Quarterly Enterprise Collaboration Meeting February 4 2016 11

Quarterly Enterprise Collaboration Meeting February 4, 2016 11: 00 a-12: 00 p

Agenda 1. Change Management v 2. 0 Implementation Timeline – John Moquin on behalf of Maury Collins 2. Microsoft Office 365 Deployment Status Update – Brian Kilduff 3. Enterprise Mobility Management Overview – Michael Lee & Brent Richter 4. Assembly Row Network Segmentation – Michael Healy & Timothy White 5. Epic 2015 Infrastructure Update – Herbert Harrison 2

Enterprise IS Change Management QA Pilot 2/12/16 – 2/26/16 Reference Guide & Videos 3/8/16 Training Webinars 2/24/16 - 3/11/16 Drop in Sessions 3/16/16 - 3/17/16 Go Live 3/15/16 Training Webinars Schedule Note: No signup, mark your calendar and click below https: //phsenterprise. webex. com/meet/changemanagementpartners. org February March Wednesday 2/24 @ 12 -1 pm 3/2 @ 12 -1 pm 3/9 @ 12 -1 pm Friday 2/26 @ 10 -11 am 3/4 @ 1 -2 pm 3/11 @ 10 -11 am

Microsoft Office 365 Pro. Plus, Exchange Online status Brian Kilduff

Outline • Summary • Deployment Goals • Pro Plus Deployment Status and Timeline • Exchange Online 5

Summary Current Status • Office Pro Plus 2013, ready for deployment – only limited by application compatibility – We are preparing Pro Plus 2016 starting late Q 1 of this calendar year • Skype for Business is part of Office deployment and can be used to host web conferencing • One. Drive for Business part of Office deployment – awaiting results of personal storage recommendation • Exchange Online – currently in testing with some decisions to be reviewed at Tech Leaders at end of February • Share. Point Online – in use, accepting new sites, still planning moves from onpremises Share. Point 2010 6

Deployment Goals • Deployment wave occurs once per week to allow for assessment and remediation • Currently deploying to between 75 to 150 per wave • Goal is to reach between 600 and 1000 machines per week successfully • This number is greatly influenced by success in reaching machine on network and remediation 7

Pro Plus Deployment Status and Timeline 8

Exchange Online • Current Status – Current Pilot includes 5 mailboxes » Mainly test mailboxes » 2 production mailboxes ( 1 member of Exchange team, 1 consultant) • What we are testing – Galen/PAS interaction – Access to on premises Public Folders from Cloud accounts – Free/Busy Calendar functionality between on premises and cloud accounts • Next Steps – Increase Pilot to between 7 and 10 users – Begin end user delegate mapping in preparation for migration 9

Microsoft Office 365 Questions? 10

Enterprise Mobility Management Goals, Status Update, Implementation Roadmap Michael Lee & Brent Richter

What is Enterprise Mobility Management “Enterprise Mobility Management (EMM) suites consist of policy and configuration management tools and a management overlay for applications and content intended for mobile devices based on smartphone OSs. They are an evolution from previousgeneration mobile device management (MDM) products that lacked application and content management. ” - Gartner Key Differentiators of EMM solutions Application Management Reduces risk of data loss through use of managed silos Secure browsing to internal Partners websites Access Management Restrict access to certain apps only through apps distributed and managed by the EMM Solutions Ability to perform and “Enterprise Wipe” of the managed applications and content contained within those apps 12

Enterprise Mobility Management: Initial Rollout Goals • Epic Haiku/Canto. Group 2 enrollment and Group 1 re-enrollment and migration of Haiku configuration URL to only MDM-enrolled devices. • “Active. Sync 2. 0”. Define and execute implementation plan to migrate all 34, 000+ devices directly connected to Active. Sync onto the Mobile. Iron platform which ensure all devices accessing Partners email is managed • Training of Service Desk and Field Technicians that will be tasked with handling the 1˚ and 2˚ level support for end users. Local support of mobile devices will be critical to the success of any mobility strategy put forth by Partners IS. Where necessary, increase resources to balance additional workload • Air. Watch Retirement. Migrate and retire all 880+ Air. Watch enrolled devices, thereby saving the institution resources (licensing costs, upgrade costs and staffing support) 13

