Strategy Development Problem Statement Understanding the Environment Mission

Strategy Development • Problem Statement • Understanding the Environment • Mission • Vision • Core Values • Develop an Operational Approach • Action Plans

Problem Statement • Commonwealth Office of Technology is a less than optimally functioning Information Technology organization

Understanding the Environment • • No Overall Enterprise Architecture No direct IT reporting relationships with the Cabinets No Authority over IT spending No prioritization (if everything is a priority, nothing is a priority) Minimal knowledge of Cabinet IT projects Aging IT infrastructure Fighting 25 meter target unable to look out to 300 meters

Commonwealth Office of Technology Our Mission To support agency partners in the fulfillment of their core mission by providing technology leadership, services, and solutions in a secure, transparent, and fiscally responsible manner. Our Vision The Commonwealth Office of Technology enables a proficient digital government supportive of a 21 st century economy by being a trusted and valued business partner with unyielding commitment to cost-effective service delivery.

Core Values • One IT Team in the Commonwealth – building a cohesive IT team embracing • • and driving change, enhancing communication, collaborating, and developing partnerships. Customer Service – empowering individuals and organizations to provide quality service in a fair and timely manner Being Constituent-focused – aligning information technology services to meet agencies’ business needs Professionalism – treating others with honesty, respect, integrity and fostering openness and trust Being Forward Thinking – embracing continuous improvement and adaptability

Strategic Plan: Four Primary Lines of Effort • • Security Enterprise Services Contract Administration Training/Education

Operational Approach Current Environmen t Security 1 2 3 4 5 6 Enterprise Services 1 2 3 4 5 6 Contract Administration 1 2 3 4 Training/Education 1 2 3 4 SUPPORTED OBJECTIVES 1 2 3 4 5 6 Securing the network Shared data environment Data Center restructuring Single Sign On/Identity Management Enterprise standards and services Oversight of IT acquisitions and projects A B C D 5 6 6 A B C 21 st Century Information Technology Environment D DESIRED CONDITIONS A monitored and secured computing environment capable of risk detection, response, and mitigation State-of-the Market services provided to agencies A task deliverable contracting environment with approach monitoring and follow-up Planned workforce training and education for completion of daily tasks and investment in our future IT staff

Documents Driving Change

Staffing Changes • Contracting Officer (CO) - works hand in hand with Finance • Chief Compliance Officer (CCO)- offloads tasks from our Chief Information Security Officer (CISO) – focus on compliance and policy • Enterprise Project Management Officer (EPMO)- consolidated all project managers • Chief Data Officer (CDO) – all data initiatives • Digital Transformation Office – stood up and actively working three projects • Kentucky Business One Stop - Executive Director hired

IT Fiduciary Responsibility In the last twelve months Paid-down Debt by …. Made a General Fund xfer of Capital Account xfer of $ 12. 0 M $ 10. 8 M $ 4. 0 M $ 26. 8 M Debt History November 2017 Chase Debt balance November 2018 Chase Debt balance Chase Debt paid down by …. $17, 900, 000 $5, 922, 000 $11, 978, 000 Current (Nov 2018) monthly debt payment is installments of $674 K Avoiding future debt: Leveraging capital to finally "operationalize" desktop hardware refreshes $6, 000 Enacted Budget transfers to the General Fund FY 17 FY 18 $8, 000 $10, 800, 000 $18, 800, 000 This fiscal responsibility and progress is made possible by the authority levied in HB 244. The authority has empowered enterprise-wide IT leadership, with the result effecting debt service, enterprise initiatives and net savings across the Exec Branch

Cost Saving Initiatives • Implementing converged infrastructure for servers and storage (VBlock) • Implemented enterprise monitoring & management tools (Dynatrace) • Managed Router Service (MRS) with AT&T reduces cost and better service (KIH 3 contract) • Reduced annual cost by $600 K by eliminating Service. Link (datacom) • Refreshed and Upgraded the central datacommunications core ("a heart transplant") • Centralizing and standardizing Video Conferencing • Standardizing Document Management approaches and software (On. Base) • Upgrading the Geographic Information System (GIS) capabilities with leaf-off photogs • Implementing the Citrix environment to facilitate application modernization • Eliminated bloated or underused consulting agreements (i. e. Gartner) • Mainframe to the Cloud (Boulder, CO)

