Define Your Cloud Vision

Define your cloud vision before it defines you

Analyst perspective

Use the cloud’s strengths. Mitigate its weaknesses.

The cloud isn’t magic. It’s not necessarily cheaper, better, or even available for the thing you want it to do. It’s not mysterious or a cure-all, and it does take a bit of effort to systematize your approach and make consistent, defensible decisions about your cloud services. That’s where this blueprint comes in.

Your cloud vision is the culmination of this effort all boiled down into a single statement: “This is how we want to use the cloud.” That simple statement should, of course, be representative of – and built from – a broader, contextual strategy discussion that answers the following questions: What should go to the cloud? What kind of cloud makes sense? Should the cloud deployment be public, private, or hybrid? What does a migration look like? What risks and roadblocks need to be considered when exploring your cloud migration options? What are the “day 2” activities that you will need to undertake after you’ve gotten the ball rolling?

Taken as a whole, answering these questions is difficult task. But with the framework provided here, it’s as easy as – well, let’s just say it’s easier.

Jeremy Roberts

Research Director, Infrastructure and Operations

Info-Tech Research Group

Executive Summary

Your Challenge

• You are both extrinsically motivated to move to the cloud (e.g. by vendors) and intrinsically motivated by internal digital transformation initiatives.
• You need to define the cloud’s true value proposition for your organization without assuming it is an outsourcing opportunity or will save you money.
• Your industry, once cloud-averse, is now normalizing the use of cloud services, but you have not established a basic cloud vision from which to develop a strategy at a later point.

Common Obstacles

• Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud’s benefits.
• Many organizations have a foot in the cloud already, but these decisions have been made in an ad hoc rather than systematic fashion.
• You lack a consistent framework to assess your workloads’ suitability for the cloud.

Info-Tech's Approach

• Evaluate workloads’ suitability for the cloud using Info-Tech’s methodology to select the optimal migration (or non-migration) path based on the value of cloud characteristics.
• Codify risks tied to workloads’ cloud suitability and plan mitigations.
• Build a roadmap of initiatives for actions by workload and risk mitigation.
• Define a cloud vision to share with stakeholders.

Info-Tech Insight: 1) Base migration decisions on cloud characteristics. If your justification for the migration is simply getting your workload out of the data center, think again. 2) Address the risks up front in your migration plan. 3) The cloud changes roles and calls for different skill sets, but Ops is here to stay.

Your challenge

This research is designed to help organizations who need to:

• Identify workloads that are good candidates for the cloud.
• Develop a consistent, cost-effective approach to cloud services.
• Outline and mitigate risks.
• Define your organization’s cloud archetype.
• Map initiatives on a roadmap.
• Communicate your cloud vision to stakeholders so they can understand the reasons behind a cloud decision and differentiate between different cloud service and deployment models.
• Understand the risks, roadblocks, and limitations of the cloud.

“We’re moving from a world where companies like Oracle and Microsoft and HP and Dell were all critically important to a world where Microsoft is still important, but Amazon is now really important, and Google also matters. The technology has changed, but most of the major vendors they’re betting their business on have also changed. And that’s super hard for people..” –David Chappell, Author and Speaker

Common obstacles

These barriers make this challenge difficult to address for many organizations:

• Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud’s benefits.
• Many organizations already have a foot in the cloud, but the choice to explore these solutions was made in an ad hoc rather than systematic fashion. The cloud just sort of happened.
• The lack of a consistent assessment framework means that some workloads that probably belong in the cloud are kept on premises or with hosted services providers – and vice versa.
• Securing cloud expertise is remarkably difficult – especially in a labor market roiled by the global pandemic and the increasing importance of cloud services.

Standard cloud challenges

30% of all cloud spend is self-reported as waste. Many workloads that end up in the cloud don’t belong there. Many workloads that do belong in the cloud aren’t properly migrated. (Flexera, 2021)

44% of respondents report themselves as under-skilled in the cloud management space. (Pluralsight, 2021)

Info-Tech’s approach

Goals and drivers

• Service model
  • What type of cloud makes the most sense for workload archetypes? When does it make sense to pick SaaS over IaaS, for example?
• Delivery model
  • Will services be delivered over the public cloud, a private cloud, or a hybrid cloud? What challenges accompany this decision?

• Migration Path
  • What does the migration path look like? What does the transition to the cloud look like, and how much effort will be required? Amazon’s 6Rs framework captures migration options: rehosting, repurchasing, replatforming, and refactoring, along with retaining and retiring. Each workload should be assessed for its suitability for one or more of these paths.

• Support model
  • How will services be provided? Will staff be trained, new staff hired, a service provider retained for ongoing operations, or will a consultant with cloud expertise be brought on board for a defined period? The appropriate support model is highly dependent on goals along with expected outcomes for different workloads.

Highlight risks and roadblocks

Formalize cloud vision

Document your cloud strategy

The Info-Tech difference:

1. Determine the hypothesized value of cloud for your organization.
2. Evaluate workloads with 6Rs framework.
3. Identify and mitigate risks.
4. Identify cloud archetype.
5. Plot initiatives on a roadmap.
6. Write action plan statement and goal statement.

What is the cloud, how is it deployed, and how is service provided?

Cloud Characteristics

1. On-demand self-service: the ability to access reosurces instantly without vendor interaction
2. Broad network access: all services delivered over the network
3. Resource pooling: multi-tenant environment (shared)
4. Rapid elasticity: the ability to expand and retract capabilities as needed
5. Measured service: transparent metering

Service Model:

1. Software-as-a-Service: all but the most minor configuration is done by the vendor
2. Platform-as-a-Service: customer builds the application using tools provided by the provider
3. Infrastructure-as-a-Service: the customer manages OS, storage, and the application

Delivery Model

1. Public cloud: accessible to anyone over the internet; multi-tenant environment
2. Private cloud: provisioned for a single organization with multiple units
3. Hybrid cloud: two or more connected clouds; data is portage across them
4. Community cloud: provisioned for a specific group of organizations

(National Institute of Standards and Technology)

A workload-first approach will allow you to take full advantage of the cloud’s strengths

• Under all but the most exceptional circumstances, good cloud strategies will incorporate different service models. Very few organizations are “IaaS shops” or “SaaS shops,” even if they lean heavily in one direction.
• These different service models (including non-cloud options like colocation and on-premises infrastructure) each have different strengths. Part of your cloud strategy should involve determining which of the services makes the most sense for you.
• Own the cloud by understanding which cloud (or non-cloud!) offering makes the most sense for you given your unique context.

Migration paths

In a 2016 blog post, Amazon introduced a framework for understanding cloud migration strategies. The framework presented here is slightly modified – including a “relocate” component rather than a “retire” component – but otherwise hews close to the standard.

These migration paths reflect organizational capabilities and desired outcomes in terms of service models – cloud or otherwise. Retention means keeping the workload where it is, in a datacenter or a colocation service, or relocating to a colocation or hosted software environment. These represent the “non-cloud” migration paths.

In the graphic on the right, the paths within the red box lead to the cloud. Rehosting means lifting and shifting to an infrastructure environment. Migrating a virtual machine from your VMware environment on premises to Azure Virtual machines is a quick way to realize some benefits from the cloud. Migrating from SQL Server on premises to a cloud-based SQL solution looks a bit more like changing platforms (replatforming). It involves basic infrastructure modification without a substantial architectural component.

Refactoring is the most expensive of the options and involves engaging the software development lifecycle to build a custom solution, fundamentally rewriting the solution to be cloud native and take advantage of cloud-native architectures. This can result in a PaaS or an IaaS solution.

Finally, repurchasing means simply going to market and procuring a new solution. This may involve migrating data, but it does not require the migration of components.

Migration Paths

Retain (Revisit)

• Keep the application in its current form, at least for now. This doesn’t preclude revisiting it in the future.

Relocate

• Move the workload between datacenters or to a hosted software/colocation provider.

Rehost

• Move the application to the cloud (IaaS) and continue to run it in more or less the same form as it currently runs.

Replatform

• Move the application to the cloud and perform a few changes for cloud optimizations.

Refactor

• Rewrite the application, taking advantage of cloud-native architectures.

Repurchase

• Replace with an alternative, cloud-native application and migrate the data.

Support model

Support models by characteristic

IT services, including cloud services, can be delivered and managed in multiple ways depending on the nature of the workload and the organization’s intended path forward. Three high-level options are presented here and may be more or less valuable based on the duration of the expected engagement with the service (temporary or permanent), the skills specialization required, and the flexibility necessary to complete the job.

By way of example, a highly technical, short-term project with significant flexibility requirements might be a good fit for an expensive consultant, whereas post-implementation maintenance of a cloud email system requires relatively little specialization and flexibility and would therefore be a better fit for internal management.

There is no universally applicable rule here, but there are some workloads that are generally a good fit for the cloud and others that are not as effective, with that fit being conditional on the appropriate support model being employed.

Risks, roadblocks, and strategy components

No two cloud strategies are exactly alike, but all should address 14 key areas. A key step in defining your cloud vision is an assessment of these strategy components. Lower maturity does not preclude an aggressive cloud strategy, but it does indicate that higher effort will be required to make the transition.

Cloud archetypes – a cloud vision component

Once you understand the value of the cloud, your workloads’ general suitability for cloud, and your proposed risks and mitigations, the next step is to define your cloud archetype.

Your organization’s cloud archetype is the strategic posture that IT adopts to best support the organization’s goals. Info-Tech’s model recognizes seven archetypes, divided into three high-level archetypes.

After consultation with your stakeholders, and based on the results of the suitability and risk assessment activities, define your archetype. The archetype feeds into the overall cloud vision and provides simple insight into the cloud future state for all stakeholders.

The cloud vision itself is captured in a “vision statement,” a short summary of the overall approach that includes the overall cloud archetype.

Info-Tech’s methodology for defining your cloud vision

Insight summary

The cloud may not be right for you – and that’s okay!

Don’t think about the cloud as an inevitable next step for all workloads. The cloud is merely another tool in the toolbox, ready to be used when appropriate and put away when it’s not needed. Cloud first isn’t always the way to go.

Not all clouds are equal

It’s not “should I go to the cloud?” but “what service and delivery models make sense based on my needs and risk tolerance?” Thinking about the cloud as a binary can force workloads into the cloud that don’t belong (and vice versa).

Bottom-up is best

A workload assessment is the only way to truly understand the cloud’s value. Work from the bottom up, not the top down, understand what characteristics make a workload cloud suitable, and strategize on that basis.

Your accountability doesn’t change

You are still accountable for maintaining available, secure, functional applications and services. Cloud providers share some responsibility, but the buck stops where it always has: with you.

Don’t customize for the sake of customization

SaaS providers make money selling the same thing to everyone. When migrating a workload to SaaS, work with stakeholders to pursue standardization around a selected platform and avoid customization where possible.

Best of both worlds, worst of both worlds

Hybrid clouds are in fashion, but true hybridity comes with additional cost, administration, and other constraints. A convoy moves at the speed of its slowest member.

The journey matters as much as the destination

How you get there is as important as what “there” actually is. Any strategy that focuses solely on the destination misses out on a key part of the value conversation: the migration strategy.

Blueprint benefits

Cloud Vision Executive Presentation

This presentation captures the results of the exercises and presents a complete vision to stakeholders including a desired target state, a rubric for decision making, the results of the workload assessments, and an overall risk profile.

Cloud Vision Workbook

This workbook includes the standard cloud workload assessment questionnaire along with the results of the assessment. It also includes the milestone timeline for the implementation of the cloud vision.

Blueprint benefits

IT Benefits

• A consistent approach to the cloud takes the guesswork out of deployment decisions and makes it easier for IT to move on to the execution stage.
• When properly incorporated, cloud services come with many benefits, including automation, elasticity, and alternative architectures (micro-services, containers). The cloud vision project will help IT readers articulate expected benefits and work towards achieving them.
• A clear framework for incorporating organizational goals into cloud plans.

Business benefits

• Simple, well-governed access to high-quality IT resources.
• Access to the latest and greatest in technology to facilitate remote work.
• Framework for cost management in the cloud that incorporates OpEx and chargebacks/showbacks. A clear understanding of expected changes to cost modeling is also a benefit of a cloud vision.
• Clarity for stakeholders about IT’s response (and contribution to) IT strategic initiatives.

Measure the value of this blueprint

Don’t take our word for it:

• The cloud vision material in various forms has been offered for several years, and members have generally benefited substantially, both from cloud vision workshops and from guided implementations led by analysts.
• After each engagement, we send a survey that asks members how they benefited from the experience. Of 30 responses, the cloud vision research has received an average score of 9.8/10. Real members have found significant value in the process.
• Additionally, members reported saving between 2 and 120 days (for an average of 17), and financial savings ranged from $1,920 all the way up to $1.27 million, for an average of $170,577.90! If we drop outliers on both ends, the average reported value of a cloud vision engagement is $37, 613.
• Measure the value by calculating the time saved from using Info-Tech’s framework vs. a home-brewed cloud strategy alternative and by comparing the overall cost of a guided implementation or workshop with the equivalent offering from another firm. We’re confident you’ll come out ahead.

9.8/10 Average reported satisfaction

17 Days Average reported time savings

$37, 613 Average cost savings (adj.)

Executive Brief Case Study

Industry: Financial

Source: Info-Tech workshop

Anonymous financial institution

A small East Coast financial institution was required to develop a cloud strategy. This strategy had to meet several important requirements, including alignment with strategic priorities and best practices, along with regulatory compliance, including with the Office of the Comptroller of the Currency.

The bank already had a significant cloud footprint and was looking to organize and formalize the strategy going forward.

Leadership needed a comprehensive strategy that touched on key areas including the delivery model, service models, individual workload assessments, cost management, risk management and governance. The output had to be consumable by a variety of audiences with varying levels of technical expertise and had to speak to IT’s role in the broader strategic goals articulated earlier in the year.

Results

The bank engaged Info-Tech for a cloud vision workshop and worked through four days of exercises with various IT team members. The bank ultimately decided on a multi-cloud strategy that prioritized SaaS while also allowing for PaaS and IaaS solutions, along with some non-cloud hosted solutions, based on organizational circumstances.

Bank cloud vision

[Bank] will provide innovative financial and related services by taking advantage of the multiplicity of best-of-breed solutions available in the cloud. These solutions make it possible to benefit from industry-level innovations, while ensuring efficiency, redundancy, and enhanced security.

Bank cloud decision workflow

• SaaS
  • Platform?
    • Yes
      • PaaS
    • No
      • Hosted
    • IaaS
      • Other

Non-cloud

Cloud

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

"Our team has already made this crticial project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation

"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

Workshop

"We need to hit the ground running and get this project kicked off imediately. Our team has the ability to take this over once we get a framework and strategy in place."

Consulting

"Our team does not have the time or the knowledge the take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

Phase 1

• Call #1: Discuss current state, challenges, etc.
• Call #2: Goals, drivers, and current state.

Phase 2

• Call #3: Conduct cloud suitability assessment for selected workloads.

Phase 3

• Call #4: Generate and categorize risks.
• Call #5: Begin the risk mitigation conversation.

Phase 4

• Call #6: Complete the risk mitigation process
• Call #7: Finalize vision statement and cloud decision framework.

Workshop Overview

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

Understand the cloud

Build the foundations of your cloud vision

Phase 1

Phase 1

Understand the Cloud

Phase 1

1.1 Generate goals and drivers

1.2 Explore cloud characteristics

1.3 Create a current state summary

1.4 Select workloads for analysis

Phase 2

2.1 Conduct workload assessments

2.2 Determine workload future states

Phase 3

3.1 Generate risks and roadblocks

3.2 Mitigate risks and roadblocks

3.3 Define roadmap initiatives

Phase 4

4.1 Review and assign work items

4.2 Finalize cloud decision framework

4.3 Create cloud vision

This phase will walk you through the following activities:

1.1.1 Generate organizational goals

1.1.2 Define cloud drivers

1.1.3 Define success indicators

1.3.1 Record your current state

1.4.1 Select workloads for further assessment

This phase involves the following participants:

IT management, the core working group, security, infrastructure, operations, architecture, engineering, applications, non-IT stakeholders.

It starts with shared understanding

Stakeholders must agree on overall goals and what “cloud” means

The cloud is a nebulous term that can reasonably describe services ranging from infrastructure as a service as delivered by providers like Amazon Web Services and Microsoft through its Azure platform, right up to software as a service solutions like Jira or Salesforce. These solutions solve different problems – just because your CRM would be a good fit for a migration to Salesforce doesn’t mean the same system would make sense in Azure or AWS.

This is important because the language we use to talk about the cloud can color our approach to cloud services. A “cloud-first” strategy will mean something different to a CEO with a concept of the cloud rooted in Salesforce than it will to a system administrator who interprets it to mean a transition to cloud-hosted virtual machines.

Add to this the fact that not all cloud services are hosted externally by providers (public clouds) and the fact that multiple delivery models can be engaged at once through hybrid or multi-cloud approaches, and it’s apparent that a shared understanding of the cloud is necessary for a coherent strategy to take form.

This phase proceeds in four steps, each governed by the principle of shared understanding. The first requires a shared understanding of corporate goals and drivers. Step 2 involves coming to a shared understanding of the cloud’s unique characteristics. Step 3 requires a review of the current state. Finally, in Step 4, participants will identify workloads that are suitable for analysis as candidates for the cloud.

Step 1.1

Generate goals and drivers

Activities

1.1.1 Define organizational goals

1.1.2 Define cloud drivers

1.1.3 Define success indicators

Generate goals and drivers

Explore cloud characteristics

Create a current state summary

Select workloads for analysis

This step involves the following participants:

• IT management
• Core working group
• Security
• Applications
• Infrastructure
• Service management
• Leadership

Outcomes of this step

• List of organizational goals
• List of cloud drivers
• Defined success indicators

What can the cloud do for you?

The cloud is not valuable for its own sake, and not all users derive the same value

• The cloud is characterized by on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Any or all of those characteristics might be enough to make the cloud appealing, but in most cases, there is an overriding driver.
• Multiple paths may lead to the cloud. Consider an organization with a need to control costs by showing back to business units, or perhaps by reducing capital expenditure – the cloud may be the most appropriate way to effect these changes. Conversely, an organization expanding rapidly and with a need to access the latest and greatest technology might benefit from the elasticity and pooled resources that major cloud providers can offer.
• In these cases, the destination might be the same (a cloud solution) but the delivery model – public, private, or hybrid – and the decisions made around the key strategy components, including architecture, provisioning, and cost management, will almost certainly be different.
• Defining goals, understanding cloud drivers, and – crucially – understanding what success means, are all therefore essential elements of the cloud vision process.

1.1.1 Generate organizational goals

1-3 hours

Input

• Strategy documentation

Output

• Organizational goals

Materials

• Whiteboard (digital/physical)

Participants

• IT leadership
• Infrastructure
• Applications
• Security

1. As a group, brainstorm organizational goals, ideally based on existing documentation
   • Review relevant corporate and IT strategies.
   • If you do not have access to internal documentation, review the standard goals on the next slide and select those that are most relevant for you.
2. Record the most important business goals in the Cloud Vision Executive Presentation. Include descriptions where possible to ensure wide readability.
3. Make note of these goals. They should inform the answers to prompts offered in the Cloud Vision Workbook and should be a consistent presence in the remainder of the visioning exercise. If you’re conducting the session in person, leave the goals up on a whiteboard and make reference to them throughout the workshop.

Cloud Vision Executive Presentation

Standard COBIT 19 enterprise goals

1. Portfolio of competitive products and services
2. Managed business risk
3. Compliance with external laws and regulations
4. Quality of financial information
5. Customer-oriented service culture
6. Business service continuity and availability
7. Quality of management information
8. Optimization of internal business process functionality
9. Optimization of business process costs
10. Staff skills, motivation, and productivity
11. Compliance with internal policies
12. Managed digital transformation programs
13. Product and business innovation

1.1.2 Define cloud drivers

30-60 minutes

Input

• Organizational goals
• Strategy documentation
• Management/staff perspective

Output

• List of cloud drivers

Materials

• Sticky notes
• Whiteboard
• Markers

Participants

• IT leadership
• Infrastructure
• Applications
• Security

1. Cloud drivers sit at a level of abstraction below organizational goals. Keeping your organizational goals in mind, have each participant in the session write down how they expect to benefit from the cloud on a sticky note.
2. Solicit input one at a time and group similar responses. Encourage participants to bring forward their cloud goals even if similar goals have been mentioned previously. The number of mentions is a useful way to gauge the relative weight of the drivers.
3. Once this is done, you should have a few groups of similar drivers. Work with the group to name each category. This name will be the driver reported in the documentation.
4. Input the results of the exercise into the Cloud Vision Executive Presentation, and include descriptions based on the constituent drivers. For example, if a driver is titled “do more valuable work,” the constituent drivers might be “build cloud skills,” “focus on core products,” and “avoid administration work where possible.” The description would be based on these components.

Cloud Vision Executive Presentation

1.1.3 Define success indicators

1 hour

Input

• Cloud drivers
• Organizational goals

Output

• List of cloud driver success indicators

Materials

• Whiteboard
• Markers

Participants

• IT leadership
• Infrastructure
• Applications
• Security

1. On a whiteboard, draw a table with each of the cloud drivers (identified in 1.1.2) across the top.
2. Work collectively to generate success indicators for each cloud driver. In this case, a success indicator is some way you can report your progress with the stated driver. It is a real-world proxy for the sometimes abstract phenomena that make up your drivers. Think about what would be true if your driver was realized.
   1. For example, if your driver is “faster access to resources,” you might consider indicators like developer satisfaction, project completion time, average time to provision, etc.
3. Once you are satisfied with your list of indicators, populate the slide in the Cloud Vision Executive Presentation for validation from stakeholders.

Cloud Vision Executive Presentation

Step 1.2

Explore cloud characteristics

Activities

Understand the value of the cloud:

• Review delivery models
• Review support models
• Review service models
• Review migration paths

Understand the Cloud

Generate goals and drivers

Explore cloud characteristics

Create a current state summary

Select workloads for analysis

This step involves the following participants:

• Core working group
• Architecture
• Engineering
• Security

Outcomes of this step

• Understanding of cloud service models and value

Defining the cloud

Per NIST, the cloud has five fundamental characteristics. All clouds have these characteristics, even if they are executed in somewhat different ways between delivery models, service models, and even individual providers.

Cloud characteristics

On-demand self-service

Cloud customers are capable of provisioning cloud resources without human interaction (e.g. contacting sales), generally through a web console.

Broad network access

Capabilities are designed to be delivered over a network and are generally intended for access by a wide variety of platform types (cloud services are generally device-agnostic).

Resource pooling

Multiple customers (internal, in the case of private clouds) make use of a highly abstracted shared infrastructure managed by the cloud provider.

Rapid elasticity

Customers are capable of provisioning additional resources as required, pulling from a functionally infinite pool of capacity. Cloud resources can be spun-down when no longer needed.

Measured service

Consumption is metered based on an appropriate unit of analysis (number of licenses, storage used, compute cycles, etc.) and billing is transparent and granular.

Cloud delivery models

The NIST definition of cloud computing outlines four cloud delivery models: public, private, hybrid, and community clouds. A community cloud is like a private cloud, but it is provisioned for the exclusive use of a like-minded group of organizations, usually in a mutually beneficial, non-competitive arrangement. Universities and hospitals are examples of organizations that can pool their resources in this way without impacting competitiveness. The Info-Tech model covers three key delivery models – public, private, and hybrid, and an overarching model (multi-cloud) that can comprise more than one of the other models – public + public, public + hybrid, etc.

Public

The cloud service is provisioned for access by the general public (customers).

Private

A private cloud has the five key characteristics, but is provisioned for use by a single entity, like a company or organization.

Hybrid

Hybridity essentially refers to interoperability between multiple cloud delivery models (public +private).

Multi

A multi-cloud deployment requires only that multiple clouds are used without any necessary interoperability (Nutanix, 2019).

Public cloud

This is what people generally think about when they talk about cloud

• The public cloud is, well, public! Anyone can make use of its resources, and in the case of the major providers, capacity is functionally unlimited. Need to store exabytes of data in the cloud? No problem! Amazon will drive a modified shipping container to your datacenter, load it up, and “migrate” it to a datacenter.
• Public clouds offer significant variety on the infrastructure side. Major IaaS providers, like Microsoft and Amazon, offer dozens of services across many different categories including compute, networking, and storage, but also identity, containers, machine learning, virtual desktops, and much, much more. (See a list from Microsoft here, and Amazon here)
• There are undoubtedly strengths to the public cloud model. Providers offer the “latest and greatest” and customers need not worry about the details, including managing infrastructure and physical locations. Providers offer built-in redundancy, multi-regional deployments, automation tools, management and governance solutions, and a variety of leading-edge technologies that would not be feasible for organizations to run in-house, like high performance compute, blockchain, or quantum computing.
• Of course, the public cloud is not all sunshine and rainbows – there are downsides as well. It can be expensive; it can introduce regulatory complications to have to trust another entity with your key information. Additionally, there can be performance hiccups, and with SaaS products, it can be difficult to monitor at the appropriate (per-transaction) level.

Prominent examples include:

AWS

Microsoft

Azure

Salesforce.com

Workday

SAP

Private cloud

A lower-risk cloud for cloud-averse customers?

• A cloud is a cloud, no matter how small. Some IT shops deploy private clouds that make use of the five key cloud characteristics but provisioned for the exclusive use of a single entity, like a corporation.
• Private clouds have numerous benefits. Some potential cloud customers might be uncomfortable with the shared responsibility that is inherent in the public cloud. Private clouds allow customers to deliver flexible, measured services without having to surrender control, but they require significant overhead, capital expenditure, administrative effort, and technical expertise.
• According to the 2021 State of the Cloud Report, private cloud use is common, and the most frequently cited toolset is VMware vSphere, followed by Azure Stack, OpenStack, and AWS Outposts. Private cloud deployments are more common in larger organizations, which makes sense given the overhead required to manage such an environment.

Private cloud adoption

VMware and Microsoft lead the pack among private cloud customers, with Amazon and Red Hat also substantially present across private cloud environments.

Hybrid cloud

The best of both worlds?

Hybrid cloud architectures combine multiple cloud delivery models and facilitate some level of interoperability. NIST suggests bursting and load balancing as examples of hybrid cloud use cases. Note: it is not sufficient to simply have multiple clouds running in parallel – there must be a toolset that allows for an element of cross-cloud functionality.

This delivery model is attractive because it allows users to take advantage of the strengths of multiple service models using a single management pane. Bursting across clouds to take advantage of additional capacity or disaster recovery capabilities are two obvious use cases that appeal to hybrid cloud users.

But while hybridity is all the rage (especially given the impact Covid-19 has had on the workplace), the reality is that any hybrid cloud user must take the good with the bad. Multiple clouds and a management layer can be technically complex, expensive, and require maintaining a physical infrastructure that is not especially valuable (“I thought we were moving to the cloud to get out of the datacenter!”).

Before selecting a hybrid approach through services like VMware Cloud on AWS or Microsoft’s Azure Stack, consider the cost, complexity, and actual expected benefit.

