An Overview of IT Governance

1. An Overview of IT Governance

2. … and CIO’s must balance among many competing priorities. • Maximize return: • Improve business results;grow revenue and earnings, cash flow, reducedcost-of-operation • Increase agility: • Enable the business organization and operations to adapt to changing business needs • Improve performance: • Improve business operations performance end-to-end across the enterprise • Increase customer and employee satisfaction • Mitigate risk: • Ensure security and continuity of internal business operations, while minimizing exposure to external risk factor

3. Alignment Flexibility Efficiency Quality Needs, Issues & Challenges Planning Capital, Capacity, Priorities Lack of Business aligned strategy Deployment Complexity in number of project Making new outsourcing decisions No means of capturing demands Management of Service Changes Cannot aggregate need and distribute ROI Deployment Complexity through lack of standard & legacy No means of prioritization of business need Lack of IT resource transparency Supply Demand IT and Business Resources Strategic Tactical Operations No means of reporting SLA Must reduce IT costs by 30% Ineffective project Management Reduce costs across business No Audit Trails Missed targets due to lack of steering control No means of governing outsourced contracts Control Procedure, Audits, Metrics

4. Vision,goals/priorities, measures; value prop & service portfolio;resource approaches & commitments;change managementplans Translation intoaligned, tactical, operationalplans; closed-loop monitoring & control;accountability; regulatory compliance Aligned/synchronized with the enterprise strategy, including other key asset strategies What is IT Governance? (Ref.)HP working definition Decision rights framework & mechanisms IT governance is the formal process of defining the strategy of the IT organization and overseeing its execution to achieve the goals of the enterprise.

5. Who are the Decision Makers? Non-Cooperative Cooperative Business Decision IT Decision Business and IT Collaboration Centralized IT Exec. Business Exec. Business and IT Exec. Federal Business and ITExec./Mgt. Business Exec./Mgt. IT Exec./Mgt. De-centralised IT Management Business and IT Mgt. Business Mgt. Anarchy

6. Core Competencies for Effective IT Governance • Balance the demand for IT services with available resources to meet immediate and strategic goals. • Align operational and strategic IT investments to business strategies & objectives. Supply / Demand Management • Establish effective, collaborative relationships with business stakeholders and suppliers. IT Strategy Management Relationship Management IT Operating Model • Understand the drivers of IT costs to allocate appropriate costs to the consumers of IT services. • Establish policies, standards, models and processes for managing IT as an enterprise asset Financial Management Enterprise ArchitectureManagement Portfolio Management • Lifecycle management of infrastructure, applications and services

7. The HP IT Governance Capability Model IT Governance Capability Model IT Governance Capability Model None None None None Utility Utility Utility Utility Dependent Dependent Agile Agile Role of IT Role of IT IT Governance IT Governance 1: Initial Level 1: Initial Level 2: Repeatable 2: Repeatable 3: Defined Level 3: Defined Level 4: Managed 4: Managed Level 5: Optimized 5: Optimized Capability Levels Capability Levels Balanced & Balanced & Enterprise Enterprise IT Strategy Ad Hoc or IT Ad Hoc or IT Supply Supply IT Strategy Aligned Adaptive Aligned Adaptive Deliver to Budget Deliver to Budget Demand Driven Demand Driven Management Centric Centric Constrained Constrained Management Enterprise Enterprise Ad Hoc Review of Ad Hoc Review of Enterprise IT Enterprise IT IT Cost IT Cost Business Unit Business Unit Emerging ROI Emerging ROI Portfolio Portfolio Portfolio Portfolio Portfolio Portfolio s s s s Minimization Minimization Aligned Aligned Based Funding Based Funding Management Management n n n n Synergies Synergies Management Management i i i i a a a a m m m m o o o o Initial Enterprise Initial Enterprise Ad hoc / Ineffective Ad hoc / Ineffective Architecture Architecture - - Business Strategy Business Strategy Enterprise Enterprise Enterprise Program Program - - based based Integrated Enterprise Integrated Enterprise Enterprise D D D D Ad hoc Technical Ad hoc Technical Architecture Architecture Business Strategy Business Strategy Agile Enterprise Agile Enterprise Architecture Architecture Enterprise Enterprise Compliant Compliant Aligned Aligned Architecture Architecture Architecture Architecture Architecture Architecture & Architecture & Architecture y y y y t t t t Architecture Architecture Driven Design Driven Design Linked Linked Architecture Architecture i i i i l l l l Management Management Management Management Management Business Planning Business Planning Program Program Architecture Architecture Design Design Architecture Architecture Management i i i i b b b b a a a a p p p p Optimized Optimized a a a a Financial Expense Driven, Expense Driven, IT Cost IT Cost Enterprise Cost Enterprise Cost C C C C Financial IT Cost Transfer IT Cost Transfer Business Value Business Value Management Budget Focused Budget Focused Minimization Minimization Management Management e e e e Management c c c c Impact Impact n n n n a a a a n n n n Balanced & Balanced & Balanced & Balanced & r r r r e e e e Technology Technology Technology Technology Supply Supply Supply Supply Supply / Demand v v v v Value Based Value Based Value Based Value Based Aligned Multi Aligned Multi Aligned Multi Aligned Multi - - - - Demand Driven Demand Driven Demand Driven Demand Driven o o o o Based Based Based Based Constrained Constrained Constrained Constrained Management Management G G G G Sourcing Sourcing Sourcing Sourcing T T T T I I I I Business Relationship Technology Technology Technology-Based Technology - based Relationship Service Centric Service Centric Business Centric Business Centric Customer Centric Customer Centric Management Centric Centric Services Services Management IT Operating IT Operating Business Process Business Process Business Process Business Process Internal Service Internal Service Internal Service Internal Service Silo Silo Silo Silo IT Process-Based IT Process IT Process IT Process - - - Based Based Based Shared Services Shared Services Shared Services Shared Services Model Model Based Based Based Based Provider Provider Provider Provider 21 October 2014 7

