IT Governance Boring Name BIG IMPACT About the

IT Governance Boring Name BIG IMPACT

About the Presenter Matthew Eshleman Chief Technology Officer Community IT meshleman@communityit. com 202 -449 -6711 @meshleman @community. IT

This Session Twitter: #13 NTCITgov Eval: www. nten. org/ntc/eval

Agenda IT Governance… 1. 2. 3. 4. 5. What is it? Why do you need it? Who should be involved? Why should you care? How do you get there?

What is it? C IT B O M P K BO ISO-9000 ITI L v ITGI 3 6 1 E A SS photo: Wikimedia Commons

What is it? The leadership and organizational structures and processes that ensure that the organization’s IT sustains and extends the organization’s strategies and objectives. ITGI, 2006

What is it really? The essential organizational structures and processes that ensure that the organization’s IT sustains and extends the organization’s strategies and mission. revised ITGI, 2012

Why do you need it? Without good governance, IT cannot support the MISSION

Why do you need it? source: COBIT 5

Why do you need it? • Information is critical to mission • Information is an asset • Technology is a significant investment • IT is complex

source: COBIT 5

IT Governance essentials… 1. Leadership 2. Organizational Structures 3. Processes

Exec Tier 1 VP Tier 2 Tier 3 Ops VP Ops

Changing role of IT • Recognize consumerization of IT • Recognize changing organization culture • Enable effective use of technology

COBIT Focus Areas source: COBIT 4. 1 Executive Summary

COBIT Focus Areas 1. 2. 3. 4. Strategic Alignment Value Delivery Risk Management Resource Management 5. Performance Measurement source: COBIT 4. 1 Executive Summary

Maturity is a journey “optimized” “managed” “defined” “ad-hoc” “none”

Strategic Alignment Business Goals Requirements Information IT Goals IT Processes source: COBIT 4. 1 Executive Summary

Strategic Alignment Mission Requirements Information IT Goals IT Processes source: COBIT 4. 1 Executive Summary

Requirements • • • Business Continuity Reporting Compliance Automation/efficiency Mobile Access Ongoing Support • Culture • Cost

Information • • Outcome measurements Performance Metrics Messaging systems Website Files Databases Internet Access

Strategic Alignment is a dialogue Mission Requirements Information IT Goals IT Processes

…throughout the organization IT Goals IT Process

IT Governance can’t be outsourced

Strategic Alignment 1. Leadership willing and able to have dialogue 2. Organizational Structures that enable the conversation IT Director/CIO that owns it Reporting to the ED/CEO 3. Processes that support it

Dialogue around… source: COBIT 4. 1 Executive Summary

Key Decisions 1. What resources are required? 2. What risks are tolerable? 3. What measurements are needed? source: COBIT 4. 1 Executive Summary

Org Strategy Org Goals for IT IT Goals Enterprise Architecture for IT IT Scorecard

Required Resources 1. 2. 3. 4. 5. Specific systems Support staff Training Platform Infrastructure source: COBIT 4. 1 Executive Summary

Risk Tolerance 1. 2. 3. 4. 5. 6. 7. 8. 9. Business Continuity Disaster Recovery RPO RTO Cyber Crime Malware / Virus Spam Copyright infringement Data loss

INFORMATION SYSTEM SPRAWL

Simple Risk Matrix RTO RPO Retention Reports Cost Tape Backup 1 -2 weeks 1 -7 days 6 months Custom $10, 000 Availability Hosted 1 hr n/a 15 min 3 months Custom $20, 000 1 day 3 weeks Limited $15, 000

Simple Risk Matrix Tape Backup Down for… 1 -2 weeks Lost data… 1 -7 days Retention 6 months Reports Custom Cost $10, 000 Availability Hosted 1 hr n/a 15 min 3 months Custom $20, 000 1 day 3 weeks Limited $15, 000

Measurements Needed 1. 2. 3. 4. 5. Reporting requirements Compliance requirements Management Performance metrics Project status

Accountability source: COBIT 4. 1 Executive Summary

Accountability 1. How will leadership know if IT is delivering value? a) Metrics? b) Reports? 2. Is responsibility clearly defined? a) SLA b) Policy

Accountability Our Rhythm – Annual Assessment & Planning • Big picture • Align IT initiatives with Org Goals – Quarterly Reviews • Compare progress to goals • What’s changed – Monthly Check-ins • Metric reviews • Plan for what’s upcoming

Value Delivery 1. Leadership exercising oversight 2. Organizational Structures that enable accountability 3. Processes that deliver value

In closing… 1. Start with Strategic Alignment 2. Create Dialogue around… a) Resource Management b) Risk Management c) Performance Measurement 3. Identify Value Delivery through a) Accountability b) Regular reports

Discussion

Resources • • • www. isaca. org www. itgi. org www. community. IT. com meshleman@community. IT. com @meshleman

Reference Links • http: //www. isaca. org/Knowledge. Center/Research/Documents/Measurand. D emo. Valueof. IT. pdf • http: //www. itgi. org/