Amazon, Microsoft, and Google dominate public cloud IaaS, but IBM is betting big on hybrid cloud:

With its acquisition of Red Hat in 2019 for $34 billion, Big Blue put its money where its mouth is and acquired a substantial hybrid cloud business. At the time of the acquisition, Red Hat’s CEO, Jim Whitehurst, spoke about the benefit IBM expected to receive:

“Joining forces with IBM gives Red Hat the opportunity to bring more open source innovation to an even broader range of organizations and will enable us to scale to meet the need for hybrid cloud solutions that deliver true choice and agility” (Red Hat, 2019).

Multi-cloud

For most organizations, the multi-cloud is the most realistic option.

Multi-cloud is popular!

Multi-cloud solutions exist at a different layer of abstraction from public, private, and even hybrid cloud delivery models. A multi-cloud architecture, as the name suggests, requires the user to be a customer of more than one cloud provider, and it can certainly include a hybrid cloud deployment, but it is not bound by the same rules of interoperability.

Many organizations – especially those with fewer resources or a lack of a use case for a private cloud – rely on a multi-cloud architecture to build applications where they belong, and they manage each environment separately (or occasionally with the help of cloud management platforms).

If your data team wants to work in AWS and your enterprise services run on basic virtual machines in Azure, that might be the most effective architecture. As the Flexera 2021 State of the Cloud Report suggests, this architecture is far more common than the more complicated bursting or brokering architectures characteristic of hybrid clouds.

NIST cloud service models

Software as a service

SaaS has exploded in popularity with consumers who wish to avail themselves of the cloud’s benefits without having to manage underlying infrastructure components. SaaS is simple, generally billed per-user per-month, and is almost entirely provider-managed.

Platform as a service

PaaS providers offer a toolset for their customers to run custom applications and services without the requirement to manage underlying infrastructure components. This service model is ideal for custom applications/services that don’t benefit from highly granular infrastructure control.

Infrastructure as a service

IaaS represents the sale of components. Instead of a service, IaaS providers sell access to components, like compute, storage, and networking, allowing for customers to build anything they want on top of the providers’ infrastructure.

Cloud service models

• This research focuses on five key service models, each of which has its own strengths and weaknesses. Moving right from “on-prem,” customers gradually give up more control over their environments to cloud service providers.
• An entirely premises-based environment means that the customer is responsible for everything ranging from the dirt under the datacenter to application-level configurations. Conversely, in a SaaS environment, the provider is responsible for everything but those top-level application configurations.
• A managed service provider or other third party can manage any or of the components of the infrastructure stack. A service provider may, for example, build a SaaS solution on top of another provider’s IaaS, or might offer configuration assistance with a commercially available SaaS.

Info-Tech Insight

Not all workloads fit well in the cloud. Many environments will mix service models (e.g. SaaS for some workloads, some in IaaS, some on-premises), and this can be perfectly effective. It must be consistent and intentional, however.

Organization has control

Organization or vendor may control

Vendor has control

Analytics folly

SaaS is good, but it’s not a panacea

Industry: Healthcare

Source: Info-Tech workshop

Situation

A healthcare analytics provider had already moved a significant number of “non-core workloads” to the cloud, including email, HRIS, and related services.

The company CEO was satisfied with the reduced effort required by IT to manage SaaS-based workloads and sought to extend the same benefits to the core analytics platform where there was an opportunity to reduce overhead.

Complication

Many components of the health analytics service were designed to run specifically in a datacenter and were not ready to be migrated to the cloud without significant effort/refactoring. SaaS was not an option because this was a core platform – a SaaS provider would have been the competition.

That left IaaS, which was expensive and would not bring the expected benefits (reduced overhead).

Results

The organization determined that there were no short-term gains from migrating to the cloud. Due to the nature of the application (its extensive customization, the fact that it was a core product sold by the company) any steps to reduce operational overhead were not feasible.

The CEO recognized that the analytics platform was not a good candidate for the cloud and what distinguished the analytics platform from more suitable workloads.

Migration paths

In a 2016 blog post, Amazon Web Services articulated a framework for cloud migration that incorporates elements of the journey as well as the destination. If workload owners do not choose to retain or retire their workloads, there are four alternatives. These alternatives all stack up differently along five key dimensions:

1. Value: does the workload stand to benefit from unique cloud characteristics? To what degree?
2. Effort: how much work would be required to make the transition?
3. Cost: how much money is the migration expected to cost?
4. Time: how long will the migration take?
5. Skills: what skills must be brought to bear to complete the migration?

Not all migration paths can lead to all destinations. Rehosting generally means IaaS, while repurchasing leads to SaaS. Refactoring and replatforming have some variety of outcomes, and it becomes possible to take advantage of new IaaS architectures or migrate workloads over fully to SaaS.

As part of the workload assessment process, use the five dimensions (expanded upon on the next slide) to determine what migration path makes sense. Preferred migration paths form an important part of the overall cloud vision process.

Retain (Revisit)

• Keep the application in its current form, at least for now. This doesn’t preclude revisiting it in the future.

Retire

• Get rid of the application completely.

Rehost

• Move the application to the cloud (IaaS) and continue to run it in more or less the same form as it currently runs.

Replatform

• Move the application to the cloud and perform a few changes for cloud optimizations.

Refactor

• Rewrite the application, taking advantage of cloud native architectures.

Repurchase

• Replace with an alternative, cloud-native application and migrate the data.

Migration paths – relative value

Where should you get your cloud skills?

Cloud skills are certainly top of mind right now. With the great upheaval in both work patterns and in the labor market more generally, expertise in cloud-related areas is simultaneously more valuable and more difficult to procure. According to Pluralsight’s 2021 “State of Upskilling” report, 44% of respondents report themselves under-skilled in the cloud management area, making cloud management the most significant skill gap reported on the survey.

Everyone left the office. Work as we know it is fundamentally altered for a generation or more. Cloud services shot up in popularity by enabling the transition. And yet there is a gap – a prominent gap – in skilling up for this critically important future. What is the cloud manager to do?

Per the framework presented here, that manager has three essential options. They may take somewhat different forms depending on specific requirements and the quirks of the local market, but the options are:

1. Train or hire internal resources: This might be easier said than done, especially for more niche skills, but makes sense for workloads that are critical to operations for the long term.
2. Engage a managed service provider: MSPs are often engaged to manage services where internal IT lacks bandwidth or expertise.
3. Hire a consultant: Consultants are great for time-bound implementation projects where highly specific expertise is required, such as a migration or implementation project.

Each model makes sense to some degree. When evaluating individual workloads for cloud suitability, it is critical to consider the support model – both immediate and long term. What makes sense from a value perspective?

Cloud decisions – summary

A key component of the Info-Tech cloud vision model is that it is multi-layered. Not every decision must be made at every level. At the workload level, it makes sense to select service models that make sense, but each workload does not need its own defined vision. Workload-level decisions should be guided by an overall strategy but applied tactically, based on individual workload characteristics and circumstances.

Conversely, some decisions will inevitably be applied at the environment level. With some exceptions, it is unlikely that cloud customers will build an entire private/hybrid cloud environment around a single solution; instead, they will define a broader strategy and fit individual workloads into that strategy.

Some considerations exist at both the workload and environment levels. Risks and roadblocks, as well as the preferred support model, are concerns that exist at both the environment level and at the workload level.

Step 1.3

Create a current state summary

Activities

1.3.1 Record your current state

Understand the Cloud

Generate goals and drivers

Explore cloud characteristics

Create a current state summary

Select workloads for analysis

This step involves the following participants: Core working group

Outcomes of this step

• Current state summary of cloud solutions

1.3.1 Record your current state

30 minutes

Input

• Knowledge of existing cloud workloads

Output

• Current state cloud summary for service, delivery, and support models

Materials

• Whiteboard

Participants

• Core working group
• Infrastructure team
• Service owners

1. On a whiteboard (real or virtual) draw a table with each of the cloud service models across the top. Leave a cell below each to list examples.
2. Under each service model, record examples present in your environment. The purpose of the exercise is to illustrate the existence of cloud services in your environment or the lack thereof, so there is no need to be exhaustive. Complete this in turn for each service model until you are satisfied that you have created an effective picture of your current cloud SaaS state, IaaS state, etc.
3. Input the results into their own slide titled “current state summary” in the Cloud Vision Executive Presentation.
4. Repeat for the cloud delivery models and support models and include the results of those exercises as well.
5. Create a short summary statement (“We are primarily a public cloud consumer with a large SaaS footprint and minimal presence in PaaS and IaaS. We retain an MSP to manage our hosted telephony solution; otherwise, everything is handled in house.”

Cloud Vision Executive Presentation

Step 1.4

Select workloads for current analysis

Activities

1.4.1 Select workloads for assessment

This step involves the following participants:

• Core working group

Outcomes of this step

• List of workloads for assessment

Understand the cloud

Generate goals and drivers

Explore cloud characteristics

Create a current state summary

Select workloads for analysis

1.4.1 Select workloads for assessment

30 minutes

Input

• Knowledge of existing cloud workloads

Output

• List of workloads to be assessed

Materials

• Whiteboard
• Cloud Vision Workbook

Participants

• Core working group
• IT management

1. In many cases, the cloud project is inspired by a desire to move a particular workload or set of workloads. Solicit feedback from the core working group about what these workloads might be. Ask everyone in the meeting to suggest a workload and record each one on a sticky note or white board (virtual or physical).
2. Discuss the results with the group and begin grouping similar workloads together. They will be subject to the assessments in the Cloud Vision Workbook, so try to avoid selecting too many workloads that will produce similar answers. It might not be obvious, but try to think about workloads that have similar usage patterns, risk levels, and performance requirements, and select a representative group.
3. You should embrace counterintuition by selecting a workload that you think is unlikely to be a good fit for the cloud if you can and subjecting it to the assessment as well for validation purposes.
4. When you have a list of 4-6 workloads, record them on tab 2 of the Cloud Vision Workbook.

Cloud Vision Workbook

Assess your cloud workloads

Build the foundations of your cloud vision

Phase 2

Phase 2

Evaluate Cloud Workloads

Phase 1

1.1 Generate goals and drivers

1.2 Explore cloud characteristics

1.3 Create a current state summary

1.4 Select workloads for analysis

Phase 2

2.1 Conduct workload assessments

2.2 Determine workload future states

Phase 3

3.1 Generate risks and roadblocks

3.2 Mitigate risks and roadblocks

3.3 Define roadmap initiatives

Phase 4

4.1 Review and assign work items

4.2 Finalize cloud decision framework

4.3 Create cloud vision

This phase will walk you through the following activities:

• Conduct workload assessments
• Determine workload future state

This phase involves the following participants:

• Subject matter experts
• Core working group
• IT management

Define Your Cloud Vision

Work from the bottom up and assess your workloads

A workload-first approach will help you create a realistic vision.

The concept of a cloud vision should unquestionably be informed by the nature of the workloads that IT is expected to provide for the wider organization. The overall cloud vision is no greater than the sum of its parts. You cannot migrate to the cloud in the abstract. Workloads need to go – and not all workloads are equally suitable for the transition.

It is therefore imperative to understand which workloads are a good fit for the cloud, which cloud service models make the most sense, how to execute the migration, what support should look like, and what risks and roadblocks you are likely to encounter as part of the process.

That’s where the Cloud Vision Workbook comes into play. You can use this tool to assess as many workloads as you’d like – most people get the idea after about four – and by the end of the exercise, you should have a pretty good idea about where your workloads belong, and you’ll have a tool to assess any net new or previously unconsidered workloads.

It’s not so much about the results of the assessment – though these are undeniably important – but about the learnings gleaned from the collaborative assessment exercise. While you can certainly fill out the assessment without any additional input, this exercise is most effective when completed as part of a group.

Introducing the Cloud Vision Workbook

• The Cloud Vision Workbook is an Excel tool that answers the age old question: “What should I do with my workloads?”
• It is divided into eight tabs, each of which offers unique value. Start by reading the introduction and inputting your list of workloads. Work your way through tabs 3-6, completing the suitability, migration, management, and risk and roadblock assessments, and review the results on tab 7.
• If you choose to go through the full battery of assessments for each workload, expect to answer and weight 111 unique questions across the four assessments. This is an intensive exercise, so carefully consider which assessments are valuable to you, and what workloads you have time to assess.
• Tab 8 hosts the milestone timeline and captures the results of the phase 3 risk and mitigation exercise.

Understand Cloud Vision Workbook outputs

Step 2.1

Conduct workload assessments

Activities

2.1.1 Conduct workload assessments

2.1.2 Interpret your results

Phase Title

Conduct workload assessments

Determine workload future state

This step involves the following participants:

• Core working group
• Workload subject matter experts

Outcomes of this step

• Completed workload assessments

2.1.1 Conduct workload assessments

2 hours per workload

Input

• List of workloads to be assessed

Output

• Completed cloud vision assessments

Materials

• Cloud Vision Workbook

Participants

• Core working group
• Service owners/workload SMEs

1. The Cloud Vision Workbook is your one stop shop for all things workload assessment. Open the tool to tab 2 and review the workloads you identified at the end of phase 1. Ensure that these are correct. Once satisfied, project the tool (virtually, if necessary) so that all participants can see the assessment questions.
2. Work through tabs 3-6, answering the questions and assigning a multiplier for each one. A higher multiplier increases the relative weight of the question, giving it a greater impact on the overall outcome.
3. Do your best to induce participants to offer opinions. Consensus is not absolutely necessary, but it is a good goal. Ask your participants if they agree with initial responses and occasionally take the opposite position (“I’m surprised you said agree – I would have thought we didn’t care about CapEx vs. OpEx”). Stimulate discussion.
4. Highlight any questions that you will need to return to or run by someone not present. Include a placeholder answer, as the tool requires all cells to be filled for computation.

Cloud Vision Workbook

2.1.2 Interpret your results

10 minutes

Input

• Completed cloud vision assessments

Output

• Shared understanding of implications

Materials

• Cloud Vision Workbook

Participants

• Core working group
• Service owners/workload SMEs

1. Once you’ve completed all 111 questions for each workload, you can review your results on tab 7. On tab 7, you will see four populated graphics: cloud suitability, migration path, “where should skills be procured?”, and risks and roadblocks. These represent the components of the overall cloud vision that you will present to stakeholders.
2. The “cloud suitability” chart captures the service model that the assessment judges to be most suitable for the workload. Ask those present if any are surprised by the output. If there is any disagreement, discuss the source of the surprise and what a more realistic outcome would be. Revisit the assessment if necessary.
3. Conduct a similar exercise with each of the other outputs. Does it make sense to refactor the workload based on its cloud suitability? Does the fact that we scored so highly on the “consultant” support model indicate something about how we handle upskilling internally? Does the profile of risks and roadblocks identified here align with expectations? What should be ranked higher? What about lower?
4. Once everyone is generally satisfied with the results, close the tool and take a break! You’ve earned it.

Cloud Vision Workbook

Understand the cloud strategy components

Each cloud strategy will take a slightly different form, but all should contain echoes of each of these components. This process will help you define your vision and direction, but you will need to take steps to execute on that vision. The remainder of the cloud strategy, covered in the related blueprint Document Your Cloud Strategy comprises these fourteen topics divided across three categories: people, governance, and technology. The workload assessment covers these under risks and roadblocks and highlights areas that may require specific additional attention. When interpreting the results, think of these areas as comprising things that you will need to do to make your vision a reality.

People

• Skills and roles
• Culture and adoption
• Governing bodies

Governance

• Architecture
• Integration and interoperability
• Operations management
• Cloud portfolio management
• Cloud vendor management
• Finance management
• Security
• Data controls

Technology

• Monitoring
• Provisioning
• Migration

Strategy component: People

People form the core of any good strategy. As part of your cloud vision, you will need to understand the implications a cloud transition will have on your staff and users, whether those users are internal or external.

Strategy component: Governance

Without guardrails, the cloud deployment will grow organically. This has strengths (people tend to adopt solutions that they select and deploy themselves), but these are more than balanced out by the drawbacks that come with inconsistency, poor administration, duplication of services, suboptimal costing, and any number of other unique challenges. The solution is to develop and deploy governance. The following list captures some of the necessary governance-related components of a cloud strategy.

Strategy component: Governance (cont.)

Strategy component: Technology

Good technology will never replace good people and effective process, but it remains important in its own right. A migration that neglects the undeniable technical components of a solid cloud strategy is doomed to mediocrity at best and failure at worst. Understanding the technical implications of the cloud vision – particularly in terms of monitoring, provisioning, and migration – makes all the difference. You can interpret the results of the cloud workload assessments by reviewing the details presented here.

Step 2.2

Determine workload future state

Activities

2.2.1 Determine workload future state

Conduct workload assessments

Determine workload future state

This step involves the following participants:

• IT management
• Core working group

Outcomes of this step

• Completed workload assessments
• Defined workload future state

2.2.1 Determine workload future state

1-3 hours

Input

• Completed workload assessments

Output

• Preliminary future state outputs

Materials

• Cloud Vision Workbook
• Cloud Vision Executive Presentation

Participants

• Core working group
• Service owners
• IT management

1. After you’ve had a chance to validate your results, refer to tab 7 of the tool, where you will find a blank notes section.
2. With the working group, capture your answers to each of the following questions:
   1. What service model is the most suitable for the workload? Why?
   2. How will we conduct the migration? Which of the six models makes the most sense? Do we have a backup plan if our primary plan doesn’t work out?
   3. What should the support model look like?
   4. What are some workload-specific risks and considerations that must be taken into account for the workload?
3. Once you’ve got answers to each of these questions for each of the workloads, include your summary in the “notes” section of tab 7.

Cloud Vision Executive Presentation

Paste the output into the Cloud Vision Executive Presentation

• The Cloud Vision Workbook output is a compact, consumable summary of each workload’s planned future state. Paste each assessment in as necessary.
• There is no absolutely correct way to present the information, but the output is a good place to start. Do note that, while the presentation is designed to lead with the vision statement, because the process is workload-first, the assessments are populated prior to the overall vision in a bottom-up manner.
• Be sure to anticipate the questions you are likely to receive from any stakeholders. You may consider preparing for questions like: “What other workloads fit this profile?” “What do we expect the impact on the budget to be?” “How long will this take?” Keep these and other questions in mind as you progress through the vision definition process.

Info-Tech Insight

Keep your audience in mind. You may want to include some additional context in the presentation if the results are going to be presented to non-technical stakeholders or those who are not familiar with the terms or how to interpret the outputs.

Identify and Mitigate Risks

Build the foundations of your cloud vision

PHASE 3

Phase 3

Identify and Mitigate Risks

Phase 1

1.1 Generate goals and drivers

1.2 Explore cloud characteristics

1.3 Create a current state summary

1.4 Select workloads for analysis

Phase 2

2.1 Conduct workload assessments

2.2 Determine workload future states

Phase 3

3.1 Generate risks and roadblocks

3.2 Mitigate risks and roadblocks

3.3 Define roadmap initiatives

Phase 4

4.1 Review and assign work items

4.2 Finalize cloud decision framework

4.3 Create cloud vision

This phase will walk you through the following activities:

• Generate risks and roadblocks
• Mitigate risks and roadblocks
• Define roadmap initiatives

This phase involves the following participants:

• Core working group
• Workload subject matter experts

You know what you want to do, but what do you have to do?

What questions remain unanswered?

There are workload-level risks and roadblocks, and there are environment-level risks. This phase is focused primarily on environment-level risks and roadblocks, or those that are likely to span multiple workloads (but this is not hard and fast rule – anything that you deem worth discussing is worth discussing). The framework here calls for an open forum where all stakeholders – technical and non-technical, pro-cloud and anti-cloud, management and individual contributor – have an opportunity to articulate their concerns, however specific or general, and receive feedback and possible mitigation.

Start by soliciting feedback. You can do this over time or in a single session. Encourage anyone with an opinion to share it. Focus on those who are likely to have a perspective that will become relevant at some point during the creation of the cloud strategy and the execution of any migration. Explain the preliminary direction; highlight any major changes that you foresee. Remind participants that you are not looking for solutions (yet), but that you want to make sure you hear any and every concern as early as possible. You will get feedback and it will all be valuable.

Before cutting your participants loose, remind them that, as with all business decisions, the cloud comes with trade-offs. Not everyone will have every wish fulfilled, and in some cases, significant effort may be needed to get around a roadblock, risks may need to be accepted, and workloads that looked like promising candidates for one service model or another may not be able to realize that potential. This is a normal and expected part of the cloud vision process.

Once the risks and roadblocks conversation is complete, it is the core working group’s job to propose and validate mitigations. Not every risk can be completely resolved, but the cloud has been around for decades – chances are someone else has faced a similar challenge and made it through relatively unscathed. That work will inevitably result in initiatives for immediate execution. Those initiatives will form the core of the initiative roadmap that accompanies the completed Cloud Vision Executive Presentation.

Step 3.1

Generate risks and roadblocks

Activities

3.1.1 Generate risks and roadblocks

3.1.2 Generate mitigations

Identify and mitigate risks

Generate risks and roadblocks

Mitigate risks and roadblocks

Define roadmap initiatives

This step involves the following participants:

• Core working group
• IT management
• Infrastructure
• Applications
• Security
• Architecture

Outcomes of this step

• List of risks and roadblocks

Understand risks and roadblocks

Risk

• Something that could potentially go wrong.
• You can respond to risks by mitigating them:
  • Eliminate: take action to prevent the risk from causing issues.
  • Reduce: take action to minimize the likelihood/severity of the risk.
  • Transfer: shift responsibility for the risk away from IT, towards another division of the company.
  • Accept: where the likelihood or severity is low, it may be prudent to accept that the risk could come to fruition.

Roadblock

• There are things that aren’t “risks” that we care about when migrating to the cloud.
• We know, for example, that a complicated integration situation will create work items for any migration – this is not an “unknown.”
• We respond to roadblocks by generating work items.

3.1.1 Generate risks and roadblocks

1.5 hours

Input

• Completed cloud vision assessments

Output

• List of risks and roadblocks

Materials

• Whiteboard
• Sticky notes

Participants

• Core working group
• Service owners/workload SMEs
• Anyone with concerns about the cloud

1. Gather your core working group – and really anyone with an intelligent opinion on the cloud – into a single meeting space. Give the group 5-10 minutes to list anything they think could present a difficulty in transitioning workloads to the cloud. Write each risk/roadblock on its own sticky note. You will never be 100% exhaustive, but don’t let anything your users care about go unaddressed.
2. Once everyone has had time to write down their risks and roadblocks, have everyone share one by one. Make sure you get them all. Overlap in risks and roadblocks is okay! Group similar concerns together to give a sort of heat map of what your participants are concerned about. (This is called “affinity diagramming.”)
3. Assign names to these categories. Many of these categories will align with the strategy components discussed in the previous phase (governance, security, etc.) but some will be specific whether by nature or by degree.
4. Sort each of the individual risks into its respective category, collapsing any exact duplicates, and leaving room for notes and mitigations (see the next slide for a visual).

Understand risks and roadblocks

Step 3.2

Mitigate risks and roadblocks

Activities

3.2.1 Generate mitigations

Identify and mitigate risks

Generate risks and roadblocks

Mitigate risks and roadblocks

Define roadmap initiatives

This step involves the following participants:

• Core working group

Outcomes of this step

• List of mitigations

Is the public cloud less secure?

This is the key risk-related question that most cloud customers will have to answer at some point: does migrating to the cloud for some services increase their exposure and create a security problem?

As with all good questions, the answer is “it depends.” But what does it depend on? Consider these cloud risks and potential mitigations:

1. Misconfiguration: An error grants access to unauthorized parties (as happened to Capital One in 2019). This can be mitigated by careful configuration management and third-party tooling.
2. Unauthorized access by cloud provider/partner employees: Though rare, it is possible that a cloud provider or partner can be a vector for a breach. Careful contract language, choosing to own your own encryption keys, and a hybrid approach (storing data on-premises) are some possible ways to address this problem.
3. Unauthorized access to systems: Cloud services are designed to be accessed from anywhere and may be accessed by malicious actors. Possible mitigations include risk-based conditional access, careful identity access management, and logging and detection.

“The cloud is definitely more secure in that you have much more control, you have much more security tooling, much more visibility, and much more automation. So it is more secure. The caveat is that there is more risk. It is easier to accidentally expose data in the cloud than it is on-premises, but, especially for security, the amount of tooling and visibility you get in cloud is much more than anything we’ve had in our careers on-premises, and that’s why I think cloud in general is more secure.” –Abdul Kittana, Founder, ASecureCloud

Breach bests bank

No cloud provider can protect against every misconfiguration

Industry: Finance

Source: The New York Times, CNET

Background

Capital One is a major Amazon Web Services customer and is even featured on Amazon’s site as a case study. That case study emphasizes the bank’s commitment to the cloud and highlights how central security and compliance were. From the CTO: “Before we moved a single workload, we engaged groups from across the company to build a risk framework for the cloud that met the same high bar for security and compliance that we meet in our on-premises environments. AWS worked with us every step of the way.”

Complication

The cloud migration was humming along until July 2019, when the bank suffered a serious breach at the hands of a hacker. That hacker was able to steal millions of credit card applications and hundreds of thousands of Social Security numbers, bank account numbers, and Canadian social insurance numbers.

According to investigators and to AWS, the breach was caused by an open reverse proxy attack against a misconfigured web app firewall, not by an underlying vulnerability in the cloud infrastructure.

Results

Capital One reported that the breach was expected to cost it $150 million, and AWS fervently denied any blame. The US Senate got involved, as did national media, and Capital One’s CEO issued a public apology, writing, “I sincerely apologize for the understandable worry this incident must be causing those affected, and I am committed to making it right.”

It was a bad few months for IT at Capital One.

3.2.1 Generate mitigations

3-4.5 hours

Input

• Completed cloud vision assessments

Output

• List of risks and roadblocks

Materials

• Whiteboard
• Sticky notes

Participants

• Core working group
• Service owners/workload SMEs
• Anyone with concerns about the cloud

1. Recall the four mitigation strategies: eliminate, reduce, transfer, or accept. Keep these in mind as you work through the list of risks and roadblocks with the core working group. For every individual risk or roadblock raised in the initial generation session, suggest a specific mitigation. If the concern is “SaaS providers having access to confidential information,” a mitigation might be encryption, specific contract language, or proof of certifications (or all the above).
2. Work through this for each of the risks and roadblocks, identifying the steps you need to take that would satisfy your requirements as you understand them.
3. Once you have gone through the whole list – ideally with input from SMEs in particular areas like security, engineering, and compliance/legal – populate the Cloud Vision Workbook (tab 8) with the risks, roadblocks, and mitigations (sorted by category). Review tab 8 for an example of the output of this exercise.