9. Val IT Cobit ITIL ISO PPM Methods … IT Governance Models - the 5 Characteristics • There are many models. • But they share 5 characteristics: • Underpinned by processes that must be implemented (e.g. Incident management) • Supported by technology • Define business change issues to be addressed • Define organisational realignment to be achieved • Include some way of measuring the value to be achieved (e.g. balanced scorecard) Corporate Governance IT Governance Framework Processes BTO portfolio Technology Business Change Org. Alignment & Competencies People Benefits Assurance Value 21 October 2014 9

10. Execute IT Governance Assessment • Execute assessment to identify gaps • Define new role of IT in organization • Define evolution roadmap to address the gaps Setup IT Governance Framework • Define roles and responsibilities • Setup communication path to support IT-business alignment • Define management structures for decision making, reporting and escalation • Define policies • Define processes • Define KPIs and reporting requirements Design IT Governance Processes Implement Supporting Tools • Implement tool to support the execution of the solution • Implement tools for data collection and management reporting • Identify indicators to monitor strategy execution • Define steering committee to manage relationships within IT and between business & IT • Review IT strategy periodically and evolve governance environment Continuous Improvement Plan (Control Lifecycle) How to Implement Governance 21 October 2014 10

11. Critical success factors for ITG • Clarity of Purpose • Senior Management Commitment • Management of Business Change • Focus, execute and enforce • Measure achievable targets and expectations • Don’t over-engineer IT Governance • Evolution not revolution

12. Practical Advice to Successfully Implementing ITIL Best Practices Ed Holub Research Vice President, IT Operations Management Gartner for IT Leaders

13. visibility IT Operations Management Hype Cycle ITIL 2005 ITIL 2012 ITIL 2006 ITIL 2010 ITIL 2008 Peak of Inflated Expectations Trough of Disillusionment Plateau of Productivity Technology Trigger Slope of Enlightenment time Hype Surrounding ITIL • ITIL makes the business love the IT group! • ITIL is easy! • Buy our tool and have ITIL! • Everybody is doing it … • What's next … • ITIL cures cancer! • ITIL solves world hunger!

14. Key Issues 1. What is ITIL and how can it serve as a guide to transforming operations? 2. What pitfalls should be avoided whenimplementing ITIL? 3. What are the critical success factors and practical methods to maximize return on investment?

15. Key Issues 1. What is ITIL and how can it serve as a guide to transforming operations? 2. What pitfalls should be avoided whenimplementing ITIL? 3. What are the critical success factors and practical methods to maximize return on investment?

16. CMM = capability maturity model CobiT = Control Objectives for Information and Related Technology ITIL = IT Infrastructure Library TCO = total cost of ownership IS0 20000 = IT service mgt standard ISO 9000 = quality mgt standard Specific TCO CMMI ITIL ISO 20000 CobiT ITRelevance People CMM Six Sigma Point solutions are useful, but a broader, holistic approach to process and quality improvement is POWERFUL. ISO 9000 National Awards(e.g., Baldrige) Scorecards Holistic Low Level of Abstraction High Positioning the Frameworks

17. Process Framework — ITIL • ITIL is a best-practice process framework. • Service delivery • Service support • Others (application management, security management) • Shows the goals, general activities, inputs and outputs of the various processes.

18. Service Delivery: Service-level management Financial management Capacity management IT service continuity Availability management Service Support: Incident management Problem management Change management Configuration management Release management Service Desk ITIL: The Good and the Bad Core Benefits: • Standard process language • Emphasis on process vs. technology • Process integration • Standardization enables cost and quality improvements • Focus on customer Limitations: • Not a process improvement methodology • Specifies "what" but not "how" • Doesn't cover all processes • Doesn't cover organization issues • Hype driving unrealistic expectations

19. Key Issues 1. What is ITIL and how can it serve as a guide to transforming operations? 2. What pitfalls should be avoided whenimplementing ITIL? 3. What are the critical success factors and practical methods to maximize return on investment?

20. Stakeholders • IT operations and production engineering • Architecture and standards • IT controller • IT service desk • Security and compliance • Business applications More Process Refinement Initiatives Fail Due to Ineffective Governance than Due to Bad Designs Steering Committee Responsibilities • Service management vision • Project management and process prioritization • Funding and infrastructure investment • Technical architecture • Standards, tools and vendor criteria • Measurement criteria • Reporting to management

21. Level 4 Value Level 3 • IT as strategic business partner • IT and business metric linkage • IT/business collaboration improves business process • Real-time infrastructure • Business planning Service Level 2 • IT as a service provider • Define services, classes, pricing • Understand costs • Guarantee SLAs • Measure & report service availability • Integrate processes • Capacity mgt Proactive Level 1 • Analyze trends • Set thresholds • Predict problems • Measure appli-cation availability • Automate • Mature problem, configuration, change, asset and performance mgt processes Reactive Level 0 • Fight fires • Inventory • Desktop SW distribution • Initiate problem mgt process • Alert and event mgt • Measure component availability (up/down) Chaotic • Ad hoc • Undocumented • Unpredictable • Multiple help desks • Minimal IToperations • User call notification Manage IT as a Business Service and Account Management Service Delivery Process Engineering Operational Process Engineering Tool Leverage Trying to Run Before Walking

22. Assuming Tools Will Solve Your Problems "Man is a tool-using animal. Nowhere do you find him without tools; without tools he is nothing, with tools he is all." –Thomas Carlyle • Be wary of vendor hype • Focus on process first • Tools can be enablers or inhibitors • Assess capabilities of yourcurrent tools • Review new tools where they would pay significant dividends • Buy what you need, as you need it

23. This Is Not the Goal! "Certification" ITIL Six Sigma Beware of Process for Its Own Sake! CMM-I Malcolm Baldrige Certification Does Not Guarantee Good Outcomes! Etc. Process Improvement Is About Better Outcomes and Experiences for Customers Confusing the 'Means' With the 'End'

24. Key Issues 1. What is ITIL and how can it serve as a guide to transforming operations? 2. What pitfalls should be avoided whenimplementing ITIL? 3. What are the critical success factors and practical methods to maximize return on investment?

25. Determine Where to Start • Not necessarily on the least mature processes • 80 percent of clients start on core service support processes like change, incident and problem management • Configuration management is a steeper challenge • Service-level management is often first of service delivery processes Deliver Benefits Quickly to Address "Pain Points" • Examples: Reduce percentage of changes causing incidents, improve MTTR • Builds momentum Take an Iterative Approach • Design 80 percent solutions and plan to improve later • Channel benefits to "self-fund" the next phase • Periodically reassess priorities Keep Focus Narrow and Deliver Benefits

26. Build Top-Down and Grass-Roots Support • CIO or Head of Infrastructure and Operations must be visible champion • ITIL is much more about people than technology • Change culture to embrace standardization vs. unique solutions • Don't ignore the aspects of people change and simply concentrate on process and tools Treat as an Organizational Change Initiative • Tailor messages for stakeholder groups • Reward process victories vs. traditional hero behavior Emphasize "WIIFM" Communicate Frequently and Consistently • Clearly articulate underlying goals and objectives • Report on progress – macro and micro

27. Structure Program What is the Governance Structure? What pain points are addressed? Measurement and Governance How will you know when you achieve the desired maturity? How will you market and communicate the program value and progress? Adopt Process Taxonomy Common and consistent language! Better alignment of expectations! Implement and Manage Implement the target state! Operate and manage new processes! Adopt Process Reference Architecture Define a conceptual, integrated target state! Clean-sheet design concept! Build Technical IntegrationFramework What standards and protocols should be used? How should new automation be assimilated? Develop Transition Approach and Plan How should the target state be implemented? Knowledge transfer and training! Develop Process Baseline(s) How do the current processes perform? Identify key gaps against best practice! Build Process Logical Architectures Define the target state detail for each process! Task-Level Process Detail Information Requirements Automation Detail = Reference Material = Detail Design = Implementation Take a Structured and Holistic Approachto Process Refinement

28. 1 2 3 • Comprehensive monitoring • Iteratively tune thresholds • Filter out noise • Train operations center staff • Automate on call staff notification Discover anomalies as soon as possible, preferably before customer impact Availability Management Smell the smoke • Perform parallel investigation • Designate senior technical leaders • Utilize problem isolation tools • Prioritize effort based on criticality Resolve incidents as quickly as possible Incident ManagementFirefighting • Dedicate staff to problem management • Conduct quick review on all problems • Perform in-depth postmortem on significant problems • Identify root cause risk areas • Identify action items and trackto completion • Maintain an Availability Hit List Problem Management Fireproofing Take action to prevent future problems Leverage Process Integration

29. Use Metrics to Drive Behavior andMeasure Progress • People inherently want to do a good job • What gets measured gets attention • What doesn't get measured drops off the radar • People will take action to move a metric in a positive direction • People will do "dumb" things • People will stop doing "smart" things • Focus on analysis and action vs. reporting • Select a few key metrics instead of many • Measure what will help you improve, not what's easy to measure • Create "tiers" of metrics tailored to different audiences

30. Effectively Staff Crucial Roles • Designate individuals as process owners • Assign (virtual) teams of subject matter experts • Utilize program or project managers • Desirable characteristics for team members –Credibility –Communication skills –Process and customer focus –Ability to deal with ambiguity –Commitment to the cause People will make or break your ITIL initiative

31. 4. Apply Governance CobiT 3. Identify Appropriate Measures Six σ 2. Align Roles With Work RACI IT Operational Processes — ITIL 1. Establish the Work App. Development Processes — CMM, CMMI, ASL Project Management Processes — PMI Comprehensive Approach to Improvement

32. Recommendations • Keep the scope narrow enough to deliver tangible benefits before losing momentum. • Demonstrate senior management commitment repeatedlyto inspire grass-roots support. • Remember that ITIL is an organizational change initiative. • Look for "best of fit" process modifications. • Tools are not a substitute for good process. • Set attainable process improvement measurement targets. • Maintain awareness that process improvement is ameans to an end.

33. Implementing ITSM at DTS • Our approach • Current efforts

34. Approach • Why we are embracing ITSM • Serve our customers more efficiently and effectively • Position DTS to take on new services • Prepare DTS to manage services across two data centers

35. Approach • Leverage experience/expertise of others • Change to an IT service culture • Internalize incremental changes

36. Approach • Build an ITSM foundation core • Tendency to look at a single ITIL process • Keep in mind the linkages between processes

37. Approach • Take actions to address specific organizational issues • Completed ITIL Foundations training • Began the “change the language” campaign • Established the Service Desk function • Developed first version of a service level agreement • Conducted assessments

38. Current Efforts • Defining Service Request Management process to replace our current SR system • Procuring consulting services • To support refinement of implementation roadmap • To raise the maturity of other processes

39. How is DTS Implementing ITSM? • With multiple projects following project management practices • With Executive sponsorship • With stakeholder involvement • With some communication and a lot more to come • With feedback and course adjustments