Epic Haiku/Canto Rollout (5, 000 – 10, 000 Devices) What Haiku/Canto Description Require management for all Rover and Canto connected devices. Current configuration URL is hidden behind an intranet website and setup with the aid of e. Care staff. EMM would allows for managed devices to securely access configuration URL while off network, potentially simplifying enrollment while providing PHS with better inventory and configuration management. EMM Management would also fulfill the recommendation by Info. Sec for Haiku/Canto security Implementation Timeline Short (1 -3 months) Business Criticality 24 x 7 x 365 Resource Requirements EMM Staff to administer the cloud tenant and sentry appliances Align Staffing with Gartner Recommended (e. g. Pfizer has 3 person team supporting 35 K Mobile Devices) TSO Support for on premise VM and Load balancers Service Desk for EMM and Haiku Enrollment and troubleshooting Web Team to modify current or establish new enrollment URL e. Care signoff and training/enrollment support Requires change of process e. Care uses to provision devices Requires blocking of existing enrollment methods in favor of new Communication of changes to new/existing users (and why) Unknown how PHS could target existing Haiku users to enroll in EMM Risks/Roadblocks

Active. Sync Device Management (30, 000 - 35, 000 Devices) What Description Active. Sync Require management for any device accessing PHS Active. Sync environment. Instead of configuring a device to access outlook. partners. org, Active. Sync would be provisioned only for devices enrolled into EMM. PHS would gain more granular control over device wiping (e. g. wipe only the corporate mail on a lost device) as well as gaining both inventory and configuration management capabilities. Depending upon the deployment method, email configuration settings could be auto-provisioned to end user devices. Once enrolled, PHS could also offer users the ability to access Sharepoint, SFAs, Internal website, etc via secured and containerized apps (e. g. Web@Work, Docs@Work, etc). Implementation Timeline Long (6 -12 months) Business Criticality 24 x 7 x 365 Resource Requirements Increase Staffing to Gartner Recommended Levels (e. g. Pfizer uses team of 3 dedicated to supporting 35 K Mobile) EMM Staff to administer the cloud tenant and sentry appliances TSO Support for on premise VM and Load balancers Service Desk for EMM and Active. Sync Enrollment and troubleshooting Desktop Technician Support for EMM and EAS Enrollment / troubleshooting EMM Staff for Kiosk or Brownbag Q/A sessions to aid in the transition Requires manual re-enrollment of devices currently connected to Active. Sync Requires blocking of existing enrollment methods Large change to the way uses conduct business today Requiring EMM could result in backlash from user community Communicating changes to new / existing users (and why) Risks/Roadblocks

Support Responsibilities Follows existing Support workflows Initial calls routed through Service Desk Application Owner responsible managing Service. NOW queue Escalation to appropriate business units as necessary Use Cases Active. Sync Application Support: Service Desk, EMM Mobile Admins Infrastructure Support: Mobile. Iron, EMM Mobile Engineers, PHS IS Training: EMM Mobile Teams, ISS training teams Epic Haiku Application Support: Service Desk, Partners e. Care Infrastructure Support: App Development / WWW Development, EMM Mobile Engineers Training: EMM Mobile Teams, Partners e. Care

COE / CTM Interactions

Enterprise Mobility Management: Status • • • RFP: Complete June 2015 Initial EMM Pilot: Complete October 2015 Mobile. Iron Contract Negotiations & BAA: Complete November 2015 Contract Signing and PO: Complete December 2015 Cloud Infrastructure: Complete September 2015 On Premise Infrastructure: Ongoing (9/15 start) – 9 VMs Requested and Provisioned (6 Marlboro / 3 Needham) » Mobile. Iron Professional Services to complete configuration December 2015 Ongoing (1/16 start) – Load Balancing / SSL Certificates Ongoing (1/16 start) – Firewall Exceptions: Complete January 2016 • Documentation and Training Ongoing (11/15 start) – IS Training actively engaged for Active. Sync via Mobile. Iron – e. Care mobile teams engaged for Haiku via Mobile. Iron • Communications / OCM Plan Ongoing (11/15 start) – Pilot Active. Sync for CTM, IS Operations, Info. Sec February 2016 – Active. Sync via Mobile. Iron (October 1, 2016) July 2016

Implementation Roadmap § § 1 April 2016 – All new devices use Mobile. Iron to access email, Partners intranet and app store 1 October 2016 - Active Sync for email is no longer available Production Instance Partners Infrastructure Mobile. Iron Installation Started on 8 Sept Epic Readiness Remove Active Sync Process Remove Active Sync Script Support Documentation Validation Update for Active Sync removal MGH EPIC Group 2 - 2, 500 Mass Eye and Ear BWH - 1, 800 Epic Rover Non-Epic Readiness OCM non-Epic Remove Active Sync Process Remove Active Sync Script Support Documentation Validation Create Plan Implement OCM PLAN NEO PROMS KT Staffing Update for Active Sync removal Secure SMS PROMS Partners IS Ramp Pilot PROMS Partners IS Tech Summit Legacy Airwatch Mobile. Iron Support Service Desk & Tech Training Mobile System Engineer Mobile Device Team Member 1 1 Technology Status Active Sync Active. Sync 2. 0 / Mobile. Iron 2 Standard Supported Standard Today 11/2 11/16 11/30 12/14 12/28 1/11 Other Partners Team Activity Mobile Device v. Team Activity Vendor Activity Time 1/25 2/8 2/22 3/7 Critical Path 3/21 4/4 4/18 5/2 5/16 5/30 6/13 6/27 7/11 7/25 8/8 8/22 9/5 9/19 10/3 10/17

Enterprise Mobility Management Questions? 20

Network Segmentation Assembly Row Michael Healy & Timothy White

Network Segmentation Project - Assembly Row Background: Leverage the greenfield installation at AR to implement Network Segmentation and support the PHS Lighthouse security program Network Segmentation = Devices connecting to the network will be inspected for compliance. If missing a compliance check, devices will be moved to a “non compliant” network zone (as one example). Other network zones will exist – “Corporate (Trusted), Quarantine (Untrusted), and Guest. 23

Network Segmentation – Assembly Row

Network Segmentation – Assembly Row NAC Rule Sets - What compliance checks are we looking for? • MS Patching • Encryption • Anti Virus • MAC PEAS Enrollment

Network Segmentation – Assembly Row Support & Support Processes Seeking current support processes (documented) for the following use cases. 1. MS Patching 2. Encryption 3. AV Updates 4. MAC PEAS Enrollment If under our current support models an issue with a user device is present how is it handled from a support perspective? “What’s the end-user experience”? Examples: If my device is missing an MS Patch what does the end user experience look like from a documented perspective? What’s step 1? What’s step 2?

Network Segmentation – Assembly Row Questions

Epic 2015 Upgrade Herbert Harrison

Outline • Overview • Infrastructure Build-out and Upgrade • Epic Environment Upgrades • Timeline 29

Epic 2015 Upgrade • 20% computing resource utilization increase across board • Upgrading to Caché 2015 is a prerequisite. • Citrix hardware needs to be replaced with v. Block, Citrix to be upgraded to 7. 6 • Windows Servers upgrade to Window 2012 30

Prod Environment Topology 31

A Typical Non-Prod Environment Topology

Infrastructure Requirements Cache Servers • 2 new IBM Power 8 servers will be built in each data center by Jan 13 and Rollout to Production ECP tier completed by Feb 5 • Upgrade environments to Caché 2015, concurrently with the deployment of SU 9 downtime, starting the first non-prod environment on Jan 5, and finish with production environments on Feb 22, 2016. • Epic 2015 upgrade approach: in place upgrade.

Infrastructure Requirements • VCE Vblock – Vblock System 340 with VNX 5800 – Each has 82 blades, 23. 7 TB, and supports 30, 000 Citrix Hyperspace sessions – 1 for each datacenter – This will house servers for » Citrix VMs – Production Hyperspace – Non-Production Hyperspace – Dev/Perf Hyperspace » Epic Client Systems VMs (Prod and Non-Prod) – Web. Blob – Interconnect – BCA Web – Relay – Epic Print Services (EPS) • Epic 2015 upgrade approach: • Build in parallel, switch during the upgrade event. 34

Infrastructure Requirements • 34 non-prod and 122 prod for Web Tier components – Hyperspace Web – Care Everywhere – SOAP Proxies – Store and Forward Director – My. Chart – Epic Care. Link – Haiku – Rover – Kuiper • Epic 2015 upgrade approach: – Mostly build in parallel, switch during the upgrade event. – Some in place upgrade during the downtime. 35

Pe. C Environments 36

Creating A New Epic Environment • A new environment, e 15, scheduled for deployment Tue, Dec 15, 2015 – Assess build remediation effort. – Assess 2015 end user impact, training needs – Review 2015 functions and develop an adoption 37

Epic 2015 Upgrade • Epic 2015 IU 2 was released Nov 23, 2015. • Production implementation target is Oct 22, 2016. • Key upgrade dates: – POC: – TST: 19 – Production Environments PRD, RPT, SUP, DR: Thu, Apr 28 Thu, May Sat, Oct 22 38

Epic 2015 Upgrade 39

Epic 2015 Infrastructure Update Questions? Thank you! Next Meeting: May 5 th 11: 00 a-12: 00 p 40