Cloud Vision Workbook

Cloud Vision Workbook – mitigations

Step 3.3

Define roadmap initiatives

Activities

3.3.1 Generate roadmap initiatives

Identify and mitigate risks

Generate risks and roadblocks

Mitigate risks and roadblocks

Define roadmap initiatives

This step involves the following participants:

• Core working group

Outcomes of this step

• Defined roadmap initiatives

3.3.1 Generate roadmap initiatives

1 hour

Input

• List of risk and roadblock mitigations

Output

• List of cloud initiatives

Materials

• Cloud Vision Workbook

Participants

• Core working group

1. Executing on your cloud vision will likely require you to undertake some key initiatives, many of which have already been identified as part of your mitigation exercise. On tab 8 of the Cloud Vision Workbook, review the mitigations you created in response to the risks and roadblocks identified. Initiatives should generally be assignable to a party and should have a defined scope/duration. For example, “assess all net new applications for cloud suitability” might not be counted as an initiative, but “design a cloud application assessment” would likely be.
2. Design a timeline appropriate for your specific needs. Generally short-term (less than 3 months), medium-term (3-6 months), and long-term (greater than 6 months) will work, but this is entirely based on preference.
3. Review and validate the parameters with the working group. Consider creating additional color-coding (highlighting certain tasks that might be dependent on a decision or have ongoing components).

Cloud Vision Workbook

Bridge the gap and create the vision

Build the foundations of your cloud vision

Phase 4

Phase 4

Bridge the Gap and Create the Vision

Phase 1

1.1 Generate goals and drivers

1.2 Explore cloud characteristics

1.3 Create a current state summary

1.4 Select workloads for analysis

Phase 2

2.1 Conduct workload assessments

2.2 Determine workload future states

Phase 3

3.1 Generate risks and roadblocks

3.2 Mitigate risks and roadblocks

3.3 Define roadmap initiatives

Phase 4

4.1 Review and assign work items

4.2 Finalize cloud decision framework

4.3 Create cloud vision

This phase will walk you through the following activities:

• Assign initiatives and propose timelines
• Build a delivery model rubric
• Build a service model rubric
• Built a support model rubric
• Create a cloud vision statement
• Map cloud workloads
• Complete the Cloud Vision presentation

This phase involves the following participants:

• IT management, the core working group, security, infrastructure, operations, architecture, engineering, applications, non-IT stakeholders

Step 4.1

Review and assign work items

Activities

4.1.1 Assign initiatives and propose timelines

Bridge the gap and create the vision

Review and assign work items

Finalize cloud decision framework

Create cloud vision

This step involves the following participants:

• Core working group
• IT management

Outcomes of this step

• Populated cloud vision roadmap

4.1.1 Assign initiatives and propose timelines

1 hour

Input

• List of cloud initiatives

Output

• Initiatives assigned by responsibility and timeline

Materials

• Cloud Vision Workbook

Participants

• Core working group

1. Once the list is populated, begin assigning responsibility for execution. This is not a RACI exercise, so focus on the functional responsibility. Once you have determined who is responsible, assign a timeline and include any notes. This will form the basis of a more formal project plan.
2. To assign the initiative to a party, consider 1) who will be responsible for execution and 2) if that responsibility will be shared. Be as specific as possible, but be sure to be consistent to make it easier for you to sort responsibility later on.
3. When assigning timelines, we suggest including the end date (when you expect the project to be complete) rather than the start date, though whatever you choose, be sure to be consistent. Make use of the notes column to record anything that you think any other readers will need to be aware of in the future, or details that may not be possible to commit to memory.

Cloud Vision Workbook

Step 4.2

Finalize cloud decision framework

Activities

4.2.1 Build a delivery model rubric

4.2.2 Build a service model rubric

4.2.3 Build a support model rubric

Bridge the gap and create the vision

Review and assign work items

Finalize cloud decision framework

Create cloud vision

This step involves the following participants:

• Core working group

Outcomes of this step

• Cloud decision framework

4.2.1 Build a delivery model rubric

1 hour

Input

• List of cloud initiatives

Output

• Initiatives assigned by responsibility and timeline

Materials

• Cloud Vision Executive Presentation

Participants

• Core working group

1. Now that we have a good understanding of the cloud’s key characteristics, the relative suitability of different workloads for the cloud, and a good understanding of some of the risks and roadblocks that may need to be overcome if a cloud transition is to take place, it is time to formalize a delivery model rubric. Start by listing the delivery models on a white board vertically – public, private, hybrid, and multi-cloud. Include a community cloud option as well if that is feasible for you. Strike any models that do not figure into your vision.
2. Create a table style rubric for each delivery model. Confer with the working group to determine what characteristics best define workloads suitable for each model. If you have a hybrid cloud option, you may consider workloads that are highly dynamic; a private cloud hosted on-premises may be more suitable for workloads that have extensive regulatory requirements.
3. Once the table is complete, include it in the Cloud Vision Executive Presentation.

Cloud Vision Executive Presentation

Vision for the cloud future state (example)

Summary statement: Everything must go! Public cloud is a top priority. Anything that is not compatible (for whatever reason) with a public cloud deployment will be retained in a premises-based server closet (downgraded from a full datacenter). The private cloud does not align with the overall organizational vision, nor does a hybrid solution.

4.2.2 Build a service model rubric

1 hour

Input

• Output of workload assessments
• Output of risk and mitigation exercise

Output

• Service model rubric

Materials

• Whiteboard
• Cloud Vision Executive Presentation

Participants

• Core working group

1. This next activity is like the delivery model activity, but covers the relevant cloud service models. On a whiteboard, make a vertical list of the cloud service models (SaaS, PaaS, IaaS, etc.) that will be considered for workloads. If you have an order of preference, place your most preferred at the top, your least preferred at the bottom.
2. Describe the circumstances under which you would select each service model. Do your best to focus on differentiators. If a decision criterion appears for multiple service models, consider refining or excluding it. (For additional information, check out Info-Tech’s Reimagine IT Operations for a Cloud-First World blueprint.)
3. Create a summary statement to capture your overall service model position. See the next slide for an example. Note: this can be incorporated into your cloud vision statement, so be sure that it reflects your genuine cloud preferences.
4. Record the results in the Cloud Vision Executive Presentation.

Cloud Vision Executive Presentation

Vision for the cloud future state (example)

Summary statement: SaaS will be the primary service model. All workloads will migrate to the public cloud where possible. Anything that cannot be migrated to SaaS will be migrated to PaaS. IaaS is a transitory step.

4.2.3 Build a support model rubric

1 hour

Input

• Results of the cloud workload assessments

Output

• Support model rubric

Materials

• Whiteboard
• Cloud Vision Executive Presentation

Participants

• Core working group

1. The final rubric covered here is that for the support model. Where will you procure the skills necessary to ensure the vision’s proper execution? Much like the other rubric activities, write the three support models vertically (in order of preference, if you have one) on a whiteboard.
2. Next to each model, describe the circumstances under which you would select each support model. Focus on the dimensions: the duration of the engagement, specialization required, and flexibility required. If you have existing rules/practices around hiring consultants/MSPs, consider those as well.
3. Once you have a good list of decision criteria, form a summary statement. This should encapsulate your position on support models and should mention any notable criteria that will contribute to most decisions.
4. Record the results in the Cloud Vision Executive Presentation.

Cloud Vision Executive Presentation

Vision for the cloud future state (example)

Summary statement: Most workloads will be managed in house. A consultant will be employed to facilitate the transition to micro-services in a cloud container environment, but this will be transitioned to in-house staff. An MSP will continue to manage backups and telephony.

Step 4.3

Create cloud vision

Activities

4.3.1 Create a cloud vision statement

4.3.2 Map cloud workloads

4.3.3 Complete the Cloud Vision Presentation

Review and assign work items

Finalize cloud decision framework

Create cloud vision

This step involves the following participants:

• Core working group
• IT management

Outcomes of this step

Completed Cloud Vision Executive Presentation

4.3.1 Create a cloud vision statement

1 hour

Input

• List of cloud initiatives

Output

• Initiatives assigned by responsibility and timeline

Materials

• Cloud Vision Workbook

Participants

• Core working group

1. Now that you know what service models are appropriate, it’s time to summarize your cloud vision in a succinct, consumable way. A good vision statement should have three components:
   • Scope: Which parts of the organization will the strategy impact?
   • Goal: What is the strategy intended to accomplish?
   • Key differentiator: What makes the new strategy special?
2. On a whiteboard, make a chart with three columns (one column for each of the features of a good mission statement). Have the group generate a list of words to describe each of the categories. Ideally, the group will produce multiple answers for each category.
3. Once you’ve gathered a few different responses for each category, have the team put their heads down and generate pithy mission statements that capture the sentiments underlying each category.
4. Have participants read their vision statements in front of the group. Use the rest of the session to produce a final statement. Record the results in the Cloud Strategy Executive Presentation.

Example vision statement outputs

“IT at ACME Corp. hereby commits to providing clients and end users with an unparalleled, productivity-enabling technology experience, leveraging, insofar as it is possible and practical, cloud-based services.”

“At ACME Corp. our employees and customers are our first priority. Using new, agile cloud services, IT is devoted to eliminating inefficiency, providing cutting-edge solutions for a fast-paced world, and making a positive difference in the lives of our colleagues and the people we serve.”

“As a global leader in technology, ACME Corp. is committed to taking full advantage of new cloud services, looking first to agile cloud options to optimize internal processes wherever efficiency gaps exist. Improved efficiency will allow associates to spend more time on ACME’s core mission: providing an unrivalled customer experience.”

Scope

Goal

Key differentiator

4.3.2 Map cloud workloads

1 hour

Input

• List of workloads
• List of acceptable service models
• List of acceptable migration paths

Output

• Workloads mapped by service model/migration path

Materials

• Whiteboard
• Sticky notes

Participants

• Core working group

1. Now that you have defined your overall cloud vision as well as your service model options, consider aligning your service model preferences with your migration path preferences. Draw a table with your expected migration strategies across the top (retain, retire, rehost, replatform, refactor, repurchase, or some of these) and your expected service models across the side.
2. On individual sticky notes, write a list of workloads in your environment. In a smaller environment, this list can be exhaustive. Otherwise take advantage of the list you created as part of phase 1 along with any additional workloads that warrant discussion.
3. As a group, go through the list, placing the sticky notes first in the appropriate row based on their characteristics and the decision criteria that have already been defined, and then in the appropriate column based on the appropriate migration path. (See the next slide for an example of what this looks like.)
4. Record the results in the Cloud Vision Executive Presentation. Note: not every cell will be filled; some migration path/service model combinations are impossible or otherwise undesirable.

Cloud Vision Executive Presentation

Example cloud workload map

4.3.3 Complete the Cloud Vision Presentation

1 hour

Input

• List of cloud initiatives

Output

• Initiatives assigned by responsibility and timeline

Materials

• Cloud Vision Workbook

Participants

• Core working group

1. Open the Cloud Vision Executive Presentation to the second slide and review the templated executive brief. This comprises several sections (see the next slide). Populate each one:
   • Summary of the exercise
   • The cloud vision statement
   • Key cloud drivers
   • Risks and roadblocks
   • Top initiatives and next steps
2. Review the remainder of the presentation. Be sure to elaborate on any significant initiatives and changes (where applicable) and to delete any slides that you no longer require.

Cloud Vision Workbook

Sample cloud vision executive summary

• From [date to date], a cross-functional group representing IT and its constituents met to discuss the cloud.
• Over the course of the week, the group identified drivers for cloud computing and developed a shared vision, evaluated several workloads through an assessment framework, identified risks, roadblocks, and mitigations, and finally generated initiatives and next steps.
• From the process, the group produced a summary and a cloud suitability assessment framework that can be applied at the level of the workload.

Cloud Vision Statement

[Organization] will leverage public cloud solutions and retire existing datacenter and colocation facilities. This transition will simplify infrastructure administration, support, and security, while modernizing legacy infrastructure and reducing the need for additional capital expenditure.

Initiatives and next steps

• Close the datacenter and colocation site in favor of a SaaS-first cloud approach.
• Some workloads will migrate to infrastructure-as-a-service in the short term with the assistance of third-party consultants.

Document your cloud strategy

You did it!

Congratulations! If you’ve made it this far, you’ve successfully articulated a cloud vision, assessed workloads, developed an understanding (shared with your team and stakeholders) of cloud concepts, and mitigated risks and roadblocks that you may encounter along your cloud journey. From this exercise, you should understand your mission and vision, how your cloud plans will interact with any other relevant strategic plans, and what successful execution looks like, as well as developing a good understanding of overall guiding principles. These are several components of your overall strategy, but they do not comprise the strategy in its entirety.

How do you fix this?

First, validate the results of the vision exercise with your stakeholders. Socialize it and collect feedback. Make changes where you think changes should be made. This will become a key foundational piece. The next step is to formally document your cloud strategy. This is a separate project and is covered in the Info-Tech blueprint Document Your Cloud Strategy.

The vision exercise tells you where you want to go and offers some clues as to how to get there. The formal strategy exercise is a formal documentation of the target state, but also captures in detail the steps you’ll need to take, the processes you’ll need to refine, and the people you’ll need to hire.

A cloud strategy should comprise your organizational stance on how the cloud will change your approach to people and human resources, technology, and governance. Once you are confident that you can make and enforce decisions in these areas, you should consider moving on to Document Your Cloud Strategy. This blueprint, Define Your Cloud Vision, often serves as a prerequisite for the strategy documentation conversation(s).

Appendix

Summary of Accomplishment

Additional Support

Research Contributors

Related Info-Tech Research

Vendor Resources

Bibliography

Summary of Accomplishment

Problem Solved

You have now documented what you want from the cloud, what you mean when you say “cloud,” and some preliminary steps you can take to make your vision a reality.

You now have at your disposal a framework for identifying and evaluating candidates for their cloud suitability, as well as a series of techniques for generating risks and mitigations associated with your cloud journey. The next step is to formalize your cloud strategy using the takeaways from this exercise. You’re well on your way to a completed cloud strategy!

If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

Contact your account representative for more information.

workshops@infotech.com

1-888-670-8889

Additional Support

If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

The following are sample activities that will be conducted by Info-Tech analysts with your team:

Generate drivers for cloud adoption

Work with stakeholders to understand the expected benefits of the cloud migration and how these drivers will impact the overall vision.

Conduct workload assessments

Assess your individual cloud workloads for their suitability as candidates for the cloud migration.

Bibliography

“2021 State of the Cloud Report.” Flexera, 2021. Web.

“2021 State of Upskilling Report.” Pluralsight, 2021. Web.

“AWS Snowmobile.” Amazon Web Services, n.d. Web.

“Azure products.” Microsoft, n.d. Web.

“Azure Migrate Documentation.” Microsoft, n.d. Web.

Bell, Harold. “Multi-Cloud vs. Hybrid Cloud: What’s the Difference?” Nutanix, 2019. Web.

“Cloud Products.” Amazon Web Services, n.d. Web.

“COBIT 2019 Framework: Introduction and Methodology.” ISACA, 2019. Web.

Edmead, Mark T. “Using COBIT 2019 to Plan and Execute an Organization’s Transformation Strategy.” ISACA, 2020. Web.

Flitter, Emily, and Karen Weise. “Capital One Data Breach Compromises Data of Over 100 Million.” The New York Times, 29 July 2019. Web.

Gillis, Alexander S. “Cloud Security Posture Management (CSPM).” TechTarget, 2021. Web.

“’How to Cloud’ with Capital One.” Amazon Web Services, n.d. Web.

“IBM Closes Landmark Acquisition of Red Hat for $34 Billion; Defines Open, Hybrid Cloud Future.” Red Hat, 9 July 2019. Web.

Mell, Peter, and Timothy Grance. “The NIST Definition of Cloud Computing.” National Institute of Standards and Technology, Sept. 2011. Web.

Ng, Alfred. “Amazon Tells Senators it Isn't to Blame for Capital One Breach.” CNET, 2019. Web.

Orban, Stephen. “6 Strategies for Migrating Applications to the Cloud.” Amazon Web Services, 2016. Web.

Sullivan, Dan. “Cloud Access Security Broker (CASB).” TechTarget, 2021. Web.

“What Is Secure Access Service Edge (SASE)?” Cisco, n.d. Web.

Applications Priorities 2023

Applications are the engine of the business: keep them relevant and modern

What we are facing today is transforming the ways in which we work, live, and relate to one another. Applications teams and portfolios MUST change to meet this reality.

Economic, social, and regulatory conditions have changed livelihoods, businesses, and marketplaces. Modern tools and technologies have acted as lifelines by minimizing operating and delivery costs, and in the process, establishing a strong foundation for growth and maturity.

As organizations continue to strengthen business continuity, disaster recovery, and system resilience, activities to simply "keep the lights on" are not enough. Be pragmatic in the prioritization and planning of your applications initiatives, and use your technologies as a foundation for your growth.

Your applications must meet the top business goals of your CXOs

• Ensure service continuity
• Improve customer experience
• Make data-driven decisions
• Maximize stakeholder value
• Manage risk

Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022, n=568.

Select and align your applications priorities to your business goals and objectives

Applications are critical components in any business strategic plan. They can directly influence an organization's internal and external brand and reputation, such as their:

• Uniqueness, competitiveness, and innovativeness in the industry.
• Ability to be dynamic, flexible, and responsive to changing expectations, business conditions, and technologies.

Therefore, business leaders are continuously looking for innovative ways to better position their application portfolios to satisfy their goals and objectives, i.e. applications priorities. Given the scope and costs often involved, these priorities must be carefully crafted to clearly state achievable business outcomes that satisfy
the different needs of very different customers, stakeholders, and users.

Today's business applications are good but leave room for improvement

72%
Average business application satisfaction score among IT leadership in 1582 organizations.

Source: CIO Business Vision, August 2021 to July 2022, N=190.

Five Applications Priorities for 2023

In this report, we explore five priorities for emerging and leading-edge technologies and practices that can improve on capabilities needed to meet the Ambitions of your organization.

Strengthen your foundations to better support your applications priorities

These key capabilities are imperative to the success of your applications strategy.

KPI and Metrics

Easily attainable and insightful measurements to gauge the progress of meeting strategic objectives and goals (KPIs), and the performance of individual teams, practices and processes (metrics).

BUSINESS ALIGNMENT

Gain an accurate understanding and interpretation of stakeholder, end-user, and customer expectations and priorities. These define the success of business products and services considering the priorities of individual business units and teams.

EFFICIENT DELIVERY & SUPPORT PRACTICE

Software delivery and support roles, processes, and tools are collaborative, well equipped and resourced, and optimized to meet changing stakeholder expectations.

Data Management & Governance

Ensuring data is continuously reliable and trustworthy. Data structure and integrations are defined, governed, and monitored.

Product & Service Ownership

Complete inventory and rationalization of the product and service portfolio, prioritized backlogs, roadmaps, and clear product and service ownership with good governance. This helps ensure this portfolio is optimized to meet its goals and objectives.

Strengthen your foundations to better support your applications priorities (cont'd)

These key capabilities are imperative to the success of your applications strategy.

Organizational Change Management

Manage the adoption of new and modified processes and technologies considering reputational, human, and operational concerns.

IT Operational Management

Continuous monitoring and upkeep of products and services to assure business continuity, and system reliability, robustness and disaster recovery.

Architectural Framework

A set of principles and standards that guides the consistent, sustainable and scalable growth of enterprise technologies. Changes to the architecture are made in collaboration with affected parties, such as security and infrastructure.

Application Security

The measures, controls, and tactics at the application layer that prevent vulnerabilities against external and internal threats and ensure compliance to industry and regulatory security frameworks and standards.

There are many factors that can stand in your team's way

Expectations on your applications team have increased, while the gap between how stakeholders and applications teams perceive effectiveness remains wide. This points to a need to clarify the requirements to deliver valuable and quality applications and address the pressures challenging your teams.

1. Attracting and retaining talent
2. Maximizing the return on technology
3. Confidently shifting to digital
4. Addressing competing priorities
5. Fostering a collaborative culture
6. Creating high-throughput teams

CIOs agree that at least some improvement is needed across key IT activities

Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022, n=568.

Pressure Point 1:
Attracting and Retaining Talent

Recent environmental pressures impacted traditional working arrangements and showed more workplace flexibility is often possible. At the same time, many employees' expectations about how, when, and where they choose to work have also evolved. Recruitment and retention are reflections of different sides of the same employee value proposition coin. Organizations that fail to reinvent their approach to attracting and retaining talent by focusing on candidate and employee experience risk turnover, vacancies, and lost opportunities that can negatively impact the bottom line.

Address the underlying challenges

• Lack of employee empowerment and few opportunities for learning and development.
• Poor coworker and manager relationships.
• Compensation and benefits are inadequate to maintain desired quality of life.
• Unproductive work environment and conflicting balance of work and life.
• Unsatisfactory employee experience, including lack of employee recognition
  and transparency of organizational change.

While workplace flexibility comes with many benefits, longer work hours jeopardize wellbeing.
62% of organizations reported increased working hours, while 80% reported an increase in flexibility.
Source: McLean & Company, 2022; n=394.

Be strategic in how you fill and train key IT skills and capabilities

• Cybersecurity
• Big Data/Analytics
• Technical Architecture
• DevOps
• Development
• Cloud

Source: Harvey Nash Group, 2021; n=2120.

Pressure Point 2:
Maximizing the Return of Technology

Recent environmental pressures impacted traditional working arrangements and showed more workplace flexibility is often possible. At the same time, many employees' expectations about how, when, and where they choose to work have also evolved. Recruitment and retention are reflections of different sides of the same employee value proposition coin. Organizations that fail to reinvent their approach to attracting and retaining talent by focusing on candidate and employee experience risk turnover, vacancies, and lost opportunities that can negatively impact the bottom line.

Address the underlying challenges

• Inability to analyze, propose, justify, and communicate modernization solutions in language the stakeholders understand and in a way that shows they clearly support business priorities and KPIs and mitigate risks.
• Little interest in documenting and rationalizing products and services through business-IT collaboration.
• Lack of internal knowledge of the system and loss of vendor support.
• Undefined, siloed product and service ownership and governance, preventing solutions from working together to collectively deliver more value.
• Little stakeholder appetite to invest in activities beyond "keeping the lights on."

Only 64% of applications were identified as effective by end users.
Effective applications are identified as at least highly important and have high feature and usability satisfaction.
Source: Application Portfolio Assessment, August 2021 to July 2022; N=315.

"Regardless of the many definitions of modernization floating around, the one characteristic that we should be striving for is to ensure our applications do an outstanding job of supporting the users and the business in the most effective and efficient manner possible."
Source: looksoftware.

Pressure Point 3:
Confidently Shifting to Digital

"Going digital" reshapes how the business operates and drives value by optimizing how digital and traditional technologies and tactics work together. This shift often presents significant business and technical risks to business processes, enterprise data, applications, and systems which stakeholders and teams are not aware of or prepared to accommodate.

Address the underlying challenges

• Differing perspectives on digital can lead to disjointed transformation initiatives, oversold benefits, and a lack of synergy among digital technologies and processes.
• Organizations have difficulty adapting to new technologies or rethinking current business models, processes, and ways of working because of the potential human, ethical, and reputational impacts and restrictions from legacy systems.
• Management lacks a framework to evaluate how their organization manages and governs business value delivery.
• IT is not equipped or resourced to address these rapidly changing business, customer, and technology needs.
• The wrong tools and technologies were chosen to support the shift to digital.

The shift to digital processes is starting, but slowly.
62% of respondents indicated that 1-20% of their processes were digitized during the past year.
Source: Tech Trends and Priorities 2023; N=500

Resistance to change and time/budget constraints are top barriers preventing companies from modernizing their applications.
Source: Konveyor, 2022; n=600.

Pressure Point 4:
Addressing Competing Priorities

Enterprise products and services are not used, operated, or branded in isolation. The various parties involved may have competing priorities, which often leads to disagreements on when certain business and technology changes should be made and how resources, budget, and other assets should be allocated. Without a broader product vision, portfolio vision, and roadmap, the various dependent or related products and services will not deliver the same level of value as if they were managed collectively.

Address the underlying challenges

• Undefined product and service ownership and governance, including escalation procedures when consensus cannot be reached.
• Lack of a unified and grounded set of value and quality definitions, guiding principles, prioritization standards, and broad visibility across portfolios, business capabilities, and business functions.
• Distrust between business units and IT teams, which leads to the scaling of unmanaged applications and fragmented changes and projects.
• Decisions are based on opinions and experiences without supporting data.

55% of CXOs stated some improvement is necessary in activities to understand business goals.
Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568.

CXOs are moderately satisfied with IT's performance as a business partner (average score of 69% among all CXOs). This sentiment is similarly felt among CIOs (64%).
Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568.

Pressure Point 5:
Fostering a Collaborative Culture

Culture impacts business results, including bottom-line revenue and productivity metrics. Leaders appreciate the impact culture can have on applications initiatives and wish to leverage this. How culture translates from an abstract concept to something that is measurable and actionable is not straightforward. Executives need to clarify how the desired culture will help achieve their applications strategy and need to focus on the items that will have the most impact.

Address the underlying challenges

• Broad changes do not consider the unique subcultures, personalities, and behaviors of the various teams and individuals in the organization.
• Leaders mandate cultural changes without alleviating critical barriers and do not embody the principles of the target state.
• Bureaucracy and politics restrict changes and encourage the status quo.
• Industry standards, technologies, and frameworks do not support or cannot be tailored to fit the desired culture.
• Some teams are deliberately excluded from the scoping, planning, and execution of key product and service delivery and management activities.

Agile does not solve team culture challenges.
43% of organizations cited organizational culture as a significant barrier to adopting and scaling Agile practices.
Source: Digital.ai, 2021.

"Providing a great employee experience" as the second priority (after recruiting) highlights the emphasis organizations are placing on helping employees adjust after having been forced to change the way work gets done.
Source: McLean & Company, 2022; N=826.

Use your applications priorities to help address your pressure points

Success can be dependent on your ability to navigate around or alleviate your pressure points. Design and market your applications priorities to bring attention to your pressure points and position them as key risk factors to their success.

Digital Experience (DX)

PRIORITY 1

• Deliver Valuable User, Customer, Employee, and Brand Experiences

Delivering valuable digital experiences requires the adoption of good management, governance, and operational practices to accommodate stakeholder, employee, customer, and end-user expectations of digital experiences (e.g. product management, automation, and iterative delivery). Technologies are chosen based on what best enables, delivers, and supports these expectations.

Introduction

Digital transformation is not just about new tools and technologies. It is also about delivering a valuable digital experience

What is digital experience (DX)?

Digital experience (DX) refers to the interaction between a user and an organization through digital products and services. Digital products and services are tools, systems, devices, and resources that gather, store, and process data; are continuously modernized; and embody eight key attributes that are described on the following slide. DX is broken down into four distinct perspectives*:

• Customer Experience – The immediate perceptions of transactions and interactions experienced through a customer's journey in the use of the organization's digital
  products and services.
• End-User Experience – Users' emotions, beliefs, and physical and psychological responses
  that occur before, during, or after interacting with a digital product or service.
• Brand Experience – The broader perceptions, emotions, thoughts, feelings and actions the public associate with the organization's brand and reputation or its products and services. Brand experience evolves over time as customers continuously engage with the brand.
• Employee Experience – The satisfaction and experience of an employee through their journey with the organization, from recruitment and hiring to their departure. How an employee embodies and promotes the organization brand and culture can affect their performance, trust, respect, and drive to innovate and optimize.

Digital products and services have a common set of attributes

Digital transformation is not just about new tools and technologies. It is also about delivering a valuable digital experience

• Digital products and services must keep pace with changing business and end-user needs as well as tightly supporting your maturing business model with continuous modernization. Focus your continuous modernization on the key characteristics that drive business value.
• Fit for purpose: Functionalities are designed and implemented for the purpose of satisfying the end user's needs and solving their problems.
• User-centric: End users see the product as rewarding, engaging, intuitive, and emotionally satisfying. They want to come back to it.
• Adaptable: The product can be quickly tailored to meet changing end-user and technology needs with reusable and customizable components.
• Accessible: The product is available on demand and on the end user's preferred interface.
  End users have a seamless experience across all devices.
• Private and secured: The end user's activity and data are protected from unauthorized access.
• Informative and insightful: The product delivers consumable, accurate, and trustworthy real-time data that is important to the end user.
• Seamless application connection: The product facilitates direct interactions with one or more other products through an uninterrupted user experience.
• Relationship and network building: The product enables and promotes the connection and interaction of people.

Signals

DX is critical for business growth and maturity, but the organization may not be ready

A good DX has become a key differentiator that gives organizations an advantage over their competition and peers. Shifts in working environments; employee, customer, and stakeholder expectations; and the advancements in modern technologies have raised the importance of adopting and transitioning to digital processes and tools to stay relevant and responsive to changing business and technology conditions.

Applications teams are critical to ensuring the successful delivery and operation of these digital processes and tools. However, they are often under-resourced and challenged to meet their DX goals.

• 7% of both business and IT respondents think IT has the resources needed to keep up with digital transformation initiatives and meet deadlines (Cyara, 2021).
• 43% of respondents said that the core barrier to digital transformation is a lack of skilled resources (Creatio, 2021).

	of organizations stated that at least 1% of processes were shifted from being manually completed to digitally completed in the last year. 29% of organizations stated at least 21% were shifted. Source: Tech Trends and Priorities 2023; N=500.
	of organizations recognized digital transformation is important for competitive advantage. 94% stated it is important to enhance customer experience, and 91% stated it will have a positive impact on revenue. Source: Cyara, 2021.

Drivers

Brand and reputation

Customers are swayed by the innovations and advancements in digital technologies and expect your applications team to deliver and support them. Your leaders recognize the importance of these expectations and are integrating them into their business strategy and brand (how the organization presents itself to its customers, employees and the public). They hope that their actions will improve and shape the company's reputation (public perception of the company) as effective, customer-focused, and forward-thinking.

Worker productivity

As you evolve and adopt more complex tools and technology, your stakeholders will expect more from business units and IT teams. Unfortunately, teams employing manual processes and legacy systems will struggle to meet these expectations. Digital products and services promote the simplification of complex operations and applications and help the business and your teams better align operational practices with strategic goals and deliver valuable DX.

Organization modernization

Legacy processes, systems, and ways of working are no longer suitable for meeting the strategic digital objectives and DX needs stakeholders expect. They drive up operational costs without increased benefits, impede business growth and innovation, and consume scarce budgets that could be used for other priorities. Shifting to digital tools and technologies will bring these challenges to light and demonstrate how modernization is an integral part of DX success.

Benefits & Risks

Benefits

• Flexibility & Satisfaction
• Adoption
• Reliability

Employees and customers can choose how they want to access, modify, and consume digital products and services. They can be tailored to meet the specific functional needs, behaviors, and habits of the end user.

The customer, end user, brand, and employee drive selection, design, and delivery of digital products and services. Even the most advanced technologies will fail if key roles do not see the value in their use.

Digital products and services are delivered with technical quality built into them, ensuring they meet the industry, regulatory, and company standards throughout their lifespan and in various conditions.

Risks

• Legacy & Lore
• Bureaucracy & Politics
• Process Inefficiencies
• No Quality Standards

Some stakeholders may not be willing to change due to their familiarity and comfort of business practices.

Competing and conflicting priorities of strategic products and services undermine digital transformation and broader modernization efforts.

Business processes are often burdened by wasteful activities. Digital products and services are only as valuable as the processes they support.

The performance and support of your digital products and services are hampered due to unmanageable technical debt because of a deliberate decision to bypass or omit quality good practices.

Address your pressure points to fully realize the benefits of this priority

Success can be dependent on your ability to address your pressure points.

Recommendations

Build a digital business strategy

A digital business strategy clearly articulates the goals and ambitions of the business to adopt digital practices, tools, and technologies. This document:

• Looks for ways to transform the business by identifying what technologies to embrace, what processes to automate, and what new business models to create.
• Unifies digital possibilities with your customer experiences.
• Establishes accountability with the executive leadership.
• States the importance of cross-functional participation from senior management across the organization.

Related Research:

• Define Your Digital Business Strategy

Learn, understand, and empathize with your users, employees, and customers

• To create a better product, solution, or service, understanding those who use it, their needs, and their context is critical.
• A great experience design practice can help you balance those goals so that they are in harmony with those of your users.
• IT leaders must find ways to understand the needs of the business and develop empathy on a much deeper level. This empathy is the foundation for a thriving business partnership.

Related Research:

• Apply Design Thinking to Build Empathy With the Business
• Implement and Mature Your User Experience Design Practice

Recommendations

Center product and service delivery decisions and activities on DX and quality

User, customer, employee, and brand are integral perspectives on the software development lifecycle (SDLC) and the management and governance practices supporting digital products and services. It ensures quality standards and controls are consistently upheld while maintaining alignment with various needs and priorities. The goal is to come to a consensus on a universal definition and approach to embed quality and DX-thinking throughout the delivery process.

Related Research:

• Modernize Your SDLC
• Make the Case for Product Delivery
• Build a Software Quality Assurance Program

Instill collaborative delivery practices

Today's rapidly scaling and increasingly complex digital products and services create mounting pressure on delivery teams to release new features and changes quickly and with sufficient quality. This pressure is further compounded by the competing priorities of individual stakeholders and the nuances among different personas of digital products and services.

A collaborative delivery practice sets the activities, channels, and relationships needed to deliver a valuable and quality product or service with cross-functional awareness, accountability, and agreement.

Related Research:

• Implement Agile Practices That Work
• Implement DevOps Practices That Work
• Build Your BizDevOps Playbook

Recommendations

Continuously monitor and modernize your digital products and services

Today's modern digital products and services are tomorrow's shelfware. They gradually lose their value, and the supporting technologies will become obsolete. Modernization is a continuous need.

Data-driven insights help decision makers decide which products and services to retire, upgrade, retrain on, or maintain to meet the demands of the business.

Enhancements focusing on critical business capabilities strengthen the case for investment and build trust with all stakeholders.

Related Research:

• Application Portfolio Assessment: End User Feedback
• Application Portfolio Management Foundations
• Modernize Your Applications

CASE STUDY
Mastercard in Asia

Focus on the customer journey

Chief Marketing Officer M.V. Rajamannar (Raja) wanted to change Mastercard's iconic "Priceless" ad campaign (with the slogan "There are some things money can't buy. For everything else there's Mastercard."). The main reasons were that the campaign relied on one-way communication and targeted end customers, even though Mastercard doesn't issue cards directly to customers; partner banks do. To drive the change in campaign, Raja and his team created a digital engine that leveraged digital and social media. Digital engine is a seven-step process based on insights gleaned from data and real-time optimization.

1. Emotional spark: Using data to understand customers' passion points, Mastercard builds videos and creatives to ignite an emotional spark and give customers a reason to engage. For example, weeks before New Year's Eve, Mastercard produced a video with Hugh Jackman to encourage customers to submit a story about someone who deeply mattered to them. The authors of the winning story would be flown to reunite with those both distant and dear.
2. Engagement: Mastercard targets the right audience with a spark video through social media to encourage customers to share their stories.
3. Offers: To help its partner banks and merchants in driving their business, the company identifies the best offers to match consumers' interests. In the above campaign, Mastercard's Asia-Pacific team found that Singapore was a favorite destination for Indian customers, so they partnered with Singapore's Resorts World Sentosa with an attractive offer.
4. Real-time optimization: Mastercard optimizes, in real time, a portfolio of several offers through A/B testing and other analysis.
5. Amplification: Real-time testing provides confidence to Mastercard about the potential success of these offers and encourages its bank and merchant partners to co-market and co-fund these campaigns.
6. Network effects: A few weeks after consumers submitted their stories about distant loved ones, Mastercard selected winners, produced videos of them surprising their friends and families, and used these videos in social media to encourage sharing.
7. Incremental transactions: These programs translate into incremental business for banks who issue cards, for merchants where customers spend money, and for Mastercard, which gets a portion of every transaction.

Source: Harvard Business Review Press

CASE STUDY
Mastercard in Asia (cont'd)

Focus on the customer journey

1. Emotional Spark
   Drives genuine personal stories
2. Engagement
   Through Facebook
   and social media
3. Offers
   From merchants
   and Mastercard assets
4. Optimization
   Real-time testing of offers and themes
5. Amplification
   Paid and organic programmatic buying
6. Network Effects
   Sharing and
   mass engagement
7. Incremental Transactions
   Win-win for all parties

CASE STUDY
Mastercard in Asia (cont'd)

The Mastercard case highlights important lessons on how to engage customers:

• Have a broad message. Brands need to connect with consumers over how they live and spend their time. Organizations need to go beyond the brand or product message to become more relevant to consumers' lives. Dove soap was very successful in creating a conversation among consumers with its "Real Beauty" campaign, which focused not on the brand or even the product category, but on how women and society view beauty.
• Shift from storytelling to story making. To break through the clutter of advertising, companies need to move from storytelling to story making. A broader message that is emotionally engaging allows for a two-way conversation.
• Be consistent with the brand value. The brand needs to stand for something, and the content should be relevant to and consistent with the image of the brand. Pepsi announced an award of $20 million in grants to individuals, businesses, and nonprofits that promote a new idea to make a positive impact on community. A large number of submissions were about social causes that had nothing to do with Pepsi, and some, like reducing obesity, were in conflict with Pepsi's product.
• Create engagement that drives business. Too much entertainment in ads may engage customers but detract from both communicating the brand message and increasing sales. Simply measuring the number of video views provides only a partial picture of a program's success.

Intelligent Automation

PRIORITY 2

• Extend Automation Practices with AI and ML

AI and ML are rapidly growing. Organizations see the value of machines intelligently executing high-performance and dynamic tasks such as driving cars and detecting fraud. Senior leaders see AI and ML as opportunities to extend their business process automation investments.

Introduction

Intelligent automation is the next step in your business process automation journey

What is intelligent automation (IA)?

Intelligent automation (IA) is the combination of traditional automation technologies, such as business process management (BPM) and robotic process automation (RPA), with AI and ML. The goal is to further streamline and scale decision making across various business processes by:

• Removing human interactions.
• Addressing decisions that involve complex variables.
• Automatically adapting processes to changing conditions.
• Bridging disparate automation technologies into an integrated end-to-end value delivery pipeline.

"For IA to succeed, employees must be involved in the transformation journey so they can experience firsthand the benefits of a new way of working and creating business value," (Cognizant).

What is the difference between IA and hyperautomation?

"Hyperautomation is the act of automating everything in an organization that can be automated. The intent is to streamline processes across an organization using intelligent automation, which includes AI, RPA and other technologies, to run without human intervention. … Hyperautomation is a business-driven, disciplined approach that organizations use to rapidly identify, vet, and automate as many business and IT processes as possible" (IBM, 2021).

Note that hyperautomation often enables IA, but teams solely adopting IA do not need to abide to its automation-first principles.

IA is a combination of various tools and technologies

What tools and technologies are involved in IA?

• Artificial intelligence (AI) & Machine Learning (ML) – AI systems perform tasks mimicking human intelligence such as learning from experience and problem solving. AI is making its own decisions without human intervention. Machine learning systems learn from experience and without explicit instructions. They learn patterns from data then analyze and make predictions based on past behavior and the patterns learned. AI is a combination of technologies and can include machine learning.
• Intelligent Business Process Management System (iBPMS) – Combination of BPM tools with AI and other intelligence capabilities.
• Robotic Process Automation (RPA) – Robots leveraging an application's UI rather than programmatic access. Automate rules-based, repetitive tasks performed by human workers with AI/ML.
• Process Mining & Discovery – Process mining involves reading system event logs and application transactions and applying algorithmic analysis to automatically identify and map inferred business processes. Process discovery involves unintrusive virtual agents that sit on a user's desktop and record and monitor how they interact with applications to perform tasks and processes. Algorithms are then used to map and analyze the processes.
• Intelligent Document Processing – The conversion of physical or unstructured documents into a structured, digital format that can be used in automation solutions. Optical character recognition (OCR) and natural language processing (NPL) are common tools used to enable this capability.
• Advanced Analytics – The gathering, synthesis, transformation, and delivery of insightful and consumable information that supports data-driven decision making. Data is queried from various disparate sources and can take on a variety of structured and unstructured formats.

Signals

Process automation is an executive priority and requires organizational buy-in

Stakeholders recognize the importance of business process automation and AI and are looking for ways to deliver more value using these technologies.

• 90% of executives stated automating business workflows post-COVID-19 will ensure business continuity (Kofax, 2022).
• 88% of executives stated they need to fast-track their end-to-end digital transformation (Kofax, 2022).

However, the advertised benefits to vendors of enabling these desired automations may not be easily achievable because of:

• Manual and undocumented business processes.
• Fragmented and inaccessible systems.
• Poor data quality, insights, and security.
• The lack of process governance and management practice.

	of CXOs stated staff sufficiency, skill and engagement issues as a minor IT pain point compared to 51% of CIOs stated this issue as a major pain point. Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568.
	of organizations have already invested in AI or machine learning. Source: Tech Trends and Priorities 2023; N=662

Drivers

Quality & throughput

Products and services delivered through an undefined and manual process risk the creation of preventable and catchable defects, security flaws and holes, missing information, and other quality issues. IA solutions consistently reinforce quality standards the same way across all products and services while tailoring outputs to meet an individual's specific needs. Success is dependent on the accurate interpretation and application of quality standards and the user's expectations.

Worker productivity

IA removes the tedious, routine, and mundane tasks that distract and restrict employees from doing more valuable, impactful, and cognitively focused activities. Practical insights can also be generated through IA tools that help employees make data-driven decisions, evaluate problems from different angles, and improve the usability and value of the products and services they produce.

Good process management practices

Automation magnifies existing inefficiencies of a business process management practice, such as unclear and outdated process documentation and incorrect assumptions. IA reinforces the importance of good business process optimization practices, such as removing waste and inefficiencies in a thoughtful way, choosing the most appropriate automation solution, and configuring the process in the right way to maximize the solution's value.

Benefits & Risks

Benefits

• Documentation
• Hands-Off
• Reusability

All business processes must be mapped and documented to be automated, including business rules, data entities, applications, and control points.

IA can be configured and orchestrated to automatically execute when certain business, process, or technology conditions are met in an unattended or attended manner.

IA is applicable in use cases beyond traditional business processes, such as automated testing, quality control, audit, website scraping, integration platform, customer service, and data transfer.

Risks

• Data Quality & Bias
• Ethics
• Recovery & Security
• Management

The accuracy and relevance of the decisions IA makes are dependent on the overall quality of the data
used to train it.

Some decisions can have significant reputational, moral, and ethical impacts if made incorrectly.
The question is whether it is appropriate for a non-human to make that decision.

IA is composed of technologies that can be compromised or fail. Without the proper monitoring, controls,
and recovery protocols, impacted IA will generate significant business and IT costs and can potentially harm customers, employees, and the organization.

Low- and no-code capabilities ease and streamline IA development, which makes it susceptible to becoming unmanageable. Discipline is needed to ensure IA owners are aware of the size and health of the IA portfolio.

Address your pressure points to fully realize the benefits of this priority

Success can be dependent on your ability to address your pressure points.

Recommendations

Build your business process automation playbook and practice

Formalize your business process automation practice with a good toolkit and a repeatable set of tactics and techniques.

• Clarify the problem being solved with IA.
• Optimate your processes. Apply good practices to first optimize (opti-) and then automate (-mate) key business processes.
• Deliver minimum viable automations (MVAs). Maximize the learning of automation solutions and business operational changes through small, strategic automation use cases.

Related Research:

• Build a Winning Business Process Automation Playbook

Explore the various IA tooling options

Each IA tool will address a different problem. Which tool to choose is dependent on a variety of factors, such as functional suitability, technology suitability, delivery and support capabilities, alignment to strategic business goals, and the value it is designed to deliver.

Related Research:

• Build Your First RPA Bot
• Build a Chatbot Proof of Concept

Recommendations

Introduce AI and ML thoughtfully and with a plan

Despite the many promises of AI, organizations are struggling to fully realize its potential. The reasons boil down to a lack of understanding of when these technologies should and shouldn't be used, as well as a fear of the unknown. The plan to adopt AI should include:

• Understanding of what AI really means in practice.
• Identifying specific applications of AI in the business.
• Understanding the type of AI applicable for the situation.

Related Research:

• Get Started with Artificial Intelligence
• Create an Architecture for AI

Mitigate AI and ML bias

Biases can be introduced into an IA system at any stage of the development process, from the data you collect, to the way you collect it, to which algorithms are used and what assumptions were made. In most cases, AI and ML bias is a is a social, political, and business problem.

While bias may not be intentional nor completely prevented or eliminated, early detection, good design, and other proactive preventative steps can be taken to minimize its scope and impact.

Related Research:

• Mitigate Machine Bias

CASE STUDY
University Hospitals

Challenge

University Hospitals Cleveland (UH) faces the same challenge that every major hospital confronts regarding how to deliver increasingly complex, high-quality healthcare to a diverse population efficiently and economically. In 2017, UH embarked on a value improvement program aiming to improve quality while saving $400 million over a five-year period.

In emergency department (ED) and inpatient units, leaders found anticipating demand difficult, and consequently units were often over-staffed when demand was low and under-staffed when demand was high. Hospital leaders were uncertain about how to reallocate resources based on capacity needs.

Solution

UH turned to Hospital IQ's Census Solution to proactively manage capacity, staff, and flow in the ED and inpatient areas.

By applying AI, ML, and external data (e.g. weather forecasts) to the hospital's own data (including EMR data and hospital policies), the solution helped UH make two-day census forecasts that managers used to determine whether to open or close in-patient beds and, when necessary, divert low-acuity patients to other hospitals in the system to handle predicted patient volume.

Source: University Hospitals

Results

ED boarding hours have declined by 10% and the hospital has seen a 50% reduction in the number of patients who leave the hospital without
being seen.

UH also predicts in advance patients ready for discharge and identifies roadblocks, reducing the average length of stay by 15%. UH is able to better manage staff, reducing overtime and cutting overall labor costs.

The hospital has also increased staff satisfaction and improved patient safety by closing specific units on weekends and increasing the number of rooms that can be sterilized.

Proactive Application Management

PRIORITY 3

• Strengthen Applications to Prevent and Minimize the Impact of Future Issues

Application management is often viewed as a support function rather than an enabler of business growth. Focus and investments are only placed on application management when it becomes a problem. The lack of governance and practice accountability leaves this practice in a chaotic state: politics take over, resources are not strategically allocated, and customers are frustrated. As a result, application management is often reactive and brushed aside for new development.

Introduction

What is application management?

Application management ensures valuable software is successfully delivered and is maintained for continuous and sustainable business operations. It contains a repeatable set of activities needed to rationalize and roadmap products and services while balancing priorities of new features and maintenance tasks.

Unfortunately, application management is commonly perceived as a practice that solely addresses issues, updates, and incidents. However, application management teams are also tasked with new value delivery that was not part of the original release.

Why is an effective application maintenance (reactive) practice not good enough?

Application maintenance is the "process of modifying a software system or its components after delivery to correct faults, improve performance or other attributes, or adapt to a changed environment or business process," (IEEE, 1998). While it is critical to quickly fix defects and issues when they occur, reactively addressing them is more expensive than discovering them early and employing the practices to prevent them.

Even if an application is working well, its framework, architecture, and technology may not be compatible with the possible upcoming changes stakeholders and vendors may want to undertake. Applications may not be problems now, but they soon can be.

What motivates proactive application changes?

Proactive application management must be disciplined and applied strategically

Proactive application management practices are critical to maintaining business continuity. They require continuous review and modification so that applications are resilient and can address current and future scenarios. Depending on the value of the application, its criticality to business operations, and its susceptibility to technology change, a more proactive management approach may be warranted. Stakeholders can then better manage resources and budget according to the needs of specific products.

Reactive Management

Run-to-Failure

Fix and enhance the product when it breaks. In most cases, a plan is in place ahead of a failure, so that the problem can be addressed without significant disruption and costs.

Preventive

Regularly inspect and optimize the product to reduce the likelihood that it will fail in the future. Schedule inspections based on a specific timeframe or usage threshold.

Predictive

Predict failures before they happen using performance and usage data to alert teams when products are at risk of failure according to specified conditions.

Reliability and Risk Based

Analyze all possible failure scenarios for each component of the product and create tailored delivery plans to improve the stability, reliability, and value of each product.

Proactive Management

Signals

Applications begin to degrade as soon as they are used

Today's applications are tomorrow's shelfware. They gradually lose their value, stability, robustness, and compatibility with other enterprise technologies. The longer these applications are left unattended or simply "keeping the lights on," the more risks they will bring to the application portfolio, such as:

• Discovery and exploitation of security flaws and gaps.
• Increasing the lock-in to specific vendor technologies.
• Inconsistent application performance across various workloads.

These impacts are further compounded by the continuous work done on a system burdened with technical debt. Technical debt describes the result of avoided costs that, over time, cause ongoing business impacts. Left unaddressed, technical debt can become an existential threat that risks your organization's ability to effectively compete and serve its customers. Unfortunately, most organizations have a significant, growing, unmanageable technical debt portfolio.

	of respondents stated they saw an increase in perceived change in technical debt during the past three years. A quarter of respondents indicated that it stayed the same. Source: McKinsey Digital, 2020.
US $4.35 Million	is the average cost of a data breach in 2022. This figure represents a 2.6% increase from last year. The average cost has climbed 12.7% since 2020. Source: IBM, 2022; N=537.

Drivers

Technical debt

Historical decisions to meet business demands by deferring key quality, architectural, or other software delivery activities often lead to inefficient and incomplete code, fragile legacy systems, broken processes, data quality problems, and the other contributors to technical debt. The impacts for this challenge is further heightened if organizations are not actively refactoring and updating their applications behind the scenes. Proactive application management is intended to raise awareness of application fragility and prioritize comprehensive refactoring activities alongside new feature development.

Long-term application value

Applications are designed, developed, and tested against a specific set of parameters which may become less relevant over time as the business matures, technology changes, and user behaviors and interactions shift. Continuous monitoring of the application system, regular stakeholder and user feedback, and active technology trend research and vendor engagement will reveal tasks to prepare an application for future value opportunities or stability and resilience concerns.

Security and resiliency

Innovative approaches to infiltrating and compromising applications are becoming prevailing stakeholder concerns. The loopholes and gaps in existing application security protocols, control points, and end-user training are exploited to gain the trust of unsuspecting users and systems. Proactive application management enforces continuous security reviews to determine whether applications are at risk. The goal is to prevent an incident from happening by hardening or complementing measures already in place.

Benefits & Risks

Benefits

• Consistent Performance
• Robustness
• Operating Costs

Users expect the same level of performance and experience from their applications in all scenarios. A proactive approach ensures the configurations meet the current needs of users and dependent technologies.

Proactively managed applications are resilient to the latest security concerns and upcoming trends.

Continuous improvements to the underlying architecture, codebase, and interfaces can minimize the cost to maintain and operate the application, such as the transition to a loosely coupled architecture and the standardization of REST APIs.

Risks

• Stakeholder Buy-In
• Delayed Feature Releases
• Team Capacity
• Discipline

Stakeholders may not see the association between the application's value and its technical quality.

Updates and enhancements are system changes much like any application function. Depending
on the priority of these changes, new functions may be pushed off to a future release cycle.

Applications teams require dedicated capacity to proactively manage applications, but they are often occupied meeting other stakeholder demands.

Overinvesting in certain application management activities (such as refactoring, re-architecture, and redesign) can create more challenges. Knowing how much to do is important.

Address your pressure points to fully realize the benefits of this priority

Success can be dependent on your ability to address your pressure points.

Recommendations

Reinforce your application maintenance practice

Maintenance is often viewed as a support function rather than an enabler of business growth. Focus and investments are only placed on maintenance when it becomes a problem.

• Justify the necessity of streamlined maintenance.
• Strengthen triaging and prioritization practices.
• Establish and govern a repeatable process.

Ensure product issues, incidents, defects, and change requests are promptly handled to minimize business and IT risks.

Related Research:

• Streamline Application Maintenance

Build an application management practice

Apply the appropriate management approaches to maintain business continuity and balance priorities and commitments among maintenance and new development requests.

This practice serves as the foundation for creating exceptional customer experience by emphasizing cross-functional accountability for business value and product and service quality.

Related Research:

• Streamline Application Management

Recommendations

Manage your technical debt

Technical debt is a type of technical risk, which in turn is business risk. It's up to the business to decide whether to accept technical debt or mitigate it. Create a compelling argument to stakeholders as to why technical debt should be a business priority rather than just an IT one.

• Define and identify your technical debt.
• Conduct a business impact analysis.
• Identify opportunities to better manage technical debt.

Related Research:

• Manage Your Technical Debt

Gauge your application's health

Application portfolio management is nearly impossible to perform without an honest and thorough understanding of your portfolio's alignment to business capabilities, business value, total cost of ownership, end-user reception and satisfaction, and technical health.

Develop data-driven insights to help you decide which applications to retire, upgrade, retrain on, or maintain to meet the demands of the business.

Related Research:

• Application Portfolio Management Foundations

Recommendations

Adopt site reliability engineering (SRE) and DevOps practices

Site reliability engineering (SRE) is an operational model for running online services more reliably by a team of dedicated reliability-focused engineers.

DevOps, an operational philosophy promoting development and operations collaboration, can bring the critical insights to make application management practices through SRE more valuable.

Related Research:

• Implement DevOps Practices That Work
• Site Reliability Engineering: What Is It? Why Is It Important for Online Businesses?
• SLOs in Site Reliability Engineering

CASE STUDY
Government Agency

Goal

A government agency needed to implement a disciplined, sustainable application delivery, planning, and management process so their product delivery team could deliver features and changes faster with higher quality. The goal was to ensure change requests, fixes, and new features would relieve requester frustrations, reduce regression issues, and allow work to be done on agreeable and achievable priorities organization-wide. The new model needed to increase practice efficiency and visibility in order to better manage technical debt and focus on value-added solutions.

Solution

This organization recognized a number of key challenges that were inhibiting its team's ability to meet its goals:

• The product backlog had become too long and unmanageable.
• Delivery resources were not properly allocated to meet the skills and capabilities needed to successfully meet commitments.
• Quality wasn't defined or enforced, which generated mounting technical debt.
• There was a lack of clear metrics and defined roles and responsibilities.
• The business had unrealistic and unachievable expectations.

