Organizational Readiness & Strategies

Organizational Readiness& StrategiesCSG Spring Meeting 2012Bob Carozzoni (Cornell)Bill Wrobleski (Michigan)Erik Lundberg (Washington)

TheCampusthinks Cloud...Brings businessbenefit.Brings new featuresfaster.Is DIY.Makes Central ITirrelevant.TheAdministrationthinks Cloud...Reduces costs.Brings savings faster.Is risky.Makes Central ITirrelevant.

Central IT needs a cloud sourcingstrategy to do it all• Accelerate change AND manage risk.• Increase business value AND lower ITcost.• Simultaneously engage the institutionin a variety of cloud sourcing roles:catalyst, leader, enabler, partner, coach,protector.

GAIN Working Paper Series no. 3AcknowledgementsThe authors would like to sincerely thank other members of the Sub-group for theirvaluable review and comments on drafts of the Working Paper which helped tostrengthen the final document. We would especially like to acknowledge Ellen Sokol(GAIN Consultant) who provided valuable technical input into the first drafts early inthe process. Editing and layout expertise was provided by GAIN staff membersChristophe Lecureuil, Karie Atkinson, Denis Kayiwa, and Marina Monzeglio. Lastly,we appreciate the support received from the Global Alliance for Improved Nutrition(GAIN) that allowed us to proceed with this work and make it available for thebenefit of all of those working to improve infant and young child nutrition.Members of the Sub-group include:Victoria Quinn (Chair), Helen Keller International, Washington D.C.David Clark, United Nations Children’s Fund, New YorkