is difficult to find a “unicorn”: a candidate who is already fully developed in all areas.
      • The role of the CISO has changed so much in the past three years, it is unclear what competencies are most important.
      • You are a current CISO and need to scope out your areas of future development.

      Info-Tech’s Approach

      • Clarify the competencies that are important to your organizational needs and use them to find a candidate with those specific strengths.
      • If you are a current CISO, complete a self-assessment and identify your high-priority competency gaps so you can actively work to develop those areas.
      • Create an actionable plan to develop the CISO’s capabilities and regularly reassess these items to ensure constant improvement.

      Info-Tech Insight
      The new security leader must be strategic, striking a balance between being tactical and taking a proactive security stance. They must incorporate security into business practices from day one and enable secure adoption of new technologies and business practices.

      Your challenge

      This Info-Tech blueprint will help you hire and develop a strategic CISO

      • Security without strategy is a hacker’s paradise.
      • The outdated model of information security is tactical, where security acts as a watchdog and responds.
      • The new security leader must be strategic, striking a balance between being tactical and taking a proactive security stance. They must incorporate security into business practices from day one and enable secure adoption of new technologies and business practices.

      Around one in five organizations don’t have an individual with the sole responsibility for security1

      1 Navisite

      Info-Tech Insight
      Assigning security responsibilities to departments other than security can lead to conflicts of interest.

      Common obstacles

      It can be difficult to find the right CISO for your organization

      • The smaller the organization, the less likely it will have a CISO or equivalent position.
      • Because there is a shortage of qualified candidates, qualified CISOs can demand high salaries and many CISO positions will go unfilled.
      • It is easier for larger companies to attract top CISO talent, as they generally have more resources available.

      Source: Navisite

      Only 36% of small businesses have a CISO (or equivalent position).

      48% of mid-sized businesses have a CISO.

      90% of large organizations have a CISO.

      Source: Navisite

      Strategic versus tactical

      CISOs should provide leadership based on a strategic vision 1

      Strategic CISO Tactical CISO

      Proactive

      Focus is on protecting hyperdistributed business processes and data

      Elastic, flexible, and nimble

      Engaged in business design decisions

      Speaks the language of the audience (e.g. business, financial, technical)

      Reactive

      Focus is on protecting current state

      Perimeter and IT-centric approach

      Communicates with technical jargon

      1 Journal of Computer Science and Information Technology

      Info-Tech has identified three key behaviors of the world-class CISO

      To determine what is required from tomorrow’s security leader, Info-Tech examined the core behaviors that make a world-class CISO. These are the three areas that a CISO engages with and excels in.

      Later in this blueprint, we will review the competencies and skills that are required for your CISO to perform these behaviors at a high level.

      Align

      Aligning security enablement with business requirements

      Enable

      Enabling a culture of risk management

      Manage

      Managing talent and change

      Info-Tech Insight
      Through these three overarching behaviors, you can enable a security culture that is aligned to the business and make security elastic, flexible, and nimble to maintain the business processes.

      Info-Tech’s approach

      Understand what your organization needs in a CISO: Consider the core competencies of a CISO. Assess: Assess candidates' core competencies and the CISO's stakeholder relationships. Plan improvements: Identify resources to close competency gaps and an approach to improve stakeholder relationships. Executive development: Decide next steps to support your CISO moving forward and regularly reassess to measure progress.

      Info-Tech’s methodology to Develop or Hire a World-Class CISO

      1. Launch 2. Assess 3. Plan 4. Execute
      Phase Steps
      1. Understand the core competencies
      2. Measure security and business satisfaction and alignment
      1. Assess stakeholder relationships
      2. Assess core competencies
      1. Identify resources to address your CISO’s competency gaps
      2. Plan an approach to improve stakeholder relationships
      1. Decide next actions and support your CISO moving forward
      2. Regularly reassess to measure development and progress
      Phase Outcomes

      At the end of this phase, you will have:

      • Determined the current gaps in satisfaction and business alignment for your IT security program.
      • Identified the desired qualities in a security leader, specific to your current organizational needs.

      At the end of this phase, you will have:

      • Used the core competencies to help identify the ideal candidate.
      • Identified areas for development in your new or existing CISO.
      • Determined stakeholder relationships to cultivate.

      At the end of this phase, you will have:

      • Created a high-level plan to address any deficiencies.
      • Improved stakeholder relations.

      At the end of this phase, you will have:

      • Created an action-based development plan, including relevant metrics, due dates, and identified stakeholders. This plan is the beginning, not the end. Continually reassessing your organizational needs and revisiting this blueprint’s method will ensure ongoing development.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      CISO Core Competency Evaluation Tool

      Assess the competency levels of a current or prospective CISO and identify areas for improvement.

      Stakeholder Power Map Template

      Visualize the importance of various stakeholders and their concerns.

      Stakeholder Management Strategy Template

      Document a plan to manage stakeholders and track actions.

      Key deliverable:

      CISO Development Plan Template

      The CISO Development Plan Template is used to map specific activities and time frames for competency development to address gaps and achieve your goal.

      Strategic competencies will benefit the organization and the CISO

      Career development should not be seen as an individual effort. By understanding the personal core competencies that Info-Tech has identified, the individual wins by developing relevant new skills and the organization wins because the CISO provides increased value.

      Organizational Benefits Individual Benefits
      • Increased alignment between security and business objectives
      • Development of information security that is elastic, nimble, and flexible for the business
      • Reduction in wasted efforts and resources, and improvement in efficiency of security and the organization as a whole
      • True synergy between security and business stakeholders, where the goals of both groups are being met
      • Increased opportunity as you become a trusted partner within your organization
      • Improved relationships with peers and stakeholders
      • Less resistance and more support for security initiatives
      • More involvement and a stronger role for security at all levels of the organization

      Measured value of a world-class CISO

      Organizations with a CISO saw an average of $145,000 less in data breach costs.1

      However, we aren’t talking about hiring just any CISO. This blueprint seeks to develop your CISO’s competencies and reach a new level of effectiveness.

      Organizations invest a median of around $375,000 annually in their CISO.2 The CISO would have to be only 4% more effective to represent $15,000 more value from this position. This would offset the cost of an Info-Tech workshop, and this conservative estimate pales in comparison to the tangible and intangible savings as shown below.

      Your specific benefits will depend on many factors, but the value of protecting your reputation, adopting new and secure revenue opportunities, and preventing breaches cannot be overstated. There is a reason that investment in information security is on the rise: Organizations are realizing that the payoff is immense and the effort is worthwhile.

      Tangible cost savings from having a world-class CISO Intangible cost savings from having a world-class CISO
      • Cost savings from incident reduction.
      • Cost savings achieved through optimizing information security investments, resulting in savings from previously misdiagnosed issues.
      • Cost savings from ensuring that dollars spent on security initiatives support business strategy.
      • More opportunities to create new business processes through greater alignment between security and business.
      • Improved reputation and brand equity achieved through a proper evaluation of the organization’s security posture.
      • Continuous improvement achieved through a good security assessment and measurement strategy.
      • Ability to plan for the future since less security time will be spent firefighting and more time will be spent engaged with key stakeholders.

      1 IBM Security
      2 Heidrick & Struggles International, Inc.

      Case Study

      In the middle of difficulty lies opportunity

      SOURCE
      Kyle Kennedy
      CISO, CyberSN.com

      Challenge
      The security program identified vulnerabilities at the database layer that needed to be addressed.