Next 12 Months • Windows 10 upgrade - current Operating System not supported after January 2020, 33, 000 devices - Apprenticeships (2) helping rebuild Computers • Integrated Enterprise service desk (trouble ticketing) - currently 9 different trouble ticket systems in the Commonwealth • Decision on Enterprise email and desktop applications (Microsoft/Google Discussion) • Enterprise Resource Planning (ERP) system decision (two completely different CGI and SAP)

Questions

BACKUP

Security • To protect the confidentiality, integrity, and availability of state data and networks against an ever-growing number of cybersecurity threats, the Commonwealth adopted the National Institute of Standards and Technology (NIST) 800 -53 Security and Risk Management Framework in 2015. That framework and the twenty-three control families provide the Commonwealth the means of meeting the regulatory compliance requirements governing the data leveraged within the Commonwealth. • The Chief Information Security Officer’s Office spearheads the implementation of the NIST control families across the executive branch, and in doing so, works closely with cabinet IT leads developing integrated approaches that appropriately balance security-related IT investments and risks. Every IT organization within the executive branch agencies, including state employees and contractors, will be cognizant of and share responsibility for protection of the Commonwealth’s data and network resources. For that reason, every COT objective and project has critical security-related elements. • Desired Condition: A monitored and secured computing environment capable of risk detection, response, and mitigation

Enterprise Services • A Governor’s Executive Order in 2012 (Ord. No. 2012 -0880) consolidated all executive branch IT infrastructure responsibilities to the Commonwealth Office of Technology. This moved the bulk of agency servers to the Commonwealth Data Center and all infrastructure staff to COT. Consolidation established true enterprise infrastructure services for the first time, but allowed expenditures and priorities to remain in the agencies. Agency priorities and expenditures were neither visible to COT nor consistent with an enterprise approach. • Accordingly, Executive Order No. 2017 -0889 issued on 13 December 2017, establishes a single CIO for the Commonwealth and co-reporting responsibilities to agency IT leads in each Cabinet. Agency IT leads will continue to support the needs of their agencies but also be responsible to the CIO for compliance with the enterprise architecture and the funding model. The outcome of this EO, which is currently being codified in HB 244, will be accurate knowledge and approval of aggregate IT spending in the executive branch. The EO also facilitates the integration of knowledge concerning agency needs and current capabilities and redundancies. • HB 244 will ultimately create a collaborative IT environment to promote shared enterprise solutions wherever practicable, drive down costs, and spur process and service modernization. • Desired Condition: State-of-the-Market services provided to agencies either directly or through sourced solutions

Contract Administration • Kentucky state government is facing the largest financial challenge since the 2008 recession. Critical to the Commonwealth’s fiscal responsibility is the proper management of all IT projects and expenditures to maximize return on investment and improve service delivery. • COT will implement a process modeled by the Federal Government, contained within the Federal Acquisition Regulation (FAR) establishing a Quality Assurance Surveillance Plan (QASP) for monitoring and managing vendor performance and ensuring such performance complies with contractual requirements. COT will establish a task-based contracting approach, ensuring each contract has a deliverable component. These guiding principles provide an acquisition system allowing COT to conduct business with integrity, fairness, and transparency. • Desired Condition: A task-deliverable contracting approach with monitoring, follow-up, and a clearly defined end-state

Training/Education • The Commonwealth faces challenges recruiting and retaining skilled IT staff. COT will emphasize workforce planning to provide staff the skills needed to elevate performance and improve morale. COT, in cooperation with agency IT staff, will assess and coordinate end-user education and training needs. As enterprise services evolve, targeted education and training with measured and delivered outcomes will be the focus. • Desired Condition: Planned workforce training and education for completion of daily tasks and investments in our future IT staff

Action Plans 1 2 3 4 5 6 Supported Objectives 1, 2, 5 4 5 5 5 1 3, 5 Supported Objectives Securing the network Shared data environment Data Center restructuring Single Sign On/Identity Management Enterprise standards and services Oversight of IT acquisitions and projects Action Plans Modernize Integrated Tax System (ITS) Promote Kentucky Online Gateway (KOG) to enterprise service Implement Kentucky Business One-Stop (KBOS) phase III Establish HEAT as enterprise solution for L 1 support Provide enterprise license management solution in HEAT or as standalone solution Implement Network Access Control (NAC) Consolidation/integration of KSP, DOCJT, DJJ, Fair Board Upgrade Windows 7 devices to Windows 10 to meet Jan. 1 sunset date Office OIAG OIAG OISD