Source: Info-Tech Workshop

Key practices implemented

• Schedule quarterly business satisfaction surveys.
• Structure and facilitate regular change advisory board meetings.
• Define and enforce product quality standards.
• Standardize a streamlined process with defined roles.
• Configure management tools to better handle requests.

Multisource Systems

PRIORITY 4

• Manage an Ecosystem Composed of In-House and Outsourced Systems

Various market and company factors are motivating a review on resource and system sourcing strategies. The right sourcing model provides key skills, resources, and capabilities to meet innovation, time to market, financial, and quality goals of the business. However, organizations struggle with how best to support sourcing partners and to allocate the right number of resources to maximize success.

Introduction

A multisource system is an ecosystem of integrated internally and externally developed applications, data, and infrastructure. These technologies can be custom developed, heavily configured vendor solutions, or they may be commercial off-the-shelf (COTS) solutions. These systems can also be developed, supported, and managed by internal staff, in partnership with outsourced contractors, or be completely outsourced. Multisource systems should be configured and orchestrated in a way that maximizes the delivery of specific value drivers for the targeted audience.

Successfully selecting a sourcing approach is not a simple RFP exercise to choose the lowest cost

Defining and executing a sourcing approach can be a significant investment and risk because of the close interactions third-party services and partners will have with internal staff, enterprise applications and business capabilities. A careful selection and design is necessary.

The selection of a sourcing partner is not simple. It involves the detailed inspection and examination of different candidates and matching their fit to the broader vision of the multisource system. In cases where control is critical, technology stack and resource sourcing consolidation to a few vendors and partners is preferred. In other cases, where worker productivity and system flexibility are highly prioritized, a plug-and-play best-of-breed approach is preferred.

Sourcing needs to be driven by your department and system strategies

How does the department want to be perceived?

The image that your applications department and teams want to reflect is frequently dependent on the applications they deliver and support, the resources they are composed of, and the capabilities they provide.

Therefore, choosing the right sourcing approach should be driven by understanding who the teams are and want to be (e.g. internal builder, an integrator, a plug-in player), what they can or want to do (e.g. custom-develop or implement), and what they can deliver or support (e.g. cloud or on-premises) must be established.

What value is the system delivering?

Well-integrated systems are the lifeblood of your organization. They provide the capabilities needed to deliver value to customers, employees, and stakeholders. However, underlying system components may not be sourced under a unified strategy, which can lead to duplicate vendor services and high operational costs.

The right sourcing approach ensures your partners address key capabilities in your system's delivery and support, and that they are positioned to maximize the value of critical and high-impact components.

Signals

Business demand may outpace what vendors can support or offer

Outsourcing and shifting to a buy-over-build applications strategy are common quick fixes to dealing with capacity and skills gaps. However, these quick fixes often become long-term implementations that are not accounted for in the sourcing selection process. Current application and resource sourcing strategies must be reviewed to ensure that vendor arrangements meet the current and upcoming demands and challenges of the business, customers, and enterprise technologies, such as:

• Pressure from stakeholders to lower operating costs while maintaining or increasing quality and throughput.
• Technology lock-in that addresses short-term needs but inhibits long-term growth and maturity.
• Team capacity and talent acquisition not meeting the needs of the business.

	of respondents stated they outsourced software development fully or partly in the last 12 months (2021). Source: Coding Sans, 2021.
	of respondents stated they were at least somewhat satisfied with the result of outsourcing software development. Source: Coding Sans, 2021.

Drivers

Business-managed applications

Employees are implementing and building applications without consulting, notifying, or heeding the advice of IT. IT is often ill-equipped and under-resourced to fight against shadow IT. Instead, organizations are shifting the mindset of "fight shadow IT" to "embrace business-managed applications," using good practices in managing multisource systems. A multisource approach strikes the right balance between user empowerment and centralized control with the solutions and architecture that can best enable it.

Unique problems to solve

Point solutions offer features to address unique use cases in uncommon technology environments. However, point solutions are often deployed in siloes with limited integration or overlap with other solutions. The right sourcing strategy accommodates the fragmented nature of point solutions into a broader enterprise system strategy, whether that be:

• Multisource best of breed – integrate various technologies that provide subsets of the features needed for supporting business functions.
• Multisource custom – integrate systems built in-house with technologies developed by external organizations.
• Vendor add-ons and integrations – enhance an existing vendor's offering by using their system add-ons as upgrades, new add-ons, or integrations.

Vendor services

Some vendor services in a multisource environment may be redundant, conflicting, or incompatible. Given that multisource systems are regularly changing, it is difficult to identify what services are affected, what would be needed to fill the gap of the removed solution, or which redundant services should be removed.

A multisource approach motivates the continuous rationalization of your vendor services and partners to determine the right mixture of in-house and outsourced resources, capabilities, and technologies.

Benefits & Risks

Benefits

• Business-Focused Solution
• Flexibility
• Cost Optimization

Multisource systems can be designed to support an employee's ability to select the tools they want and need.

The environment is architected in a loosely coupled approach to allow applications to be easily added, removed, and modified with minimized impact to other integrated applications.

Rather than investing in large solutions upfront, applications are adopted when they are needed and are removed when little value is gained. Disciplined application portfolio management is necessary to see the full value of this benefit.

Risks

• Manageable Sprawl
• Policy Adherence
• Integration & Compatibility

The increased number and diversity of applications in multisource system environments can overwhelm system managers who do not have an effective application portfolio management practice.

Fragmented application implementations risk inconsistent adherence to security and other quality policies, especially in situations where IT is not involved.

Application integration can quickly become tangled, untraceable, and unmanageable because of varying team and vendor preferences for specific integration technologies and techniques.

Address your pressure points to fully realize the benefits of this priority

Success can be dependent on your ability to address your pressure points.

Recommendations

Define the goals of your applications department and product vision

Understanding the applications team's purpose and image is critical in determining how the system they are managing and the skills and capacities they need should be sourced.

Changing and conflicting definitions of value and goals make it challenging to convey an agreeable strategy of the multisource system. An achievable vision and practical tactics ensure all parties in the multisource system are moving in the same direction.

Related Research:

• Build an Application Department Strategy
• Deliver On Your Digital Product Vision

Develop a sourcing partner strategy

Almost half of all sourcing initiatives do not realize projected savings, and the biggest reason is the choice of partner (Zhang et al., 2018). Making the wrong choice means inferior products, higher costs and the loss of both clients and reputation.

Choosing the right sourcing partner involves understanding current skills and capacities, finding the right matching partner based on a desired profile, and managing a good working relationship that sees short-term gains and supports long-term goals.

Related Research:

• Select a Sourcing Partner for Your Application Development Team
• Drive Successful Sourcing Outcomes with a Robust RFP Process
• Jump Start Your Vendor Management Initiative

Recommendations

Strengthen enterprise integration practices

Integration strategies that are focused solely on technology are likely to complicate rather than simplify because little consideration is given on how other systems and processes will be impacted. Enterprise integration needs to bring together business process, applications, and data – in that order.

Kick-start the process of identifying opportunities for improvement by mapping how applications and data are coordinated to support business activities.

Related Research:

• Build Effective Enterprise Integration on the Back of Business Process
• Build an Application Integration Strategy
• Build a Data Integration Strategy

Manage your solution architecture and application portfolio

Haphazardly implementing and integrating applications can generate significant security, performance, and data risks. A well-thought-through solution architecture is essential in laying the architecture quality principles and roadmap on how the multisource system can grow and evolve in a sustainable and maintainable way.

Good application portfolio management complements the solution architecture as it indicates when low-value and unused applications should be removed to reduce system complexity.

Related Research:

• Enhance Your Solution Architecture Practices
• Application Portfolio Management Foundations

Recommendations

Embrace business-managed applications

Multisource systems bring a unique opportunity to support the business and end users' desire to implement and develop their own applications. However, traditional models of managing applications may not accommodate the specific IT governance and management practices required to operate business-managed applications:

• A collaborative and trusting business-IT relationship is key.
• The role of IT must be reimagined.
• Business must be accountable for its decisions.

Related Research:

• Embrace Business-Managed Applications

CASE STUDY
Cognizant

Situation

• Strives to be primarily an industry-aligned organization that delivers multiple service lines in multiple geographies.
• Cognizant seeks to carefully consider client culture to create a one-team environment.
• Value proposition is a consultative approach bringing thought leadership and mutually adding value to the relationship vs. the more traditional order-taker development partner.
• Wants to share in solution development to facilitate shared successes. Geographic alignment drives knowledge of the client and their challenges, not just about time zone and supportability.
• Offers one of the largest offshore capabilities in the world, supported by local and nearshore resources to drive local knowledge.
• Today's clients don't typically want a black box, they are sophisticated and want transparency around the process and solution, to have a partner.
• Clients do want to know where the work is being delivered from, how it's being done.

Source: interview with Jay MacIsaac, Cognizant.

Approach

• Best relationship comes where teams operate as one.
• Clients are seeking value, not a development black box.
• Clients want to have a partner they can engage with, not just an order taker.
• Want to build a one-team culture with shared goals and deliver business value.
• Seek a partner that will add to their thinking not echo it.

Results

• Cognizant is continuing to deliver double-digit growth and continues to strive for top quartile performance.
• Growth in the client base has seen the company grow to over 340,000 associates worldwide.

Digital Organization as a Platform

PRIORITY 5

• Create a Common Digital Interface to Access All Products and Services

A digital platform enables organizations to leverage a flexible, reliable, and scalable foundation to create a valuable DX, ease delivery and management efforts, maximize existing investments, and motivate the broader shift to digital. This approach provides a standard to architect, integrate, configure, and modernize the applications that compose the platform.

Introduction

What is digital organization as a platform (DOaaP)?

Digital organization as a platform (DOaaP) is a collection of integrated digital services, products, applications, and infrastructure that is used as a vehicle to meet and exceed an organization's digital strategies. It often serves as an accessible "place for exchanges of information, goods, or services to occur between producers and consumers as well as the community that interacts
with said platform" (Watts, 2020).

DOaaP involves a strategy that paves the way for organizations to be digital. It helps organizations use their assets (e.g. data, processes, products, services) in the most effective ways and become more open to cooperative delivery, usage, and management. This opens opportunities for innovation and cross-department collaborations.

How is DOaaP described?

1. Open and Collaborative
   • Open organization: open data, open APIs, transparency, and user participation.
   • Collaboration, co-creation, crowdsourcing, and innovation
2. Accessible and Connected
   • Digital inclusion
   • Channel ubiquity
   • Integrity and interoperability
   • Digital marketplace
3. Digital and Programmable
   • Digital identity
   • Policies and processes as code
   • Digital products and services
   • Enabling digital platforms

Digital organizations follow a common set of principles and practices

Customer-centricity

Digital organizations are driven by customer focus, meeting and exceeding customer expectations. It must design its services with a "digital first" principle, providing access through every expected channel and including seamless integration and interoperability with various departments, partners, and third-party services. It also means creating trust in its ability to provide secure services and to keep privacy and ethics as core pillars.

Leadership, management, and strategies

Digital leadership brings customer focus to the enterprise and its structures and organizes efficient networks and ecosystems. Accomplishing this means getting rid of silos and a siloed mentality and aligning on a digital vision to design policies and services that are efficient, cost-effective, and provide maximum benefit to the user. Asset sharing, co-creation, and being open and transparent become cornerstones of a digital organization.

Infrastructure

Providing digital services across demographics and geographies requires infrastructure, and that in turn requires long-term vision, smart investments, and partnerships with various source partners to create the necessary foundational infrastructure upon which to build digital services.

Digitization and automation

Automation and digitization of processes and services, as well as creating digital-first products, lead to increased efficiency and reach of the organization across demographics and geographies. Moreover, by taking a digital-first approach, digital organizations future-proof their services and demonstrate their commitment to stakeholders.

Enabling platforms

DOaaP embraces open standards, designing and developing organizational platforms and ecosystems with a cloud-first mindset and sound API strategies. Developer experience must also take center stage, providing the necessary tools and embracing Agile and DevOps practices and culture become prerequisites. Cybersecurity and privacy are central to the digital platform; hence they must be part of the design and development principles and practices.

Signals

The business expects support for digital products and services

Digital transformation continues to be a high-priority initiative for many organizations, and they see DOaaP as an effective way to enable and exploit digital capabilities. However, DOaaP unleashes new strategies, opportunities, and challenges that are elusive or unfamiliar to business leaders. Barriers in current business operating models may limit DOaaP success, such as:

• Department and functional silos
• Dispersed, fragmented and poor-quality data
• Ill-equipped and under-skilled resources to support DOaaP adoption
• System fragmentation and redundancies
• Inconsistent integration tactics employed across systems
• Disjointed user experience leading to low engagement and adoption

DOaaP is not just about technology, and it is not the sole responsibility of either IT or business. It is the collective responsibility of the organization.

	of organizations plan to unlock new value through digital. 50% of organizations are planning major transformation over the next three years. Source: Nash Squared, 2022.
	of organizations are undertaking digital expansion projects focused on scaling their business with technology. This result is up from 57% in 2021. Source: F5 Inc, 2022.

Drivers

Unified brand and experience

Users should have the same experience and perception of a brand no matter what product or service they use. However, fragmented implementation of digital technologies and inconsistent application of design standards makes it difficult to meet this expectation. DOaaP embraces a single design and DX standard for all digital products and services, which creates a consistent perception of your organization's brand and reputation irrespective of what products and services are being used and how they are accessed.

Accessibility

Rapid advancement of end-user devices and changes to end-user behaviors and expectations often outpace an organization's ability to meet these requirements. This can make certain organization products and services difficult to find, access and leverage. DOaaP creates an intuitive and searchable interface to all products and services and enables the strategic combination of technologies to collectively deliver more value.

Justification for modernization

Many opportunities are left off the table when legacy systems are abstracted away rather than modernized. However, legacy systems may not justify the investment in modernization because their individual value is outweighed by the cost. A DOaaP initiative motivates decision makers to look at the entire system (i.e. modern and legacy) to determine which components need to be brought up to a minimum digital state. The conversation has now changed. Legacy systems should be modernized to increase the collective benefit of the entire DOaaP.

Benefits & Risks

Benefits

• Look & Feel
• User Adoption
• Shift to Digital

A single, modern, customizable interface enables a common look and feel no matter what and how the platform is being accessed.

Organizations can motivate and encourage the adoption and use of all products and services through the platform and increase the adoption of underused technologies.

DOaaP motivates and supports the modernization of data, processes, and systems to meet the goals and objectives outlined in the broader digital transformation strategy.

Risks

• Data Quality
• System Stability
• Ability to Modernize
• Business Model Change

Each system may have a different definition of commonly used entities (e.g. customer), which can cause data quality issues when information is shared among these systems.

DOaaP can stress the performance of underlying systems due to the limitations of some systems to handle increased traffic.

Some systems cannot be modernized due to cost constraints, business continuity risks, vendor lock-in, legacy and lore, or other blocking factors.

Limited appetite to make the necessary changes to business operations in order to maximize the value of DOaaP technologies.

Address your pressure points to fully realize the benefits of this priority

Success can be dependent on your ability to address your pressure points.

Recommendations

Define your platform vision

Organizations realize that a digital model is the way to provide more effective services to their customers and end users in a cost-effective, innovative, and engaging fashion. DOaaP is a way to help support this transition.

However, various platform stakeholders will have different interpretations of and preferences for what this platform is intended to solve, what benefits it is supposed to deliver, and what capabilities it will deliver. A grounded vision is imperative to steer the roadmap and initiatives.

Related Research:

• Drive Digital Transformation with Platform Strategies
• Gov 2.0: Government as a Platform
• Deliver Digital Products at Scale

Assess and modernize your applications

Certain applications may not sufficiently support the compatibility, flexibility, and efficiency requirements of DOaaP. While workaround technologies and tactics can be employed to overcome these application challenges, the full value of the DOaaP may not be realized.

Reviewing the current state of the application portfolio will indicate the functional and value limitations of what DOaaP can provide and an indication of the scope of investment needed to bring applications up to a minimum state.

Related Research:

• Application Portfolio Management Foundations
• Modernize Your Applications

Recommendations

Understand and evaluate end-user needs

Technology has reached a point where it's no longer difficult for teams to build functional and valuable digital platforms. Rather, the difficulty lies in creating an interface and platform that people want to use and use frequently.

While it is important to increase the access and promotion of all products and services, orchestrating and configuring them in a way to deliver a satisfying experience is even more important. Applications teams must first learn about and empathize with the needs of end users.

Related Research:

• Use Experience Design to Drive Empathy With the Business
• Implement and Mature Your User Experience Design Practice

Architect your platform

Formalizing and constructing DOaaP just for the sake of doing so often results in an initiative that is lengthy and costly and ends up being considered a failure.

The build and optimization of the platform must be predicated on a thorough understanding of the DOaaP's goals, objectives, and priorities and the business capabilities and process they are meant to support and enable. The appropriate architecture and delivery practices can then be defined and employed.

Related Research:

• Enhance Your Solution Architecture Practices
• Build Your Data Practice and Platform

CASE STUDY
e-Estonia

Situation

The digital strategy of Estonia resulted in e-Estonia, with the vision of "creating a society with more transparency, trust, and efficiency." Estonia has addressed the challenge by creating structures, organizations, and a culture of innovation, and then using the speed and efficiency of digital infrastructure, apps, and services. This strategy can reduce or eliminate bureaucracy through transparency and automation.

Estonia embarked on its journey to making digital a priority in 1994-1996, focusing on a committed investment in infrastructure and digital literacy. With that infrastructure in place, they started providing digital services like an e-banking service (1996), e-tax and mobile parking (2002), and then went full steam ahead with a digital information interoperability platform in 2001, digital identity in 2002, e-health in 2008, and e-prescription in 2010. The government is now strategizing for AI.

Results

Source: e-Estonia

Practices employed

The e-Estonia digital government model serves as a reference for governments across the world; this is acknowledged by the various awards it has received, like #2 in "internet freedom," awarded by Freedom House in 2019; #1 on the "digital health index," awarded by the Bertelsmann Foundation in 2019; and #1 on "start-up friendliness," awarded by Index Venture in 2018.

References

"15th State of Agile Report." Digital.ai, 2021. Web.
"2022 HR Trends Report." McLean & Company, 2022.
"2022: State of Application Strategy Report." F5 Inc, 2022.
"Are Executives Wearing Rose-Colored Glasses Around Digital Transformation?" Cyara, 2021. Web.
"Cost of a Data Breach Report 2022." IBM, 2022. Web.
Dalal, Vishal, et al. "Tech Debt: Reclaiming Tech Equity." McKinsey Digital, Oct. 2020. Web.
"Differentiating Between Intelligent Automation and Hyperautomation." IBM, 15 October 2021. Web.
"Digital Leadership Report 2021." Harvey Nash Group, 2021.
"Digital Leadership Report 2022: The State of Digital." Nash Squared, 2022. Web.
Gupta, Sunil. "Driving Digital Strategy: A Guide to Reimagining Your Business." Harvard Business Review Press, 2018. Web.
Haff, Gordon. "State of Application Modernization Report 2022." Konveyor, 2022. Web.
"IEEE Standard for Software Maintenance: IEEE Std 1219-1998." IEEE Standard for Software Maintenance, 1998. Accessed Dec. 2015.
"Intelligent Automation." Cognizant, n.d. Web.
"Kofax 2022: Intelligent Automation Benchmark Study". Kofax, 2021. Web.
McCann, Leah. "Barco's Virtual Classroom at UCL: A Case Study for the Future of All University Classrooms?" rAVe, 2 July 2020, Web.
"Proactive Staffing and Patient Prioritization to Decompress ED and Reduce Length of Stay." University Hospitals, 2018. Web.
"Secrets of Successful Modernization." looksoftware, 2013. Web.
"State of Software Development." Coding Sans, 2021. Web.
"The State of Low-Code/No-Code." Creatio, 2021. Web.
"We Have Built a Digital Society and We Can Show You How." e-Estonia. n.d. Web.
Zanna. "The 5 Types of Experience Series (1): Brand Experience Is Your Compass." Accelerate in Experience, 9 February 2020. Web.
Zhang, Y. et al. "Effects of Risks on the Performance of Business Process Outsourcing Projects: The Moderating Roles of Knowledge Management Capabilities." International Journal of Project Management, 2018, vol. 36 no. 4, 627-639.

Research Contributors and Experts

Chris Harrington
Chief Technology Officer
Carolinas Telco Federal Credit Union

Chris Harrington is Chief Technology Officer (CTO) of Carolinas Telco Federal Credit Union. Harrington is a proven leader with over 20 years of experience developing and leading information technology and cybersecurity strategies and teams in the financial industry space.

Benjamin Palacio
Senior Information Technology Analyst County of Placer

Benjamin Palacio has been working in the application development space since 2007 with a strong focus on system integrations. He has seamlessly integrated applications data across multiple states into a single reporting solution for management teams to evaluate, and he has codeveloped applications to manage billions in federal funding. He is also a CSAC-credentialed IT Executive (CA, USA).

Scott Rutherford
Executive Vice President, Technology
LGM Financial Services Inc.

Scott heads the Technology division of LGM Financial Services Inc., a leading provider of warranty and financing products to automotive OEMs and dealerships in Canada. His responsibilities include strategy and execution of data and analytics, applications, and technology operations.

Robert Willatts
IT Manager, Enterprise Business Solutions and Project Services
Town of Newmarket

Robert is passionate about technology, innovation, and Smart City Initiatives. He makes customer satisfaction as the top priority in every one of his responsibilities and accountabilities as an IT manager, such as developing business applications, implementing and maintaining enterprise applications, and implementing technical solutions. Robert encourages communication, collaboration, and engagement as he leads and guides IT in the Town of Newmarket.

Randeep Grewal
Vice President, Enterprise Applications
Red Hat

Randeep has over 25 years of experience in enterprise applications, advanced analytics, enterprise data management, and consulting services, having worked at numerous blue-chip companies. In his most recent role, he is the Vice President of Enterprise Applications at Red Hat. Reporting to the CIO, he is responsible for Red Hat's core business applications with a focus on enterprise transformation, application architecture, engineering, and operational excellence. He previously led the evolution of Red Hat into a data-led company by maturing the enterprise data and analytics function to include data lake, streaming data, data governance, and operationalization of analytics for decision support.

Prior to Red Hat, Randeep was the director of global services strategy at Lenovo, where he led the strategy using market data to grow Lenovo's services business by over $400 million in three years. Prior to Lenovo, Randeep was the director of advanced analytics at Alliance One and helped build an enterprise data and analytics function. His earlier work includes seven years at SAS, helping SAS become a leader in business analytics, and at KPMG consulting, where he managed services engagements at Fortune 100 companies.

Secure Your Hybrid Workforce

SASE as a driver to zero trust.

Analyst Perspective

Consolidate your security and network.

Remote connections like VPNs were not designed to be security tools or to have the capacity to handle a large hybrid workforce; hence, organizations are burdened with implementing controls that are perceived to be "security solutions." The COVID-19 pandemic forced a wave of remote work for employees that were not taken into consideration for most VPN implementations, and as a result, the understanding of the traditional network perimeter as we always knew it has shifted to include devices, applications, edges, and the internet. Additionally, remote work is here to stay as recruiting talent in the current market means you must make yourself attractive to potential hires.

The shift in the network perimeter increases the risks associated with traditional VPN solutions as well as exposing the limitations of the solution. This is where zero trust as a principle introduces a more security-focused strategy that not only mitigates most (if not all) of the risks, but also eliminates limitations, which would enhance the business and improve customer/employee experience.

There are several ways of achieving zero trust maturity, and one of those is SASE, which consolidates security and networking to better secure your hybrid workforce as implied trust is thrown out of the window and verification of everything becomes the new normal to defend the business.

Victor Okorie
Senior Research Analyst, Security and Privacy
Info-Tech Research Group

Executive Summary

Your Challenge

CISOs are looking to zero trust to fill the gaps associated with their traditional remote setup as well as to build an adaptable security strategy. Some challenges faced include:

• Understanding the main principles of zero trust: never trust, always verify, assume breach, and verify explicitly.
• Understanding how to achieve a zero trust framework.
• Understanding the premise of SASE as it pertains to a hybrid workforce.

Common Obstacles

The zero trust journey may seem tedious because of a few obstacles like:

• Knowing what the principle is all about and the components that align with it.
• Knowing where to start. Due to the lack of a standardized path for the zero trust journey, going about the journey can be confusing.
• Not having a uniform definition of what makes up a SASE solution as it is heavily dependent on vendors.

Info-Tech's Approach

Info-Tech provides a three-service approach to helping organizations better secure their hybrid workforce.

• Understand your current, existing technological capabilities and challenges with your hybrid infrastructure, and prioritize those challenges.
• Gain insight into zero trust and SASE as a mitigation/control/tool to those challenges.
• Identify the SASE features that are relevant to your needs and a source guide for a SASE vendor.

Info-Tech Insight

Securing your hybrid workforce should be an opportunity to get started on the zero trust journey. Realizing the core features needed to achieve this will assist you in determining which of the options is a good fit for your organization.

Turn your challenges into opportunities

Hybrid workforce is the new normal

The pandemic has shown there is no going back to full on-prem work, and as such, security should be looked at differently with various considerations in mind.

Understand that current hybrid solutions are susceptible to various forms of attack as the threat attack surface area has now expanded with users, devices, applications, locations, and data. The traditional perimeter as we know it has expanded beyond just the corporate network, and as such, it needs a more mature security strategy.

Onboarding and offboarding have been done remotely, and with some growth recorded, the size of companies has also increased, leading to a scaling issue.

Employees are now demanding remote work capabilities as part of contract negotiation before accepting a job.

Attacks have increased far more quickly during the pandemic, and all indications point to them increasing even more.

Scarce available security personnel in the job market for hire.

Reality Today

The number of breach incidents by identity theft.
Source: Security Magazine, 2022.

IT security teams want to adopt zero trust.
Source: Cybersecurity Insiders, 2019.

Reduce the risks of remote work by using zero trust

Source: IBM, 2021.

Network + Security = SASE

What exactly is a SASE product?

The convergence and consolidation of security and network brought about the formation of secure access service edge (SASE – pronounced like "sassy"). Digital transformation, hybrid workforce, high demand of availability, uninterrupted access for employees, and a host of other factors influenced the need for this convergence that is delivered as a cloud service.

The capabilities of a SASE solution being delivered are based on certain criteria, such as the identity of the entity (users, devices, applications, data, services, location), real-time context, continuous assessment and verification of risk and "trust" throughout the lifetime of a session, and the security and compliance policies of the organization.

SASE continuously identifies users and devices, applies security based on policy, and provides secure access to the appropriate and requested application or data regardless of location.

Current Approach

The traditional perimeter security using the castle and moat approach is depicted in the image here. The security shields valuable resources from external attack; however, it isn't foolproof for all kinds of external attacks. Furthermore, it does not protect those valuable resources from insider threat.

This security perimeter also allows for lateral movement when it has been breached. Access to these resources is now considered "trusted" solely because it is now behind the wall/perimeter.

This approach is no longer feasible in our world today where both external and internal threats pose continuous risk and need to be contained.

Determine the suitability of SASE and zero trust

The Challenge:

Complications facing traditional infrastructure

• Increased hybrid workforce
• Regulatory compliance
• Limited Infosec personnel
• Poor threat detection
• Increased attack surface

Common vulnerabilities in traditional infrastructure

• MITM attack
• XSS attack
• Session hijacking
• Trust-based model
• IP spoofing
• Brute force attack
• Distributed denial of service
• DNS hijacking
• Latency issues
• Lateral movement once connection is established

Candidate Solutions

Proposed benefits of SASE

• Access is only granted to the requested resource
• Consolidated network and security as a service
• Micro-segmentation on application and gateway
• Adopts a zero trust security posture for all access
• Managed detection and response
• Uniform enforcement of policy
• Distributed denial of service shield

Proposed benefits of zero trust

• Identify and protect critical and non-critical resources in accordance with business objectives.
• Produce initiatives that conform to the ideals of zero trust and are aligned with the corresponding pillars above.
• Formulate policies to protect resources and aid segmentation.

Info-Tech Insight

Securing your hybrid workforce should be an opportunity to get started on the zero trust journey. Realizing the core features needed to achieve this will help you determine which of the options is a good fit for your organization.

Measure the value of using Info-Tech's approach

IT and business value

PHASE 1

Short-term benefits

• Gain awareness of your zero trust readiness.
• Embed a zero trust mindset across your architecture.
• Control the narrative of what SASE brings to your organization.

Long-term benefits

• Identified controls to mitigate risks with current architecture while on a zero trust journey.
• Improved security posture that reduces risk by increasing visibility into threats and user connections.
• Reduced CapEx and OpEx due to the scalability, low staffing requirements, and improved time to respond to threats using a SASE or SSE solution.

Determine SASE cost factors

IT and business value

Info-Tech Insight

IT leaders need to examine different areas of their budget and determine how the adoption of a SASE solution could influence several areas of their budget breakdown.

Determining the SASE cost factors early could accelerate the justification the business needs to move forward in making an informed decision.

Info-Tech's methodology for securing your hybrid workforce

Consider several factors needed to protect your growing hybrid workforce and assess your current resource capabilities, solutions, and desire for a more mature security program. The outcome should either address a quick pain point or a long-term roadmap.

The internet is the new corporate network

The internet is the new corporate network, which opens the organization up to more risks not protected by the current security stack. Using Info-Tech's methodology of zero trust adoption is a sure way to reduce the attack surface, and SASE is one useful tool to take you on the zero trust journey.

Current-state risks and future mitigation

Securing your hybrid workforce via zero trust will inevitably include (but is not limited to) technological products/solutions.

SASE and SSE features sit as an overlay here as technological solutions that will help on the zero trust journey by aggregating all the disparate solutions required for you to meet zero trust requirements into a single interface. The knowledge and implementation of this helps put things into perspective of where and what our target state is.

The right solution for the right problem

It is critical to choose a solution that addresses the security problems you are actually trying to solve.

Don't allow the solution provider to tell you what you need – rather, start by understanding your capability gaps and then go to market to find the right partner.

Take advantage of the RFP template to source a SASE or SSE vendor. Additionally, build a zero trust roadmap to develop and strategize initiatives and tasks.

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

Zero Trust and SASE Suitability Tool
Identify critical and vulnerable DAAS elements to protect and align them to business goals.

Zero Trust Program Gap Analysis Tool
Perform a gap analysis between current and target states to build a zero trust roadmap.

Key deliverable:

Secure Your Hybrid Workforce With Zero Trust Communication deck
Present your zero trust strategy in a prepopulated document that summarizes the work you have completed as a part of this blueprint.

Phase 1

Current state and future mitigation

This phase will walk you through the following activities:

• Introduction to the tool, how to use the input tabs to identify current challenges, technologies being used, and to prioritize the challenges. The prioritized list will highlight existing gaps and eventually be mapped to recommended mitigations in the following phase.

This phase involves the following participants:

• CIO
• CISO
• CSO
• IT security team
• IT network team

Secure Your Hybrid Workforce

1.1 Limitations of legacy infrastructure

Traditional security & remote access solutions must be modernized

Info-Tech Insight
Traditional security is architected with a perimeter in mind and is poorly suited to the threats in hybrid or distributed environments.

Ensure you minimize or eliminate weak points on all layers.

• SECURITY
  • DDoS
  • DNS hijacking
  • Weak VPN protocols
• IDENTITY
  • One-time verification allowing lateral movement
• NETWORK
  • Risk perimeter stops at corporate network edge
  • Split tunneling
• AUTHENTICATION
  • Weak authentication
  • Weak passwords
• ACCESS
  • Man-in-the-middle attack
  • Cross-site scripting
  • Session hijacking

1.1.1 For example: traditional VPNs are poorly suited to a hybrid workforce

There are many limitations that make it difficult for traditional VPNs to adapt to an ever-growing hybrid workforce.

The listed limitations are tied to associated risks of legacy infrastructure as well as security components that are almost non-existent in a VPN implementation today.

Scaling

VPNs were designed for small-scale remote access to corporate network. An increase in the remote workforce will require expensive hardware investment.

Visibility

Users and attackers are not restricted to specific network resources, and with an absence of activity logs, they can go undetected.

Managed detection & response

Due to the reduction in or lack of visibility, threat detections are poorly managed, and responses are already too late.

Hardware

Limited number of locations for VPN hardware to be situated as it can be expensive.

Hybrid workforce

The increase in the hybrid workforce requires the risk perimeter to be expanded from the corporate network to devices and applications. VPNs are built for privacy, not security.

Info-Tech Insight

Hybrid workforces are here to stay, and adopting a strategy that is adaptable, flexible, simple, and cost-effective is a recommended road to take on the journey to bettering your security and network.

1.1 Identify risk from legacy infrastructure

Estimated Time: 1-2 hours

1. Ensure all vulnerabilities described on slide 17 are removed.
2. Note any forecasted challenge you think you might have down the line with your current hybrid setup.
3. Identify any trend that may be of interest to you with regards to your hybrid setup.

Download the Zero Trust - SASE Suitability Assessment Tool

Input

• List of key pain points and challenges
• List of forecasted challenges and trends of interest

Output

• Prioritized list of pain points and/or challenges

Materials

• Excel tool
• Whiteboard

Participants

• CISO
• InfoSec team
• IT manager
• CIO
• Infrastructure team

1.2 Zero trust principle as a control

A zero trust implementation comes with benefits/initiatives that mitigate the challenges identified in earlier activities.

Info-Tech Insight

Zero trust/"always verify" is applied to identity, workloads, devices, networks, and data to provide a greater control for risks associated with traditional network architecture.

Improve IAM maturity

Zero trust identity and access will lead to a mature IAM process in an organization with the removal of implicit trust.

Secure your remote access

With a zero trust network architecture (ZTNA), both the remote and on-prem network access are more secure than the traditional network deployment. The software-defined parameter ensures security on each network access.

Reduce threat surface area

With zero trust principle applied on identity, workload, devices, network, and data, the threat surface area which births some of the risks identified earlier will be significantly reduced.

Improve hybrid workforce

Scaling, visibility, network throughput, secure connection from anywhere, micro-segmentation, and a host of other benefits to improve your hybrid workforce.

1.2 SASE as an overlay to zero trust

Security and network initiatives of a zero trust roadmap converged into a single pane of glass.

Info-Tech Insight

Security and network converged into a single pane of glass giving you some of the benefits and initiatives of a zero trust implemented architecture in one package.

Improve IAM maturity

The identity-centric nature of SASE solutions helps to improve your IAM maturity as it applies the principle of least privilege. The removal of implicit trust and continuous verification helps foster this more.

Secure your remote access

With ZTNA, both the remote and on-prem network access are more secure than the traditional network deployment. The software defined parameter ensures security on each network access.

Reduce threat surface area

Secure web gateway, cloud access security broker, domain name system, next-generation firewall, data loss prevention, and ZTNA protect against data leaks, prevent lateral movement, and prevent malicious actors from coming in.

Improve hybrid workforce

Reduced costs and complexity of IT, faster user experience, and reduced risk as a result of the scalability, visibility, ease of IT administration, network throughput, secure connection from anywhere, micro-segmentation, and a host of other benefits will surely improve your hybrid workforce.

Align SASE features to zero trust core capabilities

Verify Identity

• Authentication & verification are enforced for each app request or session.
• Use of multifactor authentication.
• RBAC/ABAC and principle of least privilege are applied on the identity regardless of user, device, or location.

Verify Device

• Device health is checked to ensure device is not compromised or vulnerable.
• No admin permissions on user devices.
• Device-based risk assessment is enforced as part of UEBA.

Verify Access

• Micro-segmentation built around network, user, device, location and roles.
• Use of context and content-based policy enforced to the user, application, and device identity.
• Network access only granted to specified application request and not to the entire network.

Verify Services

• Applications and services are checked before access is granted.
• Connections to the application and services are inspected with the security controls built into the SASE solution.

Info-Tech Insight

These features of SASE and zero trust mitigate the risks associated with a traditional VPN and reduce the threat surface area. With security at the core, network optimization is not compromised.

Security components of SASE

Otherwise known as security service edge (SSE)

Security service edge is the convergence of all security services typically found in SASE. At its core, SSE consists of three services which include:

• Secure web gateway – secure access to the internet and web.
• Cloud access security broker – secure access to SaaS and cloud applications.
• Zero trust network access – secure remote access to private applications.

SSE components are also mitigations or initiatives that make up a zero trust roadmap as they comply with the zero trust principle, and as a result, they sit up there with SASE as an overlay/driver of a zero trust implementation. SSE's benefits are identical to SASE's in that it provides zero trust access, risk reduction, low costs and complexity, and a better user experience. The difference is SSE's sole focus on security services and not the network component.

1.3 Pros & cons of zero trust and SASE

Understand SASE and zero trust suitability for your needs

Estimated Time: 1 hour

Use the dashboard to understand the value assessment of adopting a SASE product or building a zero trust roadmap.

Info-Tech Insight

This tool will help steer you on a path to take as a form of mitigation/control to some or all the identified challenges.

Phase 2

Make a decision and next steps

This phase will walk you through the following activities:

• Introduction to the tool activity, how to use the input tabs and considerations to generate an output that could help understand the current state of your hybrid infrastructure and what direction is to be followed next to improve.

This phase involves the following participants:

• CIO
• CISO
• CSO
• IT security
• IT network team

Secure Your Hybrid Workforce

Step 2.1

Sourcing out a SASE/SSE vendor

Activities

2.1.1 Use the RFP template to request proposal from vendors

2.1.2 Use SoftwareReviews to compare vendors

This step involves the following participants:

• CIO, CISO, IT manager, Infosec team, executives.

Outcomes of this step

• Zero Trust Roadmap

2.1.1 Use the RFP template to request proposal from vendors

Estimated Time: 1-3 hours

1. As a group, use the RFP Template to include technical capabilities of your desired SASE product and to request proposals from vendors.
2. The features that are most important to your organization generated from phase one should be highlighted in the RFP.

Input

• List of SASE features
• Technical capabilities

Output

• RFP

Materials

• RFP Template

Participants

• Security team
• IT leadership

Download the RFP Template

2.1.2 Use SoftwareReviews to compare vendors

SoftwareReviews

• The Data Quadrant is a thorough evaluation and ranking of all software in an individual category to compare platforms across multiple dimensions.
• Vendors are ranked by their Composite Score, based on individual feature evaluations, user satisfaction rankings, vendor capability comparisons, and likeliness to recommend the platform.
• The Emotional Footprint is a powerful indicator of overall user sentiment toward the relationship with the vendor, capturing data across five dimensions.
• Vendors are ranked by their Customer Experience (CX) Score, which combines the overall Emotional Footprint rating with a measure of the value delivered by the solution.

Step 2.2

Zero trust readiness and roadmap

Activities

2.2.1 Assess the maturity of your current zero trust implementation

2.2.2 Understand business needs and current security projects

2.2.3 Set target maturity state with timeframe

This step involves the following participants:

CIO, CISO, IT manager, Infosec team, executives.

Outcomes of this step

Zero Trust Roadmap

2.2.1 Assess the maturity of your current zero trust implementation

Estimated Time: 1-3 hours

• Realizing that zero trust is a journey helps create a better roadmap and implementation. Identify the current controls or solutions in your organization that align with the principle of zero trust.
• Break down these controls or solutions into different silos (e.g. identity, security, network, data, device, applications, etc.).
• Determine your zero trust readiness.

Input

• List of zero trust controls/solutions
• Siloed list of zero trust controls/solutions
• Current state of zero trust maturity

Output

• Zero trust readiness and current maturity state

Materials

• Zero Trust Security Benefit Assessment tool

Participants

• Security team
• IT leadership

Download the Zero Trust Security Benefit Assessment tool

2.2.2 Understand business needs and current security projects

Estimated Time: 1-3 hours

1. Identify the business and IT executives, application owners, and board members whose vision aligns with the zero trust journey.
2. Identify existing projects within security, IT, and the business and highlight interdependencies or how they fit with the zero trust journey.
3. Build a rough sketch of the roadmap that fits the business needs, current projects and the zero trust journey.

Input

• Meetings with stakeholders
• List of current and future projects

Output

• Sketch of zero trust roadmap

Materials

• Whiteboard activity

Participants

• Security team
• IT leadership
• IT ops team
• Business executives
• Board members

Download Zero Trust Protect Surface Mapping Tool

2.2.3 Set target maturity state with a given timeframe

Estimated Time: 1-3 hours

1. With the zero trust readiness, current business, IT and security projects, current maturity state, and sketch of the roadmap, setting a target maturity state within some timeframe is at the top of the list. The target maturity state will include a list of initiatives that could be siloed and confined to a timeframe.
2. A Gantt chart or graph could be used to complete this task.

Input

• Results from previous activity slides

Output

• Current state and target state assessment for gap analysis
• List of initiatives and timeframe

Materials

• Zero Trust Program Gap Analysis Tool

Participants

• Security team
• IT leadership
• IT ops team
• Business executives
• Board members

Download the Zero Trust Program Gap Analysis Tool

Summary of Accomplishment

Insights Gained

• Difference between zero trust as a principle and SASE as a framework
• Difference between SASE and SSE platforms.
• Assessment of which path to take in securing your hybrid workforce

Deliverables Completed

• Zero Trust – SASE Suitability Assessment Tool
• Secure Your Hybrid Workforce Communication Deck

If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop

Contact your account representative for more information

workshops@infotech.com

1-888-670-8889

Additional Support

If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop

To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.

Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889

The following are sample activities that will be conducted by Info-Tech analysts with your team:

Zero Trust - SASE Suitability Assessment Tool

Assess current security capabilities and build a roadmap of tasks and initiatives that close maturity gaps.

Research Contributors

• Aaron Shum, Vice President, Security & Privacy
• Cameron Smith, Research Lead, Security & Privacy
• Brad Mateski, Zones, Solutions Architect for CyberSecurity
• Bob Smock, Info-Tech Research Group, Vice President of Consulting
• Dr. Chase Cunningham, Ericom Software, Chief Strategy Officer
• John Kindervag, ON2IT Cybersecurity, Senior Vice President, Cybersecurity Strategy and ON2IT Group Fellow
• John Zhao, Fonterra, Enterprise Security Architect
• Rongxing Lu, University of New Brunswick, Associate Professor
• Sumanta Sarkar, University of Warwick, Assistant Professor
• Tim Malone, J.B. Hunt Transport, Senior Director Information Security
• Vana Matte, J.B. Hunt Transport, Senior Vice President of Technology Services

Related Info-Tech Research

Build an Information Security Strategy

Info-Tech has developed a highly effective approach to building an information security strategy – an approach that has been successfully tested and refined for over seven years with hundreds of organizations. This unique approach includes tools for ensuring alignment with business objectives, assessing organizational risk and stakeholder expectations, enabling a comprehensive current state assessment, prioritizing initiatives, and building out a security roadmap.

Determine Your Zero Trust Readiness

IT security was typified by perimeter security. However, the way the world does business has mandated a change to IT security. In response, zero trust is a set of principles that can add flexibility to planning your IT security strategy.

Use this blueprint to determine your zero trust readiness and understand how zero trust can benefit both security and the business.

Mature Your Identity and Access Management Program

Many organizations are looking to improve their identity and access management (IAM) practices but struggle with where to start and whether all areas of IAM have been considered. This blueprint will help you improve the organization's IAM practices by following our three-phase methodology:

• Assess identity and access requirements.
• Identify initiatives using the identity lifecycle.
• Prioritize initiatives and build a roadmap.

Bibliography

"2021 Data Breach Investigations Report." Verizon, 2021. Web.
"Fortinet Brings Networking and Security to the Cloud" Fortinet, 2 Mar. 2021. Web.
"A Zero Trust Strategy Has 3 Needs – Identify, Authenticate, and Monitor Users and Devices on and off the Network." Fortinet, 15 July 2021. Web.
"Applying Zero Trust Principles to Enterprise Mobility." CISA, Mar. 2022. Web.
"CISA Zero Trust Maturity Model." CISA, Cybersecurity Division, June 2021. Web.
"Continuous Diagnostics and Mitigation Program Overview." CISA, Jan. 2022. Web.
"Cost of a Data Breach Report 2021 | IBM." IBM, July 2021. Web.
English, Melanie. "5 Stats That Show The Cost Saving Effect of Zero Trust." Teramind, 29 Sept. 2021. Web.
Hunter, Steve. "The Five Business Benefits of a Zero Trust Approach to Security." Security Brief - Australia, 19 Aug. 2020. Web.
"Improve Application Access and Security With Fortinet Zero Trust Network Access." Fortinet, 2 Mar. 2021. Web.
"Incorporating zero trust Strategies for Secure Network and Application Access." Fortinet, 21 Jul. 2021. Web.
Jakkal, Vasu. "Zero Trust Adoption Report: How Does Your Organization Compare?" Microsoft, 28 July 2021. Web.
"Jericho Forum™ Commandments." The Open Group, Jericho Forum, May 2007. Web.
Schulze, Holger. "2019 Zero Trust Adoption Report." Cybersecurity Insiders, 2019. Web.
"67% of Organizations Had Identity-Related Data Breaches Last Year." Security Magazine, 22 Aug. 2022. Web.
United States, Executive Office of the President Joseph R. Biden, Jr. "Executive Order on Improving the Nation's Cybersecurity." The White House, 12 May 2021. Web.

Make Your IT Governance Adaptable

Governance isn't optional, so keep it simple and make it flexible.

Table of Contents

Make Your IT Governance Adaptable

Governance isn't optional, so keep it simple and make it flexible.

EXECUTIVE BRIEF

Analyst Perspective

Governance will always be part of the fabric of your organization. Make it adaptable so it doesn’t constrain your success.

Far too often, the purpose of information and technology (I&T) governance is misunderstood. Instead of being seen as a way to align the organization’s vision to its investment in information and technology, it has become so synonymous with compliance and control that even mentioning the word “governance” elicits a negative reaction.

Success in modern digital organizations depends on their ability to adjust for velocity and uncertainty, requiring a dynamic and responsive approach to governance – one that is embedded and automated in your organization to enable new ways of working, innovation, and change.

Evolutionary theory describes adaptability as the way an organism adjusts to fit a new environment, or changes to its existing environment, to survive. Applied to organizations, adaptable governance is critical to the ability to survive and succeed.

If your governance doesn’t adjust to enable your changing business environment and customer needs, it will quickly become misaligned with your goals and drive you to failure.

It is critical that people build an approach to governance that is effective and relevant today while building in adaptability to keep it relevant tomorrow.

Valence Howden
Principal Research Director, Info-Tech Research Group

Executive Summary

Your Challenge

• People don’t understand the value of governance, seeing it as a hindrance to productivity and efficiency.
• Governance is delegated to people and practices that don’t have the ability or authority to make decisions.
• Decisions are made within committees that don’t meet frequently enough to support business velocity.
• It is difficult to allocate time and resources to build or execute governance effectively

Common Obstacles

• You are unable to clearly communicate how governance adds value to your organization.
• Your IT governance approach no longer aligns with or supports your organizational direction, goals, and work practices.
• Governance is seen and performed as a bureaucratic control-based exercise.
• Governance activities are not transparent.
• The governance committee gets too deeply involved with project deep dives and daily management, derailing its effectiveness and ability to produce value.

Info-Tech’s Approach

• Use Info-Tech’s IT governance models to identify a base model similar to the way you are organized. Confirm your current and future placement in governance execution.
• Adjust the model based on industry needs, your principles, regulatory requirements, and your future direction.
• Identify where to embed or automate decision making and compliance and what is required to do so effectively.
• Implement your governance model for success.

Info-Tech Insight

IT governance must be embedded and automated, where possible, to effectively meet the needs and velocity of digital organizations and modern practices and to drive success and value.

What is governance?

IT governance is a critical and embedded practice that ensures that information and technology investments, risks, and resources are aligned in the best interests of the organization and produce business value.

Effective governance ensures that the right technology investments are made at the right time to support and enable your organization’s mission, vision, and goals.

Why is this necessary?

• Governance is not simply a committee or an activity that you perform at a specific point in time; it is a critical and continuously active practice that drives the success of your organization. It is part of your organization’s DNA and is just as unique, with some attributes common to all (IT governance elements), some specific to your family (industry refinements), and some specific to you (individual organization).
• Your approach to governance needs to change over time in order to remain relevant and continue to enable value and success, but organizations rarely want to change governance once it’s in place.
• To meet the speed and flow of practices like Lean, DevOps, and Agile, your IT governance needs to be done differently and become embedded into the way your organization works. You must adjust your governance model based on key moments of change – organizational triggers – to maintain the effectiveness of your model.

Info-Tech Insight

Build an optimal model quickly and implement the core elements using an iterative approach to ensure the changes provide the most value.

The Technology Value Trinity

Delivery of Business Value & Strategic Needs

• DIGITAL & TECHNOLOGY STRATEGY
  The identification of objectives and initiatives necessary to achieve business goals.
• IT OPERATING MODEL
  The model for how IT is organized to deliver on business needs and strategies.
• INFORMATION & TECHNOLOGY GOVERNANCE
  The governance to ensure the organization and its customers get maximum value from the use of information and technology.

All three elements of the Technology Value Trinity work in harmony to deliver business value and meet strategic needs. As one changes, the others need to change as well.

• Digital and IT Strategy tells you what you need to achieve to be successful.
• IT Operating Model and Organizational Design is the alignment of resources to deliver on your strategy and priorities.
• Information & Technology Governance is the confirmation that IT’s goals and strategy align with the business’ strategy. It is the mechanism by which you continuously prioritize work to ensure that what you deliver is in line with the strategy. This oversight involves evaluating, directing, and monitoring the delivery of outcomes to ensure that the use of resources results in achieving the organization’s goals.

Too often strategy, operating model and organizational design, and governance are considered separate practices. As a result, “strategic documents” end up being wish lists, and projects continue to be prioritized based on who shouts the loudest rather than on what is in the best interest of the organization.

Where information & technology governance fits within an organization

I&T governance hasn’t achieved its purpose

Governance is the means by which IT ensures that information and technology delivery and spend is aligned to business goals and delivers business outcomes. However, most CEOs continue to perceive IT as being poorly aligned to the business’ strategic goals, which indicates that governance is not implemented or executed properly.

For I&T governance to be effective you need a clear understanding of the things that drive your organization and its success. This understanding becomes your guiding star, which is critical for effective governance. It also requires participation by all parts of the organization, not just IT.

Info-Tech CIO/CEO Alignment Diagnostics (N=124)

43% of CEOs believe that business goals are going unsupported by IT.

60% of CEOs believe that improvement is required around IT’s understanding of business goals.

80% of CIOs/CEOs are misaligned on the target role for IT.

30% of business stakeholders are supporters (N=32,536) of their IT departments

Common causes of poor governance

Key causes of poor or misaligned governance

1. Governance and its value to your organization is not well understood, often being confused or integrated with more granular management activities.
2. Business executives fail to understand that IT governance is a function of the business and not the IT department.
3. Poor past experiences have made “governance” a bad word in the organization. People see it as a constraint and barrier that must be circumvented to get work done.
4. There is misalignment between accountability and authority throughout the organization, and the wrong people are involved in governance practices.
5. There is an unwillingness to change a governance approach that has served the organization well in the past, leading to challenges when the organization starts to change practices and speed of delivery.
6. There is a lack of data and data-related capabilities required to support good decision making and the automation of governance decisions.
7. The goals and strategy of the organization are not known or understood, leaving nothing for IT governance to orient around.

Key symptoms of ineffective governance committees

1. No actions or decisions are generated. The committee produces no value and makes no decisions after it meets. The lack of value output makes the usefulness of the committee questionable.
2. Resources are overallocated. There is a lack of clear understanding of capacity and value in work to be done, leading to consistent underestimation of required resources and poor resource allocation.
3. Decisions are changed outside of committee. Decisions made or initiatives approved by the committee are later changed when the proper decision makers are involved or the right information becomes available.
4. Governance decisions conflict with organizational direction. This shows an obvious lack of alignment and behavioral disconnect that work against organizational success. It is often due to not accounting for where power really exists within the structure.
5. Consistently poor outcomes are produced from governance direction. Committee members’ lack of business acumen, relevant data, or understanding of organizational goals results in decisions that fail to drive successful measured outcomes.

Mature your governance by transitioning from ad hoc to automated

Organizations should look to progress in their governance stages. Ad hoc and controlled governance practices tend to be more rigid, making these a poor fit for organizations requiring higher velocity delivery or using more agile and adaptive practices.

The goal as you progress through these stages is to delegate governance and empower teams based on your fit and culture, enabling teams where needed to make optimal decisions in real time, ensuring that they are aligned with the best interests of the organization.

Automate governance for optimal velocity while mitigating risks and driving value.

This puts your organization in the best position to be adaptive, able to react effectively to volatility and uncertainty.

Stages of governance

Make Governance Adaptable and Automated to Drive Success and Value

Governance adaptiveness ensures the success of digital organizations and modern practice implementation.

THE PROBLEM

• The wrong people are making decisions.
• Organizations don't understand what governance is or why it's done.
• Governance scope and design is a bad fit, damaging the organization.
• People think governance is optional.

THE SOLUTION

ESTABLISH YOUR GUIDING PRINCIPLES

Define and establish the guiding principle that drive your organization toward success.

• Mission & Vision
• Business Goals & Success Criteria
• Operating Model & Work Practices
• Governance Scope
• Principles

SELECT AND REFINE YOUR MODEL

Use Info-Tech's IT Governance Models to identify a base model similar to the way you are organized. Confirm your current and future placement in governance execution.

IDENTIFY MODEL UPDATE TRIGGERS

Adjust the model based on industry needs, your principles, regulatory requirements, and future direction.

• Principles
  Select principles that allow the organization to be adaptive while still ensuring the governance continues to stay on course with pursuing its guiding star.
• Responsibilities
  Decide on the governance responsibilities related to Oversight Level, Strategic Alignment, Value Delivery, Risk Optimization, Resource Optimization, and Performance Management.
• Structure
  Determine at which structured level governance is appropriate: Enterprise, Strategic, Tactical, or Operational.
• Processes
  Establish processes that will enable governance to occur such as: Embed the processes required for successful governance.
• Membership
  Identify the Responsibility & Accountability of those who should be involved in governance processes, policies, guidelines, and responsibilities.
• Policies
  Confirm any governing policies that need to be adhered to and considered to manage risk.

DETERMINE AUTOMATION OPTIONS AND DECISION RULES

Identify where to embed or automate decision making and compliance and what is required to do so effectively.

STAGES OF GOVERNANCE

Traditional (People- and document-centric)

1. AD HOC GOVERNANCE
   Governance that is not well defined or understood within the organization. It occurs out of necessity but often not by the right people or bodies.
2. CONTROLLED GOVERNANCE
   Governance focused on compliance and hierarchy-based, authority-driven control of decisions. Levels of Authority are defined and often driven by regulatory requirements.

Adaptive (Data Centric)

3. AGILE GOVERNANCE
   Governance that is flexible to support different needs and quick responses in the organization. Driven by principles and delegated throughout the company.
4. AUTOMATED GOVERNANCE
   Governance that is entrenched and automated into the organizational processes and product/service design. Empowered and fully delegated governance to maintain fit and drive organizational success and survival.

KEY INSIGHT

Governance must actively adapt to changes in your organization, environment, and practices or it will drive you to failure.

Developing governance principles

Governance principles support the move from controlled to automated governance by providing guardrails that guide your decisions. They provide the ethical boundaries and cultural perspectives that contextualize your decisions and keep you in line with organizational values. Determining principles are global in nature.

Find your guiding star

Your mission and vision define your goals and objectives. These are reinforced by your guiding principles, including ethical considerations, your culture, and expected behaviors. They provide the boundaries and guardrails for enabling adaptive governance, ensuring you continue to move in the right direction for organizational success.

To paraphrase Lewis Carroll, “If you don't know where you want to get to, it doesn't much matter which way you go.” Once you know what matters, where value resides, and which considerations are necessary to make decisions, you have consistent directional alignment that allows you to delegate empowered governance throughout the organization, taking you to the places you want to go.

Understand governance versus management

Don’t blur the lines between governance and management; each has a unique role to play. Confusing them results in wasted time and confusion around ownership.

Governance I&T governance defines WHAT should be done and sets direction through prioritization and decision making, monitoring overall IT performance. Governance aligns with the mission and vision of the organization to guide IT.

Management Management focuses on HOW to do things to achieve the WHAT. It is responsible for executing on, operating, and monitoring activities as determined by I&T governance. Management makes decisions for implementation based on governance direction.

Data is critical to automating governance

Documents and subjective/non-transparent decisions do not create sufficient structure to allow for the true automation of governance. Data related to decisions and aggregated risk allow you to define decision logic and rules and algorithmically embed them into your organization.

People- and Document-Centric

Governance drives activities through specific actors (individuals/committees) and unstructured data in processes and documents that are manually executed, assessed, and revised. There are often constraints caused by gaps or lack of adequate and integrated information in support of good decisions.

Data-Centric

Governance actors provide principles, parameters, and decision logic that enable the creation of code, rulesets, and algorithms that leverage organizational data. Attestation is automatic – validated and managed within the process, product, or service.

Info-Tech’s Approach

Define your context and build your model

ESTABLISH YOUR GUIDING PRINCIPLES

Define and establish the guiding principle that drive your organization toward success.

• Mission & Vision
• Business Goals & Success Criteria
• Operating Model & Work Practices
• Governance Scope
• Principles

SELECT AND REFINE YOUR MODEL

Use Info-Tech's IT Governance Models to identify a base model similar to the way you are organized. Confirm your current and future placement in governance execution.

MODEL UPDATE TRIGGERS

Adjust the model based on industry needs, your principles, regulatory requirements, and future direction.

• Principles
  Select principles that allow the organization to be adaptive while still ensuring the governance continues to stay on course with pursuing its guiding star.
• Responsibilities
  Decide on the governance responsibilities related to Oversight Level, Strategic Alignment, Value Delivery, Risk Optimization, Resource Optimization, and Performance Management.
• Structure
  Determine at which structured level governance is appropriate: Enterprise, Strategic, Tactical, or Operational.
• Processes
  Establish processes that will enable governance to occur such as: Embed the processes required for successful governance.
• Membership
  Identify the Responsibility & Accountability of those who should be involved in governance processes, policies, guidelines, and responsibilities.
• Policies
  Confirm any governing policies that need to be adhered to and considered to manage risk.

AUTOMATION OPTIONS AND DECISION RULES

Identify where to embed or automate decision making and compliance and what is required to do so effectively.

The Info-Tech Difference

Define your context and build your model

1. Quickly identify the organizational needs driving governance and your guiding star.
2. Select and refine a base governance model based on our templates.
3. Define and document the key changes in your organization that will trigger a need to update or revise your governance.
4. Determine where you might be able to automate aspects of your governance.
5. Design your decision rules where appropriate to support automated and adaptive governance.

How to use this research

Where are you in your governance optimization journey?

Related Research:

If you are looking for details on specific associated practices, please see our related research:

1. I need to establish data governance.
2. I need to manage my project portfolio, from intake to confirmation of value.
3. I need better risk information to support decision making.
4. I need to ensure I am getting the expected outcomes and benefits from IT spend.
5. I need to prioritize my product backlog or service portfolio.

Info-Tech’s methodology for building and embedding adaptive governance

Insight summary

Value

To remain valuable, I&T governance must actively adapt to changes in your organization, environment, and practices, or it will drive you to failure instead of success.

Focus

I&T governance does not focus on the IT department. Rather, its intent is to ensure your organization makes sound decisions around investment in and use of information and technology.

Maturity

Your governance approach progresses in stages from ad hoc to automated as your organization matures. Your stage depends on your organizational needs and ways of working.

Good governance

Good governance does not equate to control and does not stifle innovation.

Automation

Automating governance must be done in stages, based on your capabilities, level of maturity, and amount of usable data.

Strategy

Establish the least amount of governance required to allow you to achieve your goals.

Guiding star

If you don’t establish a guiding star to align the different stakeholders in your organization, governance practices will create conflict and confusion.

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

Blueprint benefits

IT Benefits

• Stronger, traceable alignment of IT decisions and initiatives to business needs.
• Improved ability for IT to meet the changing demands and velocity of the business.
• Better support and enablement of innovation – removing constraints and barriers.
• Optimized governance that supports and enables modern work practices.
• Increased value generation from IT initiatives and optimal use of IT resources.
• Designed adaptability to ensure you remain in alignment as your business and IT environments change.

Business Benefits

• Clear transparent focus of IT initiatives on generating strategic business value.
• Improved ability to measure the value and contribution of IT to business goals.
• Alignment and integration of business/IT strategy.
• Optimized development and use of IT capabilities to meet business needs.
• Improved integration with corporate/enterprise governance.

Executive Brief Case Study

INDUSTRY Manufacturing
SOURCE Info-Tech analyst experience

Improving the governance approach and delegating decision making to support a change in business operation

Challenge

The large, multi-national organization has locations across the world but has two primary headquarters, in Europe and the United States.

Market shifts drove an organizational shift in strategy, leading to a change in operating models, a product focus, and new work approaches across the organization.

Much of the implementation and execution was done in isolation, and effectiveness was slowed by poor integration and conflicting activities that worked against each other.

The product owner role was not well defined.

Solution

After reviewing the organization’s challenges and governance approach, we redefined and realigned its organizational and regional goals and identified outcomes that needed to be driven into their strategies.

We also reviewed their span of control and integration requirements and properly defined decisions that could be made regionally versus globally, so that decisions could be made to support new work practices.

We defined the product and service owner roles and the decisions each needed to make.

Results

We saw an improvement in the alignment of organizational activities and the right people and bodies making decisions.

Work and practices were aimed at the same key outcomes and alignment between teams toward organizational goal improved.

Within one year, the success rate of the organization’s initiatives increased by 22%, and the percentage of product-related decisions made by product owners increased by 50%.

Info-Tech offers various levels of support to best suit your needs

Diagnostics and consistent frameworks used throughout all four options

Guided Implementation

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is between 5 and 8 calls over the course of 2 to 3 months.

What does a typical GI on this topic look like?

Phase 1: Identify Your Governance Needs

• Call #1: Confirm your organization’s mission and vision and review your strategy and goals.
• Call #2: Identify considerations and governance needs. Develop your guiding star and governing principles.

Phase 2: Select and Refine Your Model

• Call #3: Select your base model and optimize it to meet your governance needs.
• Call #4: Define your adjustment triggers and develop your implementation plan.

Phase 3: Embed and Automate

• Call #5: Identify decisions and standards you can automate and where to embed them.
• Call #6: Confirm levels of authority and data requirements. Establish your approach and update the implementation plan.

Workshop Overview

Contact your account representative for more information.
workshops@infotech.com1-888-670-8889

Make Your IT Governance Adaptable

Phase 1

Identify your Governance Needs

This phase will walk you through the following activities:

Identify the organization’s goals, mission, and vision that will guide governance.

Define the scope of your governance model and the principles that will guide how it works.

Account for organizational attitudes, behaviors, and culture related to governance and finalize your context.

This phase involves the following participants:

• Senior IT leadership
• Governance leads

Step 1.1

Define Your Guiding Star

Activities

• 1.1.1 Document and interpret your strategy, mission, and vision
• 1.1.2 Document and interpret the business and IT goals and outcomes
• 1.1.3 Identify your operating model and work processes

This step will walk you through the following activities:

Review your business and IT strategy, mission, and vision to ensure understanding of organizational direction.

Identify the business and IT goals that governance needs to align.

Confirm your operating model and any work practices that need to be accounted for in your model.

This step involves the following participants:

• Senior IT leadership
• Governance leads

Outcomes of this step

Identified guiding star outcomes to align governance outcomes with

Defined operating model type and work style that impact governance design

Identify Your Governance Needs

Govern by intent

Find the balance for your designed governance approach

Organic governance occurs during the formation of an organization and shifts with challenges, but it is rarely transparent and understood. It changes your culture in uncontrolled ways.	Intentional governance is triggered by changes in organizational needs, working approaches, goals, and structures. It is deliberate and changes your culture to enable success.

Info-Tech Insight

Your approach to governance needs to be designed, even if your execution of governance is adaptable and delegated.

What is your guiding star?

Your guiding star is a combination of your organization’s mission, vision, and strategy and the goals that have been defined to meet them.

It provides you with a consistent focal point around which I&T-related activities and projects orbit, like planets around a star.

It generates the gravity that governance uses to keep things from straying too far away from the goal of achieving relevant value.

1. Mission & Vision
2. Business Goals & Success Criteria
3. Operating Model & Work Practices
4. Governance Scope
5. Principles

1.1.1 Document and interpret your strategy, mission, and vision

Input: Business strategy, IT strategy, Mission and vision statements

Output: Updated Governance Workbook, Documented strategic outcomes and organizational aims that governance needs to achieve

Materials: Whiteboard/flip charts, Governance Workbook

Participants: IT senior leadership

1. Gather your available business, digital, and IT strategy, mission, and vision information and document everything in your Governance Workbook. It’s ok if you don’t have all of it.
2. Review and your mission and vision as a group. Discuss and document key points, including:
   • Which activities do you perform as an organization that embody your vision?
   • What key decisions and behaviors are required to ensure that your mission and vision are achievable?
   • What do you require from leadership to enable you to govern effectively?
   • What are the implications of the mission and vision on how the organization needs to work? What are the implications on decisions around opportunities and risks?

Download the Governance Workbook

1.1.2 Document and interpret the business and IT goals and outcomes

60 minutes

Input: Business strategy, Business and IT goals and related initiatives

Output: Required success outcomes for goals, Links between IT and business goals that governance needs to align

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Document the business and IT goals that have been created to achieve the mission and vision.
2. Discuss if there are any gaps between the goals and the mission and vision. Ask yourself – if we accomplish these goals will we have successfully achieved the mission?
3. For each goal, define what successful achievement of the goal looks like. Starting with one goal or objective, ask:
   • How would I know I am on the right path and how will I know I have gotten there?
   • How would I know if I am not on the right path and what does a bad result look like?
Document your success criteria.
4. Brainstorm some examples of decisions that support or constrain the achievement of your goals.
5. Repeat this exercise for your remaining goals.
6. As a group, map IT goals to business goals.

What is your operating model and why is it important?

An IT operating model is a visual representation of the way your IT organization needs to be designed and the capabilities it requires to deliver on the business mission, strategic objectives, and technological ambitions.

The model is critical in the optimization and alignment of the IT organization’s structure in order to deliver the capabilities required to achieve business goals. It is a key determinant of how governance needs to be designed and where it is implemented.

1.1.3 Identify your operating model and work practices

60 minutes

Input: Organizational structure, Operating model (if available)

Output: Confirmed operating approach, Defined work practices

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Identify the way your organization functions:
   • How do we currently operate? Are we centralized, decentralized or a hybrid? Are we focused on delivering products and services? Do we provide service ourselves or do we use vendors for delivery?
   • Can we achieve our mission, goals, and strategies, if we continue to operate this way? What would we have to change in how we operate to be successful in the future?
2. Identify your governance needs. Do we need to be more structured or more flexible to support our future ways of working?
   • If you operate in a more traditional way, consider whether you are implementing or moving toward more modern practices (e.g. Agile, DevOps, enterprise service management). Do you need to make more frequent but lower-risk decisions?
   • Is your organization ready to delegate governance culturally and in terms of business understanding? Is there enough available information to support adaptive decisions and actions?
3. Document your operating style, expected changes in work style, and cultural readiness. You will need to consider the implications on design.

Step 1.2

Define Scope and Principles

Activities

• 1.2.1 Determine the proper scope for your governance
• 1.2.2 Confirm your determining governing principles
• 1.2.3 Develop your specific governing principles

This step will walk you through the following activities:

Identify what is included and excluded within the scope of your governance.

Develop the determining and specific principles that provide guardrails for governance activities and decisions.

This step involves the following participants:

• Senior IT leadership
• Governance leads

Outcomes of this step

Documented governance scope and principles to apply

Identify Your Governance Needs

Define the context for governance

Based on the goals and principles you defined and the operating model you selected, confirm where oversight will be necessary and at what level. Focus on the necessity to expedite and clear barriers to the achievement of goals and on the ownership of risks and compliance. Some key considerations:

• Where in the organization will you need to decide on work that needs to be done?
• What type of work will you need to do?
• In what areas could there be conflicts in prioritization/resource allocation to address?
• Who is accountable for risks to the organization and its objectives?
• Where are your regional or business-unit-specific concerns that require focused local attention?
• Are we using more agile, rapid delivery methods to produce work?

Understand your governance scope

Your governance scope helps you define the boundaries of what your governance model and practices will cover. This includes key characteristics of your organization that impact what governance needs to address.

Sample Considerations

• Organizational Span
  • The geographical area the organization operates within. Regional laws and requirements will affect governance delegation and standards/policy development.
• Level of Regulation
  • Higher levels of regulation create more standards and controls for risk and compliance, impacting how authority can be delegated or automated.
• Sourcing Model
  • Changing technology sourcing introduces additional vendor governance requirements and may impact compliance and audit.
• Risk Posture
  • The appetite for risk organizationally, and in pockets, impacts the level of uncertainty you are willing to work within and impact decision-making authority positioning.
• Size
  • The size of your organization impacts the approach to governance, practice implementation, and delegation of authority.
• What Is Working Today?
  • Which elements of your current governance approach should be retained, and what are the biggest pain points that need to be addressed?

1.2.1 Determine the proper scope for your governance

60 minutes

Input: Context information from Activity 1.1, Scoping areas

Output: Defined scope and span of control

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Determine the scope/span of control required for your governance by:
   • Reviewing your key IT capabilities. Identify the ones where the responsibilities and decisions require oversight to ensure they meet the needs of the organization.
   • Identify what works well or poorly in your current governance approach.
   • Discuss and document the level and type of knowledge and business understanding required.
   • Identify and document any regulations, standards, or laws that apply to your organization/industry and how broadly they have to be applied.
   • Identify the organization’s risk appetite, where known, and areas where acceptable thresholds of risk have been defined. Where are key risk and opportunity decisions made? Who owns risk in your organization?
   • Identify and document the perceived role of the IT group in your organization (e.g. support, innovator, partner) and sourcing model (e.g. insource, outsource).
   • Is there sufficient information and data available in your organization to support effective decision making?

How should your governance be structured?

Organizations often have too many governance bodies, creating friction without value. Where that isn’t the case, the bodies are often inefficient, with gaps or overlaps in accountability and authority. Structure your governance to optimize its effectiveness, designing with the intent to have the fewest number of governing bodies to be effective, but no less than is necessary.

Start with your operating model.

• Understand what’s different about your governance based on whether your organization in centralized, distributed, or a different model (e.g. hybrid, product).
• Identify and include governance structures that are mandatory due to regulation or industry.
• Based on your context, identify how many of your governance activities should be performed together.

Determine whether your governance should be controlled or adaptive.

• Do you have the capability to distribute governance and is your organization empowered enough culturally?
• Do you have sufficient standards and data to leverage? Do you have the tools and capabilities?
• Identify governance structures that are required due to regulation or industry.

Info-Tech Insight

Your approach to governance needs to be designed and structured, even if your execution of governance is adaptable and delegated.

Identify and Refine your Principles

Confirm your defining principles based on your selection of controlled or adaptive governance. Create specific principles to clarify boundaries or provide specific guidance for teams within the organization.

Determining Principle: Delegate and empower.

Specific Principle: Decisions should be made at the lowest reasonable level of the organization with clarity.

Rationale: To govern effectively with the velocity required to address business needs, governance needs to be executed deeper into the organization and organizational goals need to be clearly understood everywhere.

Implication: Decision making needs to be delegated throughout the organization, so information and data requirements need to be identified, decision-making approach and principles need to be shared, and authority needs to be delegated clearly.

1.2.2 Confirm your determining governance principles

30-45 minutes

Input: Governance Framework Model– Governance Principles

Output: Governance workbook - Finalized list of determining principles

Materials: Whiteboard/flip charts, Governance Workbook

Participants: IT senior leadership

1. Review the IT governance principles in your Governance Workbook.
2. Within your IT senior leadership team (or IT governance working group) assign one or two principles to teams of two to three participants. Have each team identify what this would mean for your organization. Answering the questions:
   • In what ways do our current governance practices support this?
   • What are some examples of changes that would need to be made to make this a reality?
   • How would applying this principle improve your governance?
3. Have each team present their results and compile the findings and implications in the Governance Workbook to use for future communication of the change.

Specific governing principles

Specific governing principles are refined principles derived from a determining principle, when additional specificity and detail is necessary. It allows you to define an approach for specific behaviors and activities. Multiple specific principles may underpin the determining one.

Specific Principles – Related principles that may be required to ensure the implications of the determining principal are addressed within the organization. They may be specific to individual areas and may be addressed in policies. Implications – The implications of this principle on the organization, specific to how and where governance is executed and the level of information and authority that would be necessary. Rationale – The reason(s) driving the determining principle. Determining Principle – A core overarching principle – a defining aspect of your governance model.

1.2.3 Develop your specific governing principles

30 minutes

Input: Updated determining principles

Output: List of specific principles linked to determining principles

Materials: Whiteboard/flip charts, Governance Workbook

Participants: IT senior leadership

1. Confirm the determining principles for your governance model based on your previous discussions.
2. Identify where to apply the principles. This is based on:
   1. Your governance scope (how much is within your span of control)
   2. The amount of data you have available
   3. Your cultural readiness for delegation
3. Create specific principles to support the determining principles:
   1. Document the rationale driving the determining principles.
   2. Identify the implications.
   3. Create specific principles that will support the success in achieving the goals of each determining principle.
4. Document all information on the “Governance guiding star” slide in the Governance Workbook.

Download the Governance Workbook

Step 1.3

Adjust for Culture and Finalize Context

Activities

• 1.3.1 Identify and address the impact of attitude, behavior, and culture
• 1.3.2 Finalize your context

This step will walk you through the following activities:

Identify your organizational attitude, behavior, and culture related to governance.

Identify positives that can be leveraged and develop means to address negatives.

Finalize the context that your model will leverage and align to.

This step involves the following participants:

• Senior IT leadership
• Governance leads

Outcomes of this step

Downloaded tool ready to select the base governance model for your organization

Identify Your Governance Needs

Understanding attitude, behavior, and culture

What people think and feel. It can be seen in their demeanor and how they react to change initiatives, colleagues, and users. This manifests in the belief that governance is a constraint that needs to be avoided or ignored – often with unintended consequences.

New Results'.">

Any form of organizational change involves adjusting people’s attitudes to create buy-in and commitment.

You need to identify and address attitudes that can lead to negative behaviors and actions or that are counter-productive.

Understanding attitude, behavior, and culture

What people do. This is influenced by attitude and the culture of the organization. In governance, this manifests as people’s willingness to be governed, who pushes back, and who tries to bypass it.

To implement change within IT, especially at a tactical and strategic level, organizational behavior needs to change.

This is relevant because people gravitate toward stability and will resist change in an active or passive way unless you can sell the need, value, and benefit of changing their behavior and way of working.

Understanding attitude, behavior, and culture

The accepted and understood ways of working in an organization. The values and standards that people find normal and what would be tacitly identified to new resources. In governance terms, this is how decisions are really made and where responsibility really exists rather than what is identified formally.

The impact of the organizational or corporate “attitude” on employee behavior and attitude is often not fully understood.

Culture is an invisible element, which makes it difficult to identify, but it has a strong impact and must be addressed to successfully embed governance models. In the case of automating governance, cultural readiness for automation is a critical success factor.

1.3.1 Identify and address the impact of attitude, behavior, and culture

45 minutes

Input: Senior leadership knowledge

Output: Updated Governance Workbook

Materials: Governance Workbook

Participants: IT senior leadership

1. Break into three groups. Each group will discuss and document the positive and negative aspects of one of attitude, behavior, or culture related to governance in your organization.
2. Each group will present and explain their list to the group.
3. Add any additional suggestions in each area that are identified by the other groups.
4. Identify the positive elements of attitude, behavior, and culture that would help with changing or implementing your updated governance model.
5. Identify any challenges that will need to be addressed for the change to be successful.
6. As a group, brainstorm some mitigations or solutions to these challenges. Document them in the Governance Workbook to be incorporated into the implementation plan.

Download the Governance Workbook

Attitude, behavior, and culture

Evaluate the organization across the three contexts. The positive items represent opportunities for leveraging these characteristics with the implementation of the governance model, while the negative items must be considered and/or mitigated.

1.3.2 Finalize your governance context

30 minutes

Input: Documented governance principles and scope from previous exercises

Output: Finalized governance context in the Governance Workbook

Materials: Whiteboard/flip charts, Governance Workbook

Participants: IT senior leadership

1. Use the information that has been gathered throughout this section to update and finalize your IT governance context.
2. Document it in your Governance Workbook.

Download the Governance Workbook

Make Your IT Governance Adaptable

Phase 2

Select and Refine Your Governance Model

This phase will walk you through the following activities:

Select a base governance model and refine it to suit your organization.

Identify scenarios and changes that will trigger updates to your governance model.

Build your implementation plan.

This phase involves the following participants:

• Senior IT leadership
• Governance resources

Step 2.1

Choose and Adapt Your Model

Activities

• 2.1.1 Choose your base governance model
• 2.1.2 Confirm and adjust the structure of your model
• 2.1.3 Define the governance responsibilities
• 2.1.4 Validate the governance mandates and membership
• 2.1.5 Update your committee processes
• 2.1.6 Adjust your associated policies
• 2.1.7 Adjust and confirm your governance model

This step will walk you through the following activities:

Review and selecting your base governance model.

Adjust the structure, responsibilities, policies, mandate, and membership to best support your organization.

This step involves the following participants:

• Senior IT leadership
• Governance leads

Outcomes of this step

Downloaded tool ready to select the base governance model for your organization

Select and Refine Your Governance Model

Your governance framework has six key components

GOVERNANCE FRAMEWORK

• GUIDELINES
  The key behavioral factors that ground your governance framework
• MEMBERSHIP
  Formalization of who has authority and accountability to make specific governance decisions
• RESPONSIBILITIES
  The definition of which decisions and outcomes your governance structure and each governance body is accountable for
• STRUCTURE
  Which governance bodies and roles are in place to articulate where decisions are made in the organization
• PROCESS
  Identification of the how your governance will be executed, how decisions are made, and the inputs, outputs, and connections to related processes
• POLICY
  Set of principles established to address risk and drive expected and required behavior

4 layers of governance bodies

There are traditionally 4 layers of governance in an enterprise, and organizations have governing bodies or individuals at each level

2.1.1 Choose your base governance model

30 minutes

Input: Governance models templates

Output: Selected governance model

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Download Info-Tech’s base governance models (Controlled Governance Models Template and IT Governance Program Overview) and review them to find a template that most closely matches your context from Phase 1. You can start with a centralized, decentralized, or product/service hybrid IT organization. Remove unneeded models.
2. If you do not have documented governance today, start with a controlled model as your foundation. Continue working through this phase if you have a documented governance framework you wish to optimize using our best practices or move to Phase 3 if you are looking to automate or embed your governance activities.

Controlled Governance Models Template

Adaptive Governance Models Template

2.1.2 Confirm and adjust the structure of your model

30-45 minutes

Input: Selected base governance model, Governance context/scope

Output: Updated governance bodies and relationships

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Validate your selected governance body structural model.
   • Are there any governing bodies you must maintain that should replace the ones listed? In part or in full?
   • Are there any missing bodies? Look at alternative committees for examples.
   • Document the adjustments.
2. Are there any governing bodies that are not required?
   • Based on your size and needs, can they be done within one committee?
   • Is the capability or data not in place to perform the work?
   • Document the required changes.

There are five key areas of governance responsibility

STRATEGIC ALIGNMENT Ensures that technology investments and portfolios are aligned with the organization’s needs. VALUE DELIVERY Reviews the outcomes of technology investments and portfolios to ensure benefits realization. RISK MANAGEMENT Defines and owns the risk thresholds and register to ensure that decisions made are in line with the posture of the organization.

RESOURCE MANAGEMENT Ensures that people, financial knowledge, and technology resources are appropriately allocated across the organization. PERFORMANCE MEASUREMENT Monitors and directs the performance or technology investments to determine corrective actions and understand successes.

2.1.3 Define the governance responsibilities

Ensure you have the right responsibilities in the right place

45-60 minutes

Input: Selected governance base model, Governance context

Output: Updated responsibilities and activities, Updated activities for selected governance bodies, New or removed governing bodies

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Based on your context and model, review the responsibilities identified for each committee and confirm that they align with the mandate and the stated outcome.
2. Identify and highlight any responsibilities and activities that would not be involved in informing and enabling the mandate of the committee.
3. Adjust the wording of confirmed responsibilities and activities to reflect your organizational language.
4. Review each highlighted “bad fit” activity and move it to a committee whose mandate it would support or remove it if it’s not performed in your organization.
5. If an additional committee is required, define the mandate and scope, then include any additional responsibilities that might have been a bad fit elsewhere

2.1.4 Validate the governance mandates and membership

30 minutes

Input: Selected governance base model, Updated structure and responsibilities

Output: Adjusted mandates and refined committee membership

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Review the mandate and membership slides in your selected governance model.
2. Adjust the mandate to ensure that it aligns to and conveys:
   1. The outcome that the committee is meant to generate for the organization.
   2. Its scope/span of control.
3. Discuss the type of information members would require for the committee to be successful in achieving its mandate.
4. Document the member knowledge requirement in the mandate slide of the model template.

Determine the right membership for your governance

One of the biggest benefits of governance committees is the perspective provided by people from various parts of the organization, which helps to ensure technology investments are aligned with strategic goals. However, having too many people – or the wrong people – involved prevents the committee from being effective. Avoid this by following these principles.

Three principles for selecting committee membership

1. Determine membership based on responsibilities and required knowledge.
   Organizations often make the mistake of creating committees and selecting members before defining what they will do. This results in poor governance because members don’t have the knowledge required to make decisions. Define the mandate of the committee to determine which members are the right fit.
2. Ensure members are accountable and authorized to make the decisions.
   Effective governance requires the members to have the authority and accountability to make decisions. This ensures meetings achieve their outcome and produce value, which improves the committee’s chances of survival.
3. Select leaders who see the big picture.
   Often committee decisions and responsibilities become tangled in the web of organizational politics. Include people, often C-level, whose attendance is critical and who have the requisite knowledge, mindset, and understanding to put business needs ahead of their own.

2.1.5 Update your committee processes

20 minutes

Input: Selected governance base model, Updated structure and responsibilities

Output: Updated committee processes

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Review the committee details based on the changes you have made in goals, mandate, and responsibilities.
2. Identify and document changes required to the committee outputs (outcomes) and adjust the consumer of the outputs to match.
3. Review the high-level process steps required to get to the modified output. Add required activities or remove unnecessary ones. Review the process flow. Does it make sense? Are there unnecessary steps?
4. Review and update inputs required for the process steps and update the information/data sources.
5. Adjust the detailed process steps to reflect the work that needs to be done to support each high-level process step that changed.

2.1.6 Adjust your associated policies

20 minutes

Input: Selected governance base model, Updated structure and responsibilities

Output: Adjusted mandates and refined committee membership

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Review the policies associated with the governing bodies in your base model. Identify the policies that apply to your organization, those that are missing, and those that are not necessary.
2. Confirm the policies that you require.
3. Make sure the policies and policy purposes (or risks and related behaviors the policy addresses) are matched to the governance committee that has responsibilities in that area. Move policies to the right committee.

2.1.7 Adjust and confirm your governance model

1. Confirm the adjustment of governance bodies, structure, and input/output linkages.
2. Confirm revisions to decisions and responsibilities.
3. Confirm policy and regulation/standards associations.
4. Select related governance committee charters from the provided set and revise the charters to reflect the elements defined in your updated model.
5. Finalize your governance model.

Step 2.2

Identify and Document Your Governance Triggers

Activities

• 2.2.1 Identify and document update triggers
• 2.2.2 Embed triggers into the review cycle

This step will walk you through the following activities:

Identify scenarios that will create a need to review or change your governance model.

Update your review/update approach to receiving trigger notifications.

This step involves the following participants:

• Senior IT leadership
• Governance leads

Outcomes of this step

Downloaded tool ready to select the base governance model for your organization

Select and Refine Your Governance Model

What are governance triggers

Governance triggers are organizational or environmental changes within or around an organization that are inflection points that start the review and revision of governance models to maintain their fit with the organization. This is the key to adaptive governance design.

2.2.1 Identify and document update triggers

30 minutes

Input: Governance Workbook

Output: Updated workbook with defined and documented governance triggers, points of origin, and integration

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Open the Governance Workbook to the “Triggers” slides.
2. Review the list of governance triggers. Retain the ones that apply to your organization, remove those you feel are unnecessary, and add any change scenarios you feel should be included.
3. Identify where you would receive notifications of these changes and the related processes or activities that would generate these notifications, if applicable.
4. Document any points of integration required between governance processes and the source process. Highlight any where the integration is not currently in place.

2.2.2 Embed triggers into the review cycle

30 minutes

Input: Governance model

Output: Review cycle update

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. Identify which triggers impact the entire governance model and which impact specific committees.
2. Add an activity for triggered review of the impacted governance model into your governance committee process.

Step 2.3

Build Your Implementation Approach

Activities

• 2.3.1 Identify and document your implementation plan
• 2.3.2 Build your roadmap
• 2.3.3 Build your sunshine diagram

This step will walk you through the following activities:

Transfer changes to the Governance Implementation Plan Template.

Determine the timing for the implementation phases.

This step involves the following participants:

• Senior IT leadership
• Governance process owner

Outcomes of this step

Implementation plan for adaptive governance framework model

2.3.1 Identify and document your implementation plan

60 minutes

Input: Governance model, Guiding principles, Update triggers, Cultural factors and mitigations

Output: Implementation roadmap

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. As a group, discuss the changes required to implement the governance model, the cultural items that need to be addressed, and the anticipated timing.
2. Document the implementation activities and consolidate them into groupings/themes based on similarities or shared outcomes.
3. Name the grouped themes for clarity and identify key dependencies between activities in each area and across themes.
4. Identify and document your approach (e.g. continuous, phased) and high-level timeline for implementation.
5. Document the themes and initiatives in the Governance Implementation Plan.

Download the Governance Implementation Plan

Illustrate the implementation plan using roadmaps

Info-Tech recommends two different methods to roadmap the initiatives in your Governance Implementation Plan.

Gantt Chart This type of roadmap depicts themes, related initiatives, the associated goals, and exact start and end dates for each initiative. This diagram is useful for outlining a larger number of activities and initiatives and has an easily digestible and repeatable format.

Sunshine Diagram This type of roadmap depicts themes and their associated initiatives. The start and end dates for the initiatives are approximated based on years or phases. This diagram is useful for highlighting key initiatives on one page.

2.3.2 Build your roadmap

Input: Governance themes and initiatives

Output: roadmap visual

Materials: Governance Roadmap Workbook, Governance Workbook

Participants: CIO, IT senior leadership

1. Open the Governance Implementation Plan and review themes and initiatives.
2. Open the Governance Roadmap Workbook.
3. Discuss whether the implementation roadmap should be developed as a Gantt chart, a sunshine diagram, or both.
   For the Gantt chart:
   • Input the roadmap start year and date.
   • Change the months and year in the Gantt chart to reflect the same roadmap start year.
   • Input and populate the planned start and end dates for the list of high-priority initiatives.

Develop your Gantt chart in the Governance Roadmap Workbook

2.3.3 Build your sunshine diagram

30 minutes

Input: Governance themes and initiatives

Output: Sunshine diagram visual

Materials: Whiteboard/flip charts, Markers, Governance Implementation Plan

Participants: CIO, IT senior leadership

1. Review your list of themes and initiatives.
2. Build a model with “rays” radiating out from a central theme or objective.
3. Using curved arcs, break the grid into timeline periods or phases.
4. Complete your sunshine diagram in the Governance Implementation Plan.

Customize your sunshine diagram in the Governance Implementation Plan

Make Your IT Governance Adaptable

Phase 3

Embed and Automate

This phase will walk you through the following activities:

Identify which decisions you are ready to automate.

Identify standards and policies that can be embedded and automated.

Identify integration points.

Confirm data requirements to enable success.

This phase involves the following participants:

• IT senior leadership
• Governance process owner
• Product and service owners
• Policy owners

Step 3.1

Identify Decisions to Embed and Automate

Activities

• 3.1.1 Review governance decisions and standards and the required level of authority
• 3.1.2 Build your decision logic
• 3.1.3 identify constraints and mitigation approaches
• 3.1.4 Develop decision rules and principles

This step will walk you through the following activities:

Identify your key decisions.

Develop your decision logic.

Confirm decisions that could be automated.

Identify and address constraints.

Develop decision rules and principles.

This step involves the following participants:

• IT senior leadership

Outcomes of this step

Developed decision rules, rulesets, and principles that can be leveraged to automate governance

Defined integration points

Embed and Automate

What is decision automation?

Decision automation is the codifying of rules that connect the logic of how decisions are made with the data required to make those decisions. This is then embedded and automated into processes and the design of products and services.

• It is well suited to governance where the same types of decisions are made on a recurring basis, using the same set of data. It requires clean, high-quality data to be effective.
• Improvements in artificial intelligence (AI) and machine learning (ML) have allowed the creation of scenarios where a hybrid of rules and learning can improve decision outcomes.

Key Considerations

• Data Availability
• Legality
• Contingencies
• Decision Transparency
• Data Quality
• Auditability

How complexity impacts decisions

Decision complexity impacts the type of rule(s) you create and the amount of data required. It also helps define where or if decisions can be automated.

1. SIMPLE
   Known and repeatable with consistent and familiar outcomes – structured, causal, and easy to standardize and automate.
2. COMPLICATED
   Less known and outcomes are not consistently repeatable. Expertise can drive standards and guidelines that can be used to automate decisions.
3. COMPLEX
   Unknown and new, highly uncertain in terms of outcomes, impact, and data. Requires more exploration and data. Difficult to automate but can be built into the design of products and services.
4. CHAOTIC
   Unstructured and unknown situation. Requires adaptive and immediate action without active data – requires retained human governance
(Based on Dave Snowden’s Cynefin framework)

Governance Automation Criteria Checklist

The Governance Automation Criteria Checklist provides a view of key considerations for determining whether a governing activity or decision is a good candidate for automation.

The criteria identify key qualifiers/disqualifiers to make it easier to identify eligibility.

Download the Governance Automation Criteria Checklist

Governance Automation Worksheet

The Governance Automation Worksheet provides a way to document your governance and systematically identify information about the decisions to help determine if automation is possible.

From there, decision rules, logic, and rulesets can be designed in support of building a structure flow to allow for automation.

Download the Governance Automation Worksheet

3.1.1 Review governance decisions and standards and the required level of authority

30 minutes

Input: Automation Criteria Checklist, Governance Automation Worksheet, Updated governance model

Output: Documented decisions and related authority, Selected options for automation, Updated Governance Automation Worksheet

Materials: Whiteboard/flip charts, Governance Automation Worksheet

Participants: IT senior leadership

1. Identify the decisions that are made within each committee in your updated governance model and document them in the Governance Automation Worksheet.
2. Confirm the level of authority required to make each decision.
3. Review the automation checklist to confirm whether each decision is positioned well for automation.
4. Select and document the decisions that are the strongest options for automation/embedding and document them in the Governance Automation Worksheet.

What are decision rules?

Decision rules provide specific instructions and constraints that must be considered in making decisions and are critical for automating governance.

They provide the logical path to assess governance inputs to make effective decisions with positive business outputs.

Inputs would include key information such as known risks, your defined prioritization matrix, portfolio value scoring, and compliance controls.

Individual rules can be leveraged in different places.

Some decision rule types are listed here.

1. Statement Rules
   Natural expression of logical progression, written through logical elements
2. Decision Tree Rules
   Decision tree with two axes that overlap to generate a decision
3. Sequential Rules
   A sequence of decisions that move from one step to the next
4. Expression Rule
   A particular set of rules triggered by a particular rule condition being met
5. Truth table rules
   Combines many decision factors into one place; produces different outputs

What are decision rulesets

Rulesets are created to make complex decisions. Individual rule types are combined to create rulesets that are applied together to generate effective decisions. One rule will provide contextual information required for additional rules to execute in a Rule-Result-Rule-Result-Rule-Decision flow.

3.1.2 Build your decision logic

30 minutes

Input: Governance Automation Worksheet

Output: Documented decision logic to support selected decision types and data requirements

Materials: Whiteboard/flip charts

Participants: IT senior leadership

1. For each selected decision, identify the principles that drive the considerations around the decision.
2. For each decision, develop the decision logic by defining the steps and information inputs involved in making the decision and documenting the flow from beginning to end.
3. Determine whether this is one specific decision or a combination of different decisions (in sequence or based on decisions).
4. Name your decision rule.

3.1.3 Identify constraints and mitigation approaches

1. Document constraints to automation of decisions related to:
   • Availability of decision automation tools
   • Decision authority change requirements
   • Data constraints
   • Knowledge requirements
   • Process adjustment requirements
   • Product/service design levels
2. Brainstorm and identify approaches to mitigate constraints and score based on likelihood of success.
3. Identify mitigation owners and initial timeline expectations.
4. Document the constraints and mitigations in the Governance Workbook on the constraints and mitigations slide.

3.1.4 Develop decision rules and principles

1.5-2 hours

Input: Governance Automation Worksheet

Output: Defined decision integration points, Confirmed data availability sets, Decision rules, rulesets, and principles with control indicators

Materials: Whiteboard/flip charts, Governance Automation Worksheet

Participants: IT senior leadership

1. Review the decision logic for those decisions that you have confirmed for automation. Identify the processes where the decision should be executed.
2. Associate each decision with specific process steps or stages or how it would be included in software/product design.
3. For each selected decision, identify the availability of data required to support the decision logic and the level of complexity and apply governing principles.
4. Create the decision rules and identify data gaps.
5. Define the decision flow and create rulesets as needed.
6. Confirm automation requirements and define control indicators.

Step 3.2

Plan Validation and Verification

Activities

• 3.2.1 Define verification approach for embedded and automated governance
• 3.2.2 Define validation approach for embedded and automated governance

This step will walk you through the following activities:

Define how decision outcomes will be measured.

Determine how the effectiveness of automated governance will be reported.

This step involves the following participants:

• IT senior leadership

Outcomes of this step

Tested and verified automation of decisions

Embed and Automate

Decision rule relationship through to verification

3.2.1 Define verification approach for embedded and automated governance

60 minutes

Input: Governance rules and rulesets as defined in the Governance Automation Worksheet, Defined decision outcomes

Output: A defined measurement of effective decision outcomes, Approach to automate and/or report the effectiveness of automated governance

Materials: Whiteboard/flip charts

Participants: IT senior leadership

Verify

1. Confirm expected outcome of rules.
2. Select a sampling of new required decisions or recently performed decisions related to areas of automation.
3. Run the decisions through the decision rules or rule groupings that were developed and compare to parallel decisions made using the traditional approach. (These must be segregated activities.)
4. Review the outcome of the rules and adjust based on the output. Identify areas of adjustment. Confirm that the automation meets your requirements.

3.2.2 Define validation approach for embedded and automated governance

60 minutes

Input: Governance rules and rulesets as defined in the Governance Automation Worksheet, Defined decision outcomes

Output: Defined assurance and attestation requirements, Key control indicators that can be automated

Materials: Whiteboard/flip charts

Participants: IT senior leadership

Validate

1. Develop an approach to measure automated decisions. Align success criteria to current governance KPIs and metrics.
2. If no such metrics exist, define expected outcome. Define key risk indicators based on the expected points of automation.
3. Establish quality assurance checkpoints within the delivery lifecycles to adjust for variance.
4. Create triggers back to rule owners to drive changes and improvements to rules and rule groupings.

Step 3.3

Update Implementation Plan

Activities

• 3.3.1 Finalize the implementation plan

This step will walk you through the following activities:

Review implications and mitigations to make sure all have been considered.

Finalize the implementation plan and roadmap.

This step involves the following participants:

• Senior IT leadership

Outcomes of this step

Completed Governance implementation plan and roadmap

Embed and Automate

3.3.1 Finalize the implementation plan

30 minutes

Input: Governance workbook, Updated governance model, Draft implementation plan and roadmap

Output: Finalized implementation plan and roadmap

Materials: Whiteboard/flip charts, Governance Implementation Plan

Participants: IT senior leadership

1. Document automation activities within phases in a governance automation theme in the Governance Implementation Plan.
2. Review timelines in the implementation plan and where automation fits within the roadmap.
3. Updated the implementation plan and roadmap.

Governance Implementation Plan

Summary of Accomplishment

Problem Solved

Through this project we have:

• Improved your governance model to ensure a better fit for your organization, while creating adaptivity for the future.
• Ensured your governance operates as an enabler of success with the proper bodies and levels of authority established.
• Established triggers to ensure your governance model is actively adjusted to maintain its fit.
• Developed a plan to embed and automate governance.
• Created decision rules and principles and identified where to embed them within your practices.

If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

Additional Support

If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

Related Info-Tech Research

Improve IT Governance to Drive Business Results

Avoid bureaucracy and achieve alignment with a minimalist approach. Align with your organizational context.

Establish Data Governance

Establish data trust and accountability with strong governance.

Maximize Business Value From IT Through Benefits Realization

Embed value and alignment confirmation into your governance to ensure you optimize IT value achievement for resource spend.

Build a Better Product Owner

Strengthen the product/service owner role in your organization by focusing on core capabilities and proper alignment.

Research contributors and experts

Sidney Hodgson Senior Director, Industry Info-Tech Research Group Sidney has over 30 years of experience in IT leadership roles as CIO of three organizations in Canada and the US as well as international consulting experience in the US and Asia. Sid has a breadth of knowledge in IT governance, project management, strategic and operational planning, enterprise architecture, business process re-engineering, IT cost reduction, and IT turnaround management.

David Tomljenovic Principal Research Advisor, Industry Info-Tech Research Group David brings extensive experience from the Financial Services sector, having worked 25 years on Bay Street. Most recently he was a Corporate Finance and Strategy Advisor for Infiniti Labs (Toronto/Hong Kong), Automotive, and Smart City Accelerator, where he provided financial and mergers & acquisitions advisory services to accelerator participants with a focus on early-stage fundraising activities.

Research contributors and experts

Cole Cioran Practice Lead, Applications and Agile Development Info-Tech Research Group Over the past 25 years, Cole has developed software; designed data, infrastructure, and software solutions; defined systems and enterprise architectures; delivered enterprise-wide programs; and managed software development, infrastructure, and business systems analysis practices.

Crystal Singh Research Director, Applications – Data and Information Management Info-Tech Research Group Crystal brings a diverse and global perspective to her role, drawing from her professional experiences in various industries and locations. Prior to joining Info-Tech, Crystal led the Enterprise Data Services function at Rogers Communications, one of Canada’s leading telecommunications companies.

Research contributors and experts

Carlene McCubbin Practice Lead, CIO Info-Tech Research Group Carlene covers key topics in organization and leadership and specializes in governance, organizational design, relationship management, and human capital development. She led the development of Info-Tech’s Organization and Leadership practice.

Denis Goulet Senior Workshop Director Info-Tech Research Group Denis is a transformational leader and experienced strategist who focuses on helping clients communicate, relate, and adapt for success. Having developed Governance Model and IT strategies in organizations ranging from small to billion-dollar multi-nationals, he firmly believes in a collaborative value-driven approach to work.

Bibliography

“2020 State of Data Governance and Automation Report.” Erwin.com, 28 Jan. 2020. Web.

“Adaptive IT Governance.” Google search, 15 Nov. 2020.

“Adaptive IT Governance Framework.” CIO Index, 3 Nov. 2011. Accessed 15 Nov. 2020.

“Agile Governance Made Easy.” Agilist, n.d. Accessed 15 Nov. 2020.

“Automating Governance — Our Work.” Humanising Machine Intelligence, n.d. Accessed 15 Nov. 2020.

“Automation – Decisions.” IBM, 2020. Accessed 15 Oct. 2020.

Chang, Charlotte. “Accelerating Agile through effective governance.” Medium, 22 Sept. 2020. Web.

“COBIT 5: Enabling Processes.” ISACA, 2012. Web. Oct. 2016.

COBIT 2019. ISACA, Dec. 2018. Web.

Curtis, Blake. “The Value of IT Governance.” ISACA, 29 June 2020. Accessed 15 Nov. 2020.

De Smet, Aaron. “Three Keys to Faster, Better Decisions.” McKinsey & Company, 1 May 2019. Accessed 15 Nov. 2020.

“Decision Rules and Decision Analysis.” Navex Global, 2020. Web.

“Decisions Automation with Business Rules Management Solution.” Sumerge, 4 Feb. 2020. Accessed 15 Nov. 2020.

“DevGovOps – Key factors for IT governance for enterprises in a DevOps world.” Capgemini, 27 Sept. 2019. Web.

Eisenstein, Lena. “IT Governance Checklist.” BoardEffect, 19 Feb. 2020. Accessed 15 Nov. 2020.

“Establishing Effective IT and Data Governance.” Chartered Professional Accountants Canada, n.d. Accessed 15 Nov. 2020.

Gandzeichuk, Ilya. “Augmented Analytics: From Decision Support To Intelligent Decision-Making.” Forbes, 8 Jan. 2020. Accessed 15 Nov. 2020.

Georgescu, Vlad. “What Is IT Governance? Understanding From First Principles.” Plutora, 18 Oct. 2019. Web.

Goodwin, Bill. “IT Governance in the Era of Shadow IT.” ComputerWeekly, 5 Aug. 2014. Accessed 15 Nov. 2020.

“Governance of IT, OT and IOT.” ISACA Journal, 2019. Web.

Gritsenko, Daria, and Matthew Wood. “Algorithmic Governance: A Modes of Governance Approach.” Regulation & Governance, 10 Nov. 2020. Web.

Hansert, Philipp. “Adaptive IT Governance with Clausmark’s Bee4IT.” Bee360, 25 Oct. 2019. Accessed 15 Nov. 2020.

Havelock, Kylie. “What Does Good Product Governance Look Like?” Medium. 8 Jan. 2020. Web.

Haven, Dolf van der. “Governance of IT with ISO 38500 - A More Detailed View” LinkedIn article, 24 Oct. 2016. Accessed 15 Nov. 2020.

Hong, Sounman, and Sanghyun Lee. “Adaptive Governance and Decentralization: Evidence from Regulation of the Sharing Economy in Multi-Level Governance.” Government Information Quarterly, vol. 35, no. 2, April 2018, pp. 299–305. Web.

ISACA. “Monthly Seminar & Networking Dinner: CIO Dashboard.” Cvent, Feb. 2012. Accessed 15 Nov. 2020.

ISO/IEC 38500, ISO, 2018 and ongoing.

“IT Governance.” Kenway Consulting, n.d. Accessed 15 Nov. 2020.

“IT Governance in the Age of COVID 19.” Union of Arab Banks Webinar, 19-21 Oct. 2020. Accessed 15 Nov. 2020.

Jaffe, Dennis T. “Introducing the Seven Pillars of Governance.” Triple Pundit, 15 Nov. 2011. Accessed 15 Nov. 2020.

Janssen, Marijn, and Haiko van der Voort. “Agile and Adaptive Governance in Crisis Response: Lessons from the COVID-19 Pandemic.” International Journal of Information Management, vol. 55, December 2020. Web.

Jodya, Tiffany. “Automating Enterprise Governance within Delivery Pipelines.” Harness.io, 14 May 2020. Web.

Kumar, Sarvesh. “AI-Based Decision-Making Automation.” Singular Intelligence, 17 June 2019. Web.

“Lean IT Governance.” Disciplined Agile, n.d. Accessed 15 Nov. 2020.

Lerner, Mark. “Government Tech Projects Fail by Default. It Doesn’t Have to Be This Way.” Belfer Center for Science and International Affairs, 21 Oct. 2020. Accessed 15 Nov. 2020.

Levstek, Aleš, Tomaž Hovelja, and Andreja Pucihar. “IT Governance Mechanisms and Contingency Factors: Towards an Adaptive IT Governance Model.” Organizacija, vol. 51, no. 4, Nov. 2018. Web.

Maccani, Giovanni, et al. “An Emerging Typology of IT Governance Structural Mechanisms in Smart Cities.” Government Information Quarterly, vol. 37, no. 4, Oct. 2020. Web.

Magowan, Kirstie. “IT Governance vs IT Management: Mastering the Differences.” BMC Blogs, 18 May 2020. Accessed 15 Nov. 2020.

Mazmanian, Adam. “Is It Time to Rethink IT Governance? ” Washington Technology, 26 Oct. 2020. Accessed 15 Nov. 2020.

Mukherjee, Jayanto. “6 Components of an Automation (DevOps) Governance Model.” Sogeti, n.d. Accessed 15 Nov. 2020.

Ng, Cindy. “The Difference Between Data Governance and IT Governance.” Inside Out Security, updated 17 June 2020. Web.

Pearson, Garry. “Agile or Adaptive Governance Required?” Taking Care of the Present (blog), 30 Oct. 2020. Accessed 15 Nov. 2020.

Peregrine, Michael, et al. “The Long-Term Impact of the Pandemic on Corporate Governance.” Harvard Law School Forum on Corporate Governance, 16 July 2020. Web.

Raymond, Louis, et al. “Determinants and Outcomes of IT Governance in Manufacturing SMEs: A Strategic IT Management Perspective.” International Journal of Accounting Information Systems, vol. 35, December 2019. Web.

Rentrop, Christopher. “Adaptive IT Governance – Foundation of a Successful Digitalization.” Business IT Cooperation Coordination Controlling (blog). May 2, 2018. Web.

Schultz, Lisen, et al. “Adaptive Governance, Ecosystem Management, and Natural Capital.” Proceedings of the National Academy of Sciences, vol. 112, no. 24, 2015, pp. 7369–74. Web.

Selig, Gad J. Implementing IT Governance: A Practical Guide to Global Best Practices in IT Management. Van Haren Publishing, 2008. Accessed 15 Nov. 2020.

Sharma, Chiatan. “Rule Governance for Enterprise-Wide Adoption of Business Rules: Why Does a BRMS Implementation Need a Governance Framework?” Business Rules Journal, vol. 13, no. 4, April 2012. Accessed 15 Nov. 2020.

Smallwood, Robert. “Information Governance, IT Governance, Data Governance – What’s the Difference?” The Data Administration Newsletter, 3 June 2020. Accessed 15 Nov. 2020.

Snowden, Dave. "Cynefin – weaving sense-making into the fabric of our world", Cognitive Edge, 20 October 2020.

“The Place of IT Governance in the Enterprise Governance.” Institut de la Gouvernance des Systemes d’Information, 2005. Accessed 15 Nov. 2020.

Thomas, Mark. “Demystifying IT Governance Roles in a Dynamic Business Environment.” APMG International, 29 Oct. 2020. Webinar. Accessed 15 Nov. 2020.

“The Four Pillars of Governance Best Practice.” The Institute of Directors in New Zealand, 4 Nov. 2019. Web.

Wang, Cancan, Rony Medaglia, and Lei Zheng. “Towards a Typology of Adaptive Governance in the Digital Government Context: The Role of Decision-Making and Accountability.” Government Information Quarterly, vol. 35, no. 2, April 2018, pp. 306–22.

Westland, Jason. “IT Governance: Definitions, Frameworks and Planning.” ProjectManager.com, 17 Dec. 2019. Web.

Wilkin, Carla L., and Jon Riddett. “IT Governance Challenges in a Large Not-for-Profit Healthcare Organization: The Role of Intranets.” Electronic Commerce Research vol. 9, no. 4, 2009, pp. 351-74. Web.

Zalnieriute, Monika, et al. “The Rule of Law and Automation of Government Decision Making.” Modern Law Review, 25 Feb. 2019. Web.