      The decision was made to move to a new vendor. There were multiple options, but the best option in the CISO’s opinion was a substantially more expensive service that provided more robust protection and more control features.

      The CISO faced the challenge of convincing the board to make a financial investment in his IT security initiative to implement this new software.

      Solution
      The CISO knew he needed to express this challenge (and his solution!) in a way that was meaningful for the executive stakeholders.

      He identified that the business has $100 million in revenue that would move through this data stream. This new software would help to ensure the security of all these transactions, which they would lose in the event of a breach.

      Furthermore, the CISO identified new business plans in the planning stage that could be protected under this initiative.

      Results
      The CISO was able to gain support for and implement the new database platform, which was able to protect current assets more securely than before. Also, the CISO allowed new revenue streams to be created securely.

      This approach is the opposite of the cautionary tales that make news headlines, where new revenue streams are created before systems are put in place to secure them.

      This proactive approach is the core of the world-class CISO.

      Info-Tech offers various levels of support to best suit your needs

      Guided Implementation

      What does a typical GI on this topic look like?

      Launch Assess Plan Execute

      Call #1: Review and discuss CISO core competencies.

      Call #2: Discuss Security Business Satisfaction and Alignment diagnostic results.

      Call #3: Discuss the CISO Stakeholder Power Map Template and the importance of relationships.

      Call #4: Discuss the CISO Core Competency Evaluation Tool.

      Call #5: Discuss results of the CISO Core Competency Evaluation and identify resources to close gaps.

      Call #6: Review organizational structure and key stakeholder relationships.

      Call #7: Discuss and create your CISO development plan and track your development

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 6 to 10 calls over the course of 3 to 6 months.

      Phase 1

      Launch

      Phase 1
      1.1 Understand Core Competencies
      1.2 Measure Security and Business Satisfaction and Alignment

      Phase 2
      2.1 Assess Stakeholder Relationships
      2.2 Assess the Core Competencies

      Phase 3
      3.1 Identify Resources to Address Competency Gaps
      3.2 Plan Approach to Improve Stakeholder Relationships

      Phase 4
      4.1 Decide Next Actions and Support Your CISO Moving Forward
      4.2 Regularly Reassess to Measure Development and Progress

      This phase will walk you through the following activities:

      • Review and understand the core competencies of a world-class CISO.
      • Launch your diagnostic survey.
      • Evaluate current business satisfaction with IT security.
      • Determine the competencies that are valuable to your IT security program’s needs.

      Hire or Develop a World-Class CISO

      Case study

      Mark Lester
      InfoSec Manager, SC Ports Authority

      An organization hires a new Information Security Manager into a static and well-established IT department.

      Situation: The organization acknowledges the need for improved information security, but there is no framework for the Security Manager to make successful changes.

      Challenges Next Steps
      • The Security Manager is an outsider in a company with well-established habits and protocols. He is tasked with revamping the security strategy to create unified threat management.
      • Initial proposals for information security improvements are rejected by executives. It is a challenge to implement changes or gain support for new initiatives.
      • The Security Manager will engage with individuals in the organization to learn about the culture and what is important to them.
      • He will assess existing misalignments in the business so that he can target problems causing real pains to individuals.

      Follow this case study throughout the deck to see this organization’s results

      Step 1.1

      Understand the Core Competencies of a World-Class CISO

      Activities

      Review core competencies the security leader must develop to become a strategic business partner

      This step involves the following participants:

      • CEO or other executive seeking to hire/develop a CISO

      or

      • Current CISO seeking to upgrade capabilities

      Outcomes of this step
      Analysis and understanding of the eight strategic CISO competencies required to become a business partner

      Launch

      Core competencies

      Info-Tech has identified eight core competencies affecting the CISO’s progression to becoming a strategic business partner.

      Business Acumen
      A CISO must focus primarily on the needs of the business.

      Leadership
      A CISO must be a security leader and not simply a practitioner.

      Communication
      A CISO must have executive communication skills

      Technical Knowledge
      A CISO must have a broad technical understanding.

      Innovative Problem Solving
      A good CISO doesn’t just say “no,” but rather finds creative ways to say “yes.”

      Vendor Management
      Vendor and financial management skills are critical to becoming a strategic CISO.

      Change Management
      A CISO improves security processes by being an agent of change for the organization.

      Collaboration
      A CISO must be able to use alliances and partnerships strategically.

      1.1 Understand the core competencies a CISO must focus on to become a strategic business partner

      < 1 hour

      Over the next few slides, review each world-class CISO core competency. In Step 1.2, you will determine which competencies are a priority for your organization.

      CISO Competencies Description
      Business Acumen

      A CISO must focus primarily on the needs of the business and how the business works, then determine how to align IT security initiatives to support business initiatives. This includes:

      • Contributing to business growth with an understanding of the industry, core functions, products, services, customers, and competitors.
      • Understanding the business’ strategic direction and allowing it to securely capitalize on opportunities.
      • Understanding the key drivers of business performance and the use of sound business practice.
      Leadership

      A CISO must be a security leader, and not simply a practitioner. This requires:

      • Developing a holistic view of security, risk, and compliance for the organization.
      • Fostering a culture of risk management.
      • Choosing a strong team. Having innovative and reliable employees who do quality work is a critical component of an effective department.
        • This aspect involves identifying talent, engaging your staff, and managing their time and abilities.

      1.1 Understand the core competencies (continued)

      CISO Competencies Description
      Communication

      Many CISOs believe that using technical jargon impresses their business stakeholders – in fact, it only makes business stakeholders become confused and disinterested. A CISO must have executive communication skills. This involves:

      • Clearly communicating with business leaders in meaningful language (i.e. business, financial, social) that they understand by breaking down the complexities of IT security into simple and relatable concepts.
      • Not using acronyms or technological speak. Easy-to-understand translations will go a long way.
      • Strong public speaking and presentation abilities.
      Technical Knowledge

      A CISO must have a broad technical understanding of IT security to oversee a successful security program. This includes:

      • Understanding key security and general IT technologies and processes.
      • Assembling a complementary team, because no individual can have deep knowledge in all areas.
      • Maintaining continuing education to stay on top of emerging technologies and threats.

      1.1 Understand the core competencies (continued)

      CISO Competencies Description
      Innovative Problem Solving

      A good CISO doesn’t just say “no,” but rather finds creative ways to say “yes.” This can include:

      • Taking an active role in seizing opportunities created by emerging technologies.
      • Facilitating the secure implementation of new, innovative revenue models.
      • Developing solutions for complex business problems that require creativity and ingenuity.
      • Using information and technology to drive value around the customer experience.
      Vendor Management

      With the growing use of “anything as a service,” negotiation, vendor, and financial management skills are critical to becoming a strategic CISO.

      • The CISO must be able to evaluate service offerings and secure favorable contracts with the right provider. It is about extracting the maximum value from vendors for the dollars you are spending.
      • Vendor products must be aligned with future business plans to create maximum ongoing value.
      • The CISO must develop financial management skills. This includes the ability to calculate total cost of ownership, return on investment, and project spending over multiyear business plans.

      1.1 Understand the core competencies (continued)

      CISO Competencies Description
      Change Management

      A world-class CISO improves security processes by being an agent of change for the organization. This involves:

      • Leading, guiding, and motivating teams to adopt a responsible risk management culture.
      • Communicating important and complex ideas in a persuasive way.
      • Demonstrating an ability to change themselves and taking the initiative in adopting more efficient behaviors.
      • Handling unplanned change, such as unforeseen attacks or personnel changes, in a professional and proactive manner.
      Collaboration

      A CISO must be able to use alliances and partnerships strategically to benefit both the business and themselves. This includes:

      • Identifying formal and informal networks and constructive relationships to enable security development.
      • Leveraging stakeholders to influence positive outcomes for the organization.
      • Getting out of the IT or IT security sphere and engaging relationships in diverse areas of the organization.

      Step 1.2

      Evaluate satisfaction and alignment between the business and IT security

      Activities

      • Conduct the Information Security Business Satisfaction and Alignment diagnostic
      • Use your results as input into the CISO Core Competency Evaluation Tool

      This step involves the following participants:

      • CEO or other executive seeking to hire/develop a CISO

      or

      • Current CISO seeking to upgrade capabilities

      Outcomes of this step
      Determine current gaps in satisfaction and alignment between information security and your organization.

      If seeking to hire/develop a CISO: Your diagnostic results will help develop a profile of the ideal CISO candidate to use as a hiring and interview guide.

      If developing a current CISO, use your diagnostic results to identify existing competency gaps and target them for improvement.

      For the CISO seeking to upgrade capabilities: Use the core competencies guide to self-assess and identify competencies that require improvement.

      Launch

      1.2 Get started by conducting Info-Tech’s Information Security Business Satisfaction and Alignment diagnostic

      Suggested Time: One week for distribution, completion, and collection of surveys
      One-hour follow-up with an Info-Tech analyst

      The primary goal of IT security is to protect the organization from threats. This does not simply mean bolting everything down, but it means enabling business processes securely. To do this effectively requires alignment between IT security and the overall business.

      • Once you have completed the diagnostic, call Info-Tech to review your results with one of our analysts.
      • The results from this assessment will provide insights to inform your entries in the CISO Core Competency Evaluation Tool.

      Call an analyst to review your results and provide you with recommendations.

      Info-Tech Insight
      Focus on the high-priority competencies for your organization. You may find a candidate with perfect 10s across the board, but a more pragmatic strategy is to find someone with strengths that align with your needs. If there are other areas of weakness, then target those areas for development.

      1.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to understand your organizational needs

      After completing the Info-Tech diagnostic, use the CISO Core Competency Evaluation Tool to determine which CISO competencies are a priority for your organization.

      • Your diagnostic results will indicate where your information security program is aligned well or poorly with your business.
      • For example, the diagnostic may show significant misalignment between information security and executives over the level of external compliance. The CISO behavior that would contribute to solving this is aligning security enablement with business requirements.
        • This misalignment may be due to a misunderstanding by either party. The competencies that will contribute to resolving this are communication, technical knowledge, and business acumen.
        • This mapping method is what will be used to determine which competencies are most important for your needs at the present moment.

      Download the CISO Core Competency Evaluation Tool

      1.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to understand your organizational needs

      After completing the Info-Tech diagnostic, use the CISO Core Competency Evaluation Tool to determine which CISO competencies are a priority for your organization.

      1. Starting on Tab 2: CISO Core Competencies, use your understanding of each competency from section 1.1 along with the definitions described in the tool.
        • For each competency, assign a degree of importance using the drop-down menu in the second column from the right.
        • Importance ratings will range from not at all important at the low end to critically important at the high end.
        • Your importance score will be influenced by several factors, including:
          • The current alignment of your information security department.
          • Your organizational security posture.
          • The size and structure of your organization.
          • The existing skills and maturity within your information security department.

      Download the CISO Core Competency Evaluation Tool

      1.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to understand your organizational needs

      After completing the Info-Tech diagnostic, use the CISO Core Competency Evaluation Tool to determine which CISO competencies are a priority for your organization.

      1. Still on Tab 2. CISO Core Competencies, you will now assign a current level of effectiveness for each competency.
        • This will range from foundational at a low level of effectiveness up to capable, then inspirational, and at the highest rating, transformational.
        • Again, this rating will be very specific to your organization, depending on your structure and your current employees.
        • Fundamentally, these scores will reflect what you want to improve in the area of information security. This is not an absolute scale, and it will be influenced by what skills you want to support your goals and direction as an organization.

      Download the CISO Core Competency Evaluation Tool

      Phase 2

      Assess

      Phase 1
      1.1 Understand Core Competencies
      1.2 Measure Security and Business Satisfaction and Alignment

      Phase 2
      2.1 Assess Stakeholder Relationships
      2.2 Assess the Core Competencies

      Phase 3
      3.2 Plan Approach to Improve Stakeholder Relationships

      Phase 4
      4.1 Decide Next Actions and Support Your CISO Moving Forward
      4.2 Regularly Reassess to Measure Development and Progress

      This phase will walk you through the following activities:

      • Use the CISO Core Competency Evaluation Tool to create and implement an interview guide.
      • Assess and analyze the core competencies of your prospective CISOs. Or, if you are a current CISO, use the CISO Core Competency Evaluation Tool as a self-analysis and identify areas for personal development.
      • Evaluate the influence, impact, and support of key executive business stakeholders using the CISO Stakeholder Power Map Template.

      Hire or Develop a World-Class CISO

      Case study

      Mark Lester
      InfoSec Manager, SC Ports Authority

      The new Security Manager engages with employees to learn the culture.

      Outcome: Understand what is important to individuals in order to create effective collaboration. People will engage with a project if they can relate it to something they value.

      Actions Next Steps
      • The Security Manager determines that he must use low-cost small wins to integrate with the organizational culture and create trust and buy-in and investment will follow.
      • The Security Manager starts a monthly newsletter to get traction across the organization, create awareness of his mandate to improve information security, and establish himself as a trustworthy partner.
      • The Security Manager will identify specific ways to engage and change the culture.
      • Create a persuasive case for investing in information security based on what resonates with the organization.

      Follow this case study throughout the deck to see this organization’s results

      Step 2.1

      Identify key stakeholders for the CISO and assess current relationships

      Activities

      Evaluate the power, impact, and support of key stakeholders

      This step involves the following participants:

      • CEO or other executive seeking to hire/develop a CISO

      or

      • Current CISO seeking to upgrade capabilities

      Outcomes of this step

      • Power map of executive business stakeholders
      • Evaluation of each stakeholder in terms of influence, impact, and current level of support

      Assess

      Identify key stakeholders who own business processes that intersect with security processes

      Info-Tech Insight
      Most organizations don’t exist for the sole purpose of doing information security. For example, if your organization is in the business of selling pencils, then information security is in business to enable the selling of pencils. All the security in the world is meaningless if it doesn’t enable your primary business processes. The CISO must always remember the fundamental goals of the business.

      The above insight has two implications:

      1. The CISO needs to understand the key business processes and who owns them, because these are the people they will need to collaborate with. Like any C-level, the CISO should be one of the most knowledgeable people in the organization regarding business processes.
      2. Each of these stakeholders stands to win or lose depending on the performance of their process, and they can act to either block or enable your progress.
        • To work effectively with these stakeholders, you must learn what is important to them, and pose your initiatives so that you both benefit.

      When people are not receptive to the CISO, it’s usually because the CISO has not been part of the discussion when plans were being made. This is the heart of proactivity.

      You need to be involved from the start … from the earliest part of planning.

      The job is not to come in late and say “No” ... the job is to be involved early and find creative and intelligent ways to say “Yes.”

      The CISO needs to be the enabling security asset that drives business.

      – Elliot Lewis, CEO at Keyavi Data

      Evaluate the importance of business stakeholders and the support necessary from them

      The CISO Stakeholder Power Map Template is meant to provide a visualization of the CISO’s relationships within the organization. This should be a living document that can be updated throughout the year as relationships develop and the structure of an organization changes.

      At a glance, this tool should show:

      • How influential each stakeholder is within the company.
      • How supportive they currently are of the CISO’s initiatives.
      • How strongly each person is impacted by IT security activities.

      Once this tool has been created, it provides a good reference as the CISO works to develop lagging relationships. It shows the landscape of influence and impact within the organization, which may help to guide the CISO’s strategy in the future.

      Evaluate the importance of business stakeholders and the support necessary from them

      Download the CISO Stakeholder Power Map Template

      Evaluate the importance of business stakeholders and the support necessary from them

      1. Identify key stakeholders.
        1. Focus on owners of important business processes.
      2. Evaluate and map each stakeholder in terms of:
        1. Influence (up/down)
        2. Support (left/right)
        3. Impact (size of circle)
        4. Involvement (color of circle)
      3. Decide whether the level of support from each stakeholder needs to change to facilitate success.

      Evaluate the importance of business stakeholders and the support necessary from them

      Info-Tech Insight
      Some stakeholders must work closely with your incoming CISO. It is worth consideration to include these individuals in the interview process to ensure you will have partners that can work well together. This small piece of involvement early on can save a lot of headache in the future.

      Where can you find your desired CISO?

      Once you know which competencies are a priority in your new CISO, the next step is to decide where to start looking. This person may already exist in your company.

      Internal

      Take some time to review your current top information security employees or managers. It may be immediately clear that certain people will or will not be suitable for the CISO role. For those that have potential, proceed to Step 2.2 to map their competencies.

      Recruitment

      If you do not have any current employees that will fit your new CISO profile, or you have other reasons for wanting to bring in an outside individual, you can begin the recruitment process. This could start by posting the position for applications or by identifying and targeting specific candidates.

      Ready to start looking for your ideal candidate? You can use Info-Tech’s Chief Information Security Officer job description template.

      Use the CISO job description template

      Alternatives to hiring a CISO

      Small organizations are less able to muster the resources required to find and retain a CISO,

      Technical Counselor Seat

      In addition to having access to our research and consulting services, you can acquire a Technical Counselor Seat from our Security & Risk practice, where one of our senior analysts would serve with you on a retainer. You may find that this option saves you the expense of having to hire a new CISO altogether.

      Virtual CISO

      A virtual CISO, or vCISO, is essentially a “CISO as a service.” A vCISO provides an organization with an experienced individual that can, on a part-time basis, lead the organization’s security program through policy and strategy development.

      Why would an organization consider a vCISO?

      • A vCISO can provide services that are flexible, technical, and strategic and that are based on the specific requirements of the organization.
      • They can provide a small organization with program maturation within the organization’s resources.
      • They can typically offer depth of experience beyond what a small business could afford if it were to pursue a full-time CISO.

      Source: InfoSec Insights by Sectigo Store

      Why would an organization not consider a vCISO?

      • The vCISO’s attention is divided among their other clients.
      • They won’t feel like a member of your organization.
      • They won’t have a deep understanding of your systems and processes.

      Source: Georgia State University

      Step 2.2

      Assess CISO candidates and evaluate their current competency

      Activities

      Assess CISO candidates in terms of desired core competencies

      or

      Self-assess your personal core competencies

      This step involves the following participants:

      • CEO or other executive seeking to hire/develop a CISO

      or

      • Current CISO seeking to upgrade capabilities

      and

      • Any key stakeholders or collaborators you choose to include in the assessment process

      Outcomes of this step

      • You have assessed your requirements for a CISO candidate.
      • The process of hiring is under way, and you have decided whether to hire a CISO, develop a CISO, or consider a Counselor Seat as another option.

      Assess

      2.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to assess your CISO candidate

      Use Info-Tech’s CISO Core Competency Evaluation Tool to assess your CISO candidate

      Download the CISO Core Competency Evaluation Tool

      Info-Tech Insight
      The most important competencies should be your focus. Unless you are lucky enough to find a candidate that is perfect across the board, you will see some areas that are not ideal. Don’t forget the importance you assigned to each competency. If a candidate is ideal in the most critical areas, you may not mind that some development is needed in a less important area.

      2.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to evaluate your candidates

      After deciding the importance of and requirements for each competency in Phase 1, assess your CISO candidates.

      Your first pass on this tool will be to look at internal candidates. This is the develop a CISO option.

      1. In the previous phase, you rated the Importance and Current Effectiveness for each competency in Tab 2. CISO Core Competencies. In this step, use Tab 3. Gap Analysis to enter a Minimum Level and a Desired Level for each competency. Keep in mind that it may be unrealistic to expect a candidate to be fully developed in all aspects.
      2. Next, enter a rating for your candidate of interest for each of the eight competencies.
      3. This scorecard will generate an overall suitability score for the candidate. The color of the output (from red to green) indicates the suitability, and the intensity of the color indicates the importance you assigned to that competency.

      Download the CISO Core Competency Evaluation Tool

      2.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to evaluate your candidates

      • If the internal search does not identify a suitable candidate, you will want to expand your search.
      • Repeat the scoring process for external candidates until you find your new CISO.
      • You may want to skip your external search altogether and instead contact Info-Tech for more information on our Counselor Seat options.

      Download the CISO Core Competency Evaluation Tool

      Phase 3

      Plan

      Phase 1
      1.1 Understand Core Competencies
      1.2 Measure Security and Business Satisfaction and Alignment

      Phase 2
      2.1 Assess Stakeholder Relationships
      2.2 Assess the Core Competencies

      Phase 3
      3.1 Identify Resources to Address Competency Gaps
      3.2 Plan Approach to Improve Stakeholder Relationships

      Phase 4
      4.1 Decide Next Actions and Support Your CISO Moving Forward
      4.2 Regularly Reassess to Measure Development and Progress

      This phase will walk you through the following activities:

      • Create a plan to develop your competency gaps.
      • Construct and consider your organizational model.
      • Create plan to cultivate key stakeholder relationships.

      Hire or Develop a World-Class CISO

      Case study

      Mark Lester
      InfoSec Manager, SC Ports Authority

      The new Security Manager changes the security culture by understanding what is meaningful to employees.

      Outcome: Engage with people on their terms. The CISO must speak the audience’s language and express security terms in a way that is meaningful to the audience.

      Actions Next Steps
      • The Security Manager identifies recent events where ransomware and social engineering attacks were successful in penetrating the organization.
      • He uses his newsletter to create organization-wide discussion on this topic.
      • This very personal example makes employees more receptive to the Security Manager’s message, enabling the culture of risk management.
      • The Security Manager will leverage his success in improving the information security culture and awareness to gain support for future initiatives.

      Follow this case study throughout the deck to see this organization’s results

      Step 3.1

      Identify resources for your CISO to remediate competency gaps

      Activities

      Create a plan to remediate competency gaps

      This step involves the following participants:

      • CEO or other executive seeking to hire/develop a CISO
      • The newly hired CISO

      or

      • Current CISO seeking to upgrade capabilities

      Outcomes of this step

      • Identification of core competency deficiencies
      • A plan to close the gaps

      Plan

      3.1 Close competency gaps with Info-Tech’s Cybersecurity Workforce Development Training

      Resources to close competency gaps

      Info-Tech’s Cybersecurity Workforce Training develops critical cybersecurity skills missing within your team and organization. The leadership track provides the same deep coverage of technical knowledge as the analyst track but adds hands-on support and has a focus on strategic business alignment, program management, and governance.

      The program builds critical skills through:

      • Standardized curriculum with flexible projects tailored to business needs
      • Realistic cyber range scenarios
      • Ready-to-deploy security deliverables
      • Real assurance of skill development

      Info-Tech Insight
      Investing in a current employee that has the potential to be a world-class CISO may take less time, effort, and money than finding a unicorn.

      Learn more on the Cybersecurity Workforce Development webpage

      3.1 Identify resources for your CISO to remediate competency gaps

      < 2 hours

      CISO Competencies Description
      Business Acumen

      Info-Tech Workshops & Blueprints

      Actions/Activities

      • Take a business acumen course: Acumen Learning, What the CEO Wants You to Know: Building Business Acumen.
      • Meet with business stakeholders. Ask them to take you through the strategic plan for their department and then identify opportunities where security can provide support to help drive their initiatives.
      • Shadow another C-level executive. Understand how they manage their business unit and demonstrate an eagerness to learn.
      • Pursue an MBA or take a business development course.

      3.1 Identify resources for your CISO to remediate competency gaps (continued)

      < 2 hours

      CISO Competencies Description
      Leadership

      Info-Tech Training and Blueprints

      Action/Activities

      • Communicate your vision for security to your team. You will gain buy-in from your employees by including them in the creation of your program, and they will be instrumental to your success.

      Info-Tech Insight
      Surround yourself with great people. Insecure leaders surround themselves with mediocre employees that aren’t perceived as a threat. Great leaders are supported by great teams, but you must choose that great team first.

      3.1 Identify resources for your CISO to remediate competency gaps (continued)

      < 2 hours

      CISO Competencies Description
      Communication

      Info-Tech Workshops & Blueprints

      Build and Deliver an Optimized IT Update Presentation: Show IT’s value and relevance by dropping the technical jargon and speaking to the business in their terms.

      Master Your Security Incident Response Communications Program: Learn how to talk to your stakeholders about what’s going on when things go wrong.

      Develop a Security Awareness and Training Program That Empowers End Users: Your weakest link is between the keyboard and the chair, so use engaging communication to create positive behavior change.

      Actions/Activities

      Learn to communicate in the language of your audience (whether business, finance, or social), and frame security solutions in terms that are meaningful to your listener.

      Technical Knowledge

      Actions/Activities

      • In many cases, the CISO is progressing from a strong technical background, so this area is likely a strength already.
      • However, as the need for executive skills are being recognized, many organizations are opting to hire a business or operations professional as a CISO. In this case, various Info-Tech blueprints across all our silos (e.g. Security, Infrastructure, CIO, Apps) will provide great value in understanding best practices and integrating technical skills with the business processes.
      • Pursue an information security leadership certification: GIAC, (ISC)², and ISACA are a few of the many organizations that offer certification programs.

      3.1 Identify resources for your CISO to remediate competency gaps (continued)

      < 2 hours

      CISO Competencies Description
      Innovative Problem Solving

      Info-Tech Workshops & Blueprints

      Actions/Activities

      Vendor Management

      Info-Tech Blueprints & Resources

      Actions/Activities

      3.1 Identify resources for your CISO to remediate competency gaps (continued)

      < 2 hours

      CISO Competencies Description
      Change Management

      Info-Tech Blueprints

      Actions/Activities

      • Start with an easy-win project to create trust and support for your initiatives.
      Collaboration

      Info-Tech Blueprints

      Actions/Activities

      • Get out of your office. Have lunch with people from all areas of the business. Understanding the goals and the pains of employees throughout your organization will help you to design effective initiatives and cultivate support.
      • Be clear and honest about your goals. If people know what you are trying to do, then it is much easier for them to work with you on it. Being ambiguous or secretive creates confusion and distrust.

      3.1 Create the CISO’s personal development plan

      • Use Info-Tech’s CISO Development Plan Template to document key initiatives that will close previously identified competency gaps.
      • The CISO Development Plan Template is used to map specific actions and time frames for competency development, with the goal of addressing competency gaps and helping you become a world-class CISO. This template can be used to document:
        • Core competency gaps
        • Security process gaps
        • Security technology gaps
        • Any other career/development goals
      • If you have a coach or mentor, you should share your plan and report progress to that person. Alternatively, call Info-Tech to speak with an executive advisor for support and advice.
        • Toll-Free: 1-888-670-8889

      What you will need to complete this exercise

      • CISO Core Competency Evaluation Tool results
      • Information Security Business Satisfaction and Alignment diagnostic results
      • Insights gathered from business stakeholder interviews

      Step 3.2

      Plan an approach to improve your relationships

      Activities

      • Review engagement strategies for different stakeholder types
      • Create a stakeholder relationship development plan

      This step involves the following participants:

      • CEO or other executive seeking to hire/develop a CISO
      • The newly hired CISO

      or

      • Current CISO seeking to upgrade capabilities

      Outcomes of this step

      • Stakeholder relationship strategy deliverable

      Plan

      Where should the CISO sit?

      Where the CISO sits in the organization can have a big impact on the security program.

      • Organizations with CISOs in the C-suite have a fewer security incidents.1
      • Organizations with CISOs in the C-suite generally have better IT ability.1
      • An organization whose CISO reports to the CIO risks conflict of interest.1
      • 51% of CISOs believe their effectiveness can be hampered by reporting lines.2
      • Only half of CISOs feel like they are in a position to succeed.2

      A formalized security organizational structure assigns and defines the roles and responsibilities of different members around security. Use Info-Tech’s blueprint Implement a Security Governance and Management Program to determine the best structure for your organization.

      Who the CISO reports to, by percentage of organizations3

      Who the CISO reports to, by percentage of organizations

      Download the Implement a Security Governance and Management Program blueprint

      1. Journal of Computer Science and Information
      2. Proofpoint
      3. Heidrick & Struggles International, Inc

      3.2 Make a plan to manage your key stakeholders

      Managing stakeholders requires engagement, communication, and relationship management. To effectively collaborate and gain support for your initiatives, you will need to build relationships with your stakeholders. Take some time to review the stakeholder engagement strategies for different stakeholder types.

      Influence Mediators
      (Satisfy)
      Key Players
      (Engage)
      Spectators
      (Monitor)
      Noisemakers
      (Inform)
      Support for you

      When building relationships, I find that what people care about most is getting their job done. We need to help them do this in the most secure way possible.

      I don’t want to be the “No” guy, I want to enable the business. I want to find to secure options and say, “Here is how we can do this.”

      – James Miller, Information Security Director, Xavier University

      Download the CISO Stakeholder Management Strategy Template

      Key players – Engage

      Goal Action
      Get key players to help champion your initiative and turn your detractors into supporters. Actively involve key players to take ownership.
      Keep It Positive Maintain a Close Relationship
      • Use their positive support to further your objectives and act as your foundation of support.
      • Key players can help you build consensus among other stakeholders.
      • Get supporters to be vocal in your town halls.
      • Ask them to talk to other stakeholders over whom they have influence.
      • Get some quick wins early to gain and maintain stakeholder support and help convert them to your cause.
      • Use their influence and support to help persuade blockers to see your point of view.
      • Collaborate closely. Key players are tuned in to information streams that are important. Their advice can keep you informed and save you from being blindsided.
      • Keep them happy. By definition, these individuals have a stake in your plans and can be affected positively or negatively. Going out of your way to maintain relationships can be well worth the effort.

      Info-Tech Insight
      Listen to your key players. They understand what is important to other business stakeholders, and they can provide valuable insight to guide your future strategy.

      Mediators – Satisfy

      Goal Action
      Turn mediators into key players Increase their support level.
      Keep It Positive Maintain a Close Relationship
      • Make stakeholders part of the conversation by consulting them for input on planning and strategy.
      • Sample phrases:
        • “I’ve heard you have experience in this area. Do you have time to answer a few questions?”
        • “I’m making some decisions and I would value your thoughts. Can I get your perspective on this?”
      • Enhance their commitment by being inclusive. Encourage their support whenever possible.
      • Make them feel acknowledged and solicit feedback.
      • Listen to blockers with an open mind to understand their point of view. They may have valuable insight.
      • Approach stakeholders on their individual playing fields.
        • They want to know that you understand their business perspective.
      • Stubborn mediators might never support you. If consulting doesn’t work, keep them informed of important decision-making points and give them the opportunity to be involved if they choose to be.

      Info-Tech Insight
      Don’t dictate to stakeholders. Make them feel like valued contributors by including them in development and decision making. You don’t have to incorporate all their input, but it is essential that they feel respected and heard.

      Noisemakers – Inform

      Goal Action
      Have noisemakers spread the word to increase their influence. Encourage noisemakers to influence key stakeholders.
      Keep It Positive Maintain a Close Relationship
      • Identify noisemakers who have strong relationships with key stakeholders and focus on them.
        • These individuals may not have decision-making power, but their opinions and advice may help to sway a decision in your favor.
      • Look for opportunities to increase their influence over others.
      • Put effort into maintaining the positive relationship so that it doesn’t dwindle.
      • You already have this group’s support, but don’t take it for granted.
      • Be proactive, pre-emptive, and transparent.
      • Address issues or bad news early and be careful not to exaggerate their significance.
      • Use one-on-one meetings to give them an opportunity to express challenges in a private setting.
      • Show individuals in this group that you are a problem-solver:
        • “The implementation was great, but we discovered problems afterward. Here is what we’re doing about it.”

      Spectators – Monitor

      Goal Action
      Keep spectators content and avoid turning them into detractors. Keep them well informed.
      Keep It Positive Maintain a Close Relationship
      • A hands-on approach is not required with this group.
      • Keep them informed with regular, high-altitude communications and updates.
      • Use positive, exciting announcements to increase their interest in your initiatives.
      • Select a good venue for generating excitement and assessing the mood of spectators.
      • Spectators may become either supporters or blockers. Monitor them closely and keep in touch with them to stop these individuals from becoming blockers.
      • Listen to questions from spectators carefully. View any engagement as an opportunity to increase participation from this group and generate a positive shift in interest.

      3.2 Create the CISO’s stakeholder management strategy

      Develop a strategy to manage key stakeholders in order to drive your personal development plan initiatives.

      • The purpose of the CISO Stakeholder Management Strategy Template is to document the results of the power mapping exercise, create a plan to proactively manage stakeholders, and track the actions taken.
      • Use this in concert with Info-Tech’s CISO Stakeholder Power Map Template to help visualize the importance of key stakeholders to your personal development. You will document:
        • Stakeholder role and type.
        • Current relationship with the stakeholder.
        • Level of power/influence and degree of impact.
        • Current and desired level of support.
        • Initiatives that require the stakeholder’s engagement.
        • Actions to be taken – along with the status and results.

      What you will need to complete this exercise

      • Completed CISO Stakeholder Power Map
      • Security Business Satisfaction and Alignment Diagnostic results

      Download the CISO Stakeholder Management Strategy Template

      Phase 4

      Execute

      Phase 1
      1.1 Understand Core Competencies
      1.2 Measure Security and Business Satisfaction and Alignment

      Phase 2
      2.1 Assess Stakeholder Relationships
      2.2 Assess the Core Competencies

      Phase 3
      3.1 Identify Resources to Address Competency Gaps
      3.2 Plan Approach to Improve Stakeholder Relationships

      Phase 4
      4.1 Decide Next Actions and Support Your CISO Moving Forward
      4.2 Regularly Reassess to Measure Development and Progress

      This phase will walk you through the following activities:

      • Populate the CISO Development Plan Template with appropriate targets and due dates.
      • Set review and reassess dates.
      • Review due dates with CISO.

      Hire or Develop a World-Class CISO

      Case study

      Mark Lester
      InfoSec Manager, SC Ports Authority

      The new Security Manager leverages successful cultural change to gain support for new security investments.

      Outcome: Integrating with the business on a small level and building on small successes will lead to bigger wins and bigger change.

      Actions Next Steps
      • By fostering positive relationships throughout the organization, the Security Manager has improved the security culture and established himself as a trusted partner.
      • In an organization that had seen very little change in years, he has used well developed change management, business acumen, leadership, communication, collaboration, and innovative problem-solving competencies to affect his initiatives.
      • He can now return to the board with a great deal more leverage in seeking support for security investments.
      • The Security Manager will leverage his success in improving the information security culture and awareness to gain support for future initiatives.

      Step 4.1

      Decide next actions and support your CISO moving forward

      Activities

      • Complete the Info-Tech CISO Development Plan Template
      • Create a stakeholder relationship development plan

      This step involves the following participants:

      • CEO or other executive seeking to hire/develop a CISO
      • The newly hired CISO

      or

      • Current CISO seeking to upgrade capabilities

      Outcomes of this step

      Next actions for each of your development initiatives

      Execute

      Establish a set of first actions to set your plan into motion

      The CISO Development Plan Template provides a simple but powerful way to focus on what really matters to execute your plan.

      • By this point, the CISO is working on the personal competency development while simultaneously overseeing improvements across the security program, managing stakeholders, and seeking new business initiatives to engage with. This can be a lot to juggle effectively.
      • Disparate initiatives like these can hinder progress by creating confusion.
      • By distilling your plan down to Subject > Action > Outcome, you immediately restore focus and turn your plans into actionable items.
      • The outcome is most valuable when it is measurable. This makes progress (or lack of it) very easy to track and assess, so choose a meaningful metric.
      Item to Develop
      (competency/process/tech)
      First Action Toward Development
      Desired Outcome, Including a Measurable Indicator

      Download the CISO Development Plan Template

      4.1 Create a CISO development plan to keep all your objectives in one place

      Use Info-Tech’s CISO Development Plan Template to create a quick and simple yet powerful tool that you can refer to and update throughout your personal and professional development initiatives. As instructed in the template, you will document the following:

      Your Item to Develop The Next Action Required The Target Outcome
      This could be a CISO competency, a security process item, a security technology item, or an important relationship (or something else that is a priority). This could be as simple as “schedule lunch with a stakeholder” or “email Info-Tech to schedule a Guided Implementation call.” This part of the tool is meant to be continually updated as you progress through your projects. The strength of this approach is that it focuses your project into simple actionable steps that are easily achieved, rather than looking too far down the road and seeing an overwhelming task ahead. This will be something measurable like “reduce spending by 10%” or “have informal meeting with leaders from each department.”

      Info-Tech Insight
      A good plan doesn’t require anything that is outside of your control. Good measurable outcomes are behavior based rather than state based.
      “Increase the budget by 10%” is a bad goal because it is ultimately reliant on someone else and can be derailed by an unsupportive executive. A better goal is “reduce spending by 10%.” This is something more within the CISO’s control and is thus a better performance indicator and a more achievable goal.

      4.1 Create a CISO development plan to keep all your objectives in one place

      Below you will find sample content to populate your CISO Development Plan Template. Using this template will guide your CISO in achieving the goals identified here.

      The template itself is a metric for assessing the development of the CISO. The number of targets achieved by the due date will help to quantify the CISO’s progress.

      You may also want to include improvements to the organization’s security program as part of the CISO development plan.

      Area for Development Item for Development Next Action Required Key Stakeholders/ Owners Target Outcome Due Date Completed
      Core Competencies:
      Communication
      Executive
      communication
      Take economics course to learn business language Course completed [Insert date] [Y/N]
      Core Competencies:
      Communication
      Improve stakeholder
      relationships
      Email Bryce from finance to arrange lunch Improved relationship with finance department [Insert date] [Y/N]
      Technology Maturity: Security Prevention Identity and access management (IAM) system Call Info-Tech to arrange call on IAM solutions 90% of employees entered into IAM system [Insert date] [Y/N]
      Process Maturity: Response & Recovery Disaster recovery Read Info-Tech blueprint on disaster recovery Disaster recovery and backup policies in place [Insert date] [Y/N]

      Check out the First 100 Days as CISO blueprint for guidance on bringing improvements to the security program

      4.1 Use your action plan to track development progress and inform stakeholders

      • As you progress toward your goals, continually update the CISO development plan. It is meant to be a living document.
      • The Next Action Required should be updated regularly as you make progress so you can quickly jump in and take meaningful actions without having to reassess your position every time you open the plan. This is a simple but very powerful method.
      • To view your initiatives in customizable ways, you can use the drop-down menu on any column header to sort your initiatives (i.e. by due date, completed status, area for development). This allows you to quickly and easily see a variety of perspectives on your progress and enables you to bring upcoming or incomplete projects right to the top.
      Area for Development Item for Development Next Action Required Key Stakeholders/ Owners Target Outcome Due Date Completed
      Core Competencies:
      Communication
      Executive
      communication
      Take economics course to learn business language Course completed [Insert date] [Y/N]
      Core Competencies:
      Communication
      Improve stakeholder
      relationships
      Email Bryce from finance to arrange lunch Improved relationship with finance department [Insert date] [Y/N]
      Technology Maturity: Security Prevention Identity and access management (IAM) system Call Info-Tech to arrange call on IAM solutions 90% of employees entered into IAM system [Insert date] [Y/N]
      Process Maturity: Response & Recovery Disaster recovery Read Info-Tech blueprint on disaster recovery Disaster recovery and backup policies in place [Insert date] [Y/N]

      Step 4.2

      Regularly reassess to track development and progress

      Activities

      Create a calendar event for you and your CISO, including which items you will reassess and when

      This step involves the following participants:

      • CEO or other executive seeking to hire/develop a CISO
      • The newly hired CISO

      or

      • Current CISO seeking to upgrade capabilities

      Outcomes of this step

      Scheduled reassessment of the CISO’s competencies

      Execute

      4.2 Regularly evaluate your CISO’s progress

      < 1 day

      As previously mentioned, your CISO development plan is meant to be a living document. Your CISO will use this as a companion tool throughout project implementation, but periodically it will be necessary to re-evaluate the entire program to assess your progress and ensure that your actions are still in alignment with personal and organizational goals.

      Info-Tech recommends performing the following assessments quarterly or twice yearly with the help of our executive advisors (either over the phone or onsite).

      1. Sit down and re-evaluate your CISO core competencies using the CISO Core Competency Evaluation Tool.
      2. Analyze your relationships using the CISO Stakeholder Power Map Template.
      3. Compare all of these against your previous results to see what areas you have strengthened and decide if you need to focus on a different area now.
      4. Consider your CISO Development Plan Template and decide whether you have achieved your desired outcomes. If not, why?
      5. Schedule your next reassessment, then create a new plan for the upcoming quarter and get started.
      Materials
      • Laptop
      • CISO Development Plan Template
      Participants
      • CISO
      • Hiring executive (possibly)
      Output
      • Complete CISO and security program development plan

      Summary of Accomplishment

      Knowledge Gained

      • Understanding of the competencies contributing to a successful CISO
      • Strategic approach to integrate the CISO into the organization
      • View of various CISO functions from a variety of business and executive perspectives, rather than just a security view

      Process Optimized

      • Hiring of the CISO
      • Assessment and development of stakeholder relationships for the CISO
      • Broad planning for CISO development

      Deliverables Completed

      • IT Security Business Satisfaction and Alignment Diagnostic
      • CISO Core Competency Evaluation Tool
      • CISO Stakeholder Power Map Template
      • CISO Stakeholder Management Strategy Template
      • CISO Development Plan Template

      If you would like additional support, have our analysts guide you through an Info-Tech workshop or Guided Implementation

      Contact your account representative for more information

      workshop@infotech.com
      1-888-670-8889

      Related Info-Tech Research

      Build an Information Security Strategy
      Your security strategy should not be based on trying to blindly follow best practices but on a holistic risk-based assessment that is risk aware and aligns with your business context.

      The First 100 Days as CISO
      Every CISO needs to follow Info-Tech’s five-step approach to truly succeed in their new position. The meaning and expectations of a CISO role will differ from organization to organization and person to person, but the approach to the new position will be relatively the same.

      Implement a Security Governance and Management Program
      Business and security goals should be the same. Businesses cannot operate without security, and security's goal is to enable safe business operations.

      Research Contributors

      • Mark Lester, Information Security Manager, South Carolina State Ports Authority
      • Kyle Kennedy, CISO, CyberSN.com
      • James Miller, Information Security Director, Xavier University
      • Elliot Lewis, Vice President Security & Risk, Info-Tech Research Group
      • Andrew Maroun, Enterprise Security Lead, State of California
      • Brian Bobo, VP Enterprise Security, Schneider National
      • Candy Alexander, GRC Security Consultant, Towerall Inc.
      • Chad Fulgham, Chairman, PerCredo
      • Ian Parker, Head of Corporate Systems Information Security Risk and Compliance, Fujitsu EMEIA
      • Diane Kelly, Information Security Manager, Colorado State Judicial Branch
      • Jeffrey Gardiner, CISO, Western University
      • Joey LaCour, VP & Chief Security, Colonial Savings
      • Karla Thomas, Director IT Global Security, Tower Automotive
      • Kevin Warner, Security and Compliance Officer, Bridge Healthcare Providers
      • Lisa Davis, CEO, Vicinage
      • Luis Brown, Information Security & Compliance Officer, Central New Mexico Community College
      • Peter Clay, CISO, Qlik
      • Robert Banniza, Senior Director IT Center Security, AMSURG
      • Tim Tyndall, Systems Architect, Oregon State

      Bibliography

      Dicker, William. "An Examination of the Role of vCISO in SMBs: An Information Security Governance Exploration." Dissertation, Georgia State University, May 2, 2021. Accessed 30 Sep. 2022.

      Heidrick & Struggles. "2022 Global Chief Information Security Officer (CISO) Survey" Heidrick & Struggles International, Inc. September 6, 2022. Accessed 30 Sep. 2022.

      IBM Security. "Cost of a Data Breach Report 2022" IBM. August 1, 2022. Accessed 9 Nov. 2022.

      Mehta, Medha. "What Is a vCISO? Are vCISO Services Worth It?" Infosec Insights by Sectigo, June 23, 2021. Accessed Nov 22. 2022.

      Milica, Lucia. “Proofpoint 2022 Voice of the CISO Report” Proofpoint. May 2022. Accessed 6 Oct. 2022.

      Navisite. "The State of Cybersecurity Leadership and Readiness" Navisite. November 9, 2021. Accessed 9 Nov. 2022.

      Shayo, Conrad, and Frank Lin. “An Exploration of the Evolving Reporting Organizational Structure for the Chief Information Security Officer (CISO) Function” Journal of Computer Science and Information Technology, vol. 7, no. 1, June 2019. Accessed 28 Sep. 2022.

      Unify a Mixed Methodology Portfolio

      • Buy Link or Shortcode: {j2store}441|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Portfolio Management
      • Parent Category Link: /portfolio-management
      • As portfolio manager, you oversee a portfolio made up of projects using different types of planning and execution methodologies – from traditional Waterfall, to Agile, to hybrid approaches and beyond. The discontinuity between reporting metrics and funding models makes a holistic and perpetually actionable view of the portfolio elusive.
      • Agile’s influence is growing within the organization’s project ecosystem. Even projects that don’t formally use Agile methods often adopt agile tendencies, such as mitigating risk with shorter, more iterative development cycles and increasing collaboration with stakeholders. While this has introduced efficiencies at the project level, it has not translated into business agility, with decision makers still largely playing a passive role in terms of steering the portfolio.
      • Senior management still expects traditional commitments and deadlines, not “sprints” and “velocity.” The reluctance of many Agile purists to adhere to traditional timeline, budget, and scope commitments is not making Agile a particularly popular conversation topic among the organization’s decision-making layer.
      • As portfolio manager, it’s your job to unify these two increasingly fragmented worlds into a unified portfolio.

      Our Advice

      Critical Insight

      • As Agile’s influence grows and project methodologies morph and proliferate, a more engaged executive layer is required than what we see in a traditional portfolio approach. Portfolio owners have to decide what gets worked on at a regular cadence.
      • What’s the difference? In the old paradigm, nobody stopped the portfolio owners from approving too much. Decisions were based on what should be done, rather than what could get done in a given period, with the resources available.
      • The engaged portfolio succeeds by making sure that the right people work on the right things as much as possible. The portfolio owner plays a key, ongoing role in identifying the work that needs to be done, and the portfolio managers optimize the usage of resources.

      Impact and Result

      • Establish universal control points. While the manager of a mixed methodology portfolio doesn’t need to enforce a standardized project methodology, she or he does need to establish universal control points for both intake and reporting at the portfolio level. Use this research to help you define a sustainable process that will work for all types of projects.
      • Scale the approvals process. For a mixed methodology portfolio to work, the organization needs to reconcile different models for approving and starting projects. This blueprint will help you define a right-sized intake process and decision-making paradigm for sprints and project phases alike.
      • Foster ongoing executive engagement. Mixed methodology success is contingent on regular and ongoing executive engagement. Use the tools and templates associated with this blueprint to help get buy-in and commitment upfront, and then to build out portfolio reports and dashboard that will help keep the executive layer informed and engaged long term.

      Unify a Mixed Methodology Portfolio Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should consider an Engaged Agile Portfolio approach, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Get portfolio commitments

      Assess the current state of the portfolio and ensure that portfolio owners and other stakeholders are onboard before you move forward to develop and implement new portfolio processes.

      • Unify a Mixed Methodology Portfolio – Phase 1
      • Mixed Methodology Portfolio Analyzer
      • Mixed Methodology Portfolio Strategy Template
      • Mixed Methodology Portfolio Stakeholder Survey Tool

      2. Define your portfolio processes

      Wireframe standardized portfolio processes for all project methodologies to follow.

      • Unify a Mixed Methodology Portfolio – Phase 2
      • Agile Portfolio Sprint Prioritization Tool
      • Project Methodology Assessment Tool

      3. Implement your processes

      Pilot your new portfolio processes and decision-making paradigm. Then, execute a change impact analysis to inform your communications strategy and implementation plan.

      • Unify a Mixed Methodology Portfolio – Phase 3
      • Process Pilot Plan Template
      • Intake and Prioritization Impact Analysis Tool
      • Resource Management Impact Analysis Tool
      [infographic]

      Workshop: Unify a Mixed Methodology Portfolio

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Assess Current State of the Portfolio

      The Purpose

      Determine the current state of your project execution and portfolio oversight practices.

      Align different types of projects within a unified portfolio.

      Define the best roles and engagement strategies for individual stakeholders as you transition to an Engaged Agile Portfolio.

      Key Benefits Achieved

      A current state understanding of project and portfolio management challenges.

      Bolster the business case for developing an Engaged Agile Portfolio.

      Increase stakeholder and team buy-in.

      Activities

      1.1 Calculate the size of your portfolio in human resource hours.

      1.2 Estimate your project sizes and current project methodology mix.

      1.3 Document the current known status of your in-flight projects.

      1.4 Perform a project execution portfolio oversight survey.

      Outputs

      Your portfolio’s project capacity in resource hours.

      Better understanding of project demand and portfolio mix.

      Current state visibility.

      An objective assessment of current areas of strengths and weaknesses.

      2 Define Your Portfolio Processes

      The Purpose

      Objectively and transparently approve, reject, and prioritize projects.

      Prioritize work to start and stop on a sprint-by-sprint basis.

      Maintain a high frequency of accurate reporting.

      Assess and report the realization of project benefits.

      Key Benefits Achieved

      Improve timeliness and accuracy of project portfolio reporting.

      Make better, faster decisions about when to start and stop work on different projects.

      Increase stakeholder satisfaction.

      Activities

      2.1 Develop a portfolio intake workflow.

      2.2 Develop a prioritization scorecard and process.

      2.3 Establish a process to estimate sprint demand and resource supply.

      2.4 Develop a process to estimate sprint value and necessity.

      Outputs

      An intake workflow.

      A prioritization scorecard and process.

      A process to estimate sprint demand and resource supply.

      A process to estimate sprint value and necessity.

      3 Implement Your Processes

      The Purpose

      Analyze the potential change impacts of your new portfolio processes and how they will be felt across the organization.

      Develop an implementation plan to ensure strategy buy-in.

      Key Benefits Achieved

      A strategic and well-planned approach to process implementation.

      Activities

      3.1 Analyze change impacts of new portfolio processes.

      3.2 Prepare a communications plan based upon change impacts.

      3.3 Develop an implementation plan.

      3.4 Present new portfolio processes to portfolio owners.

      Outputs

      A change impact analysis.

      A communications plan.

      An implementation plan.

      Portfolio strategy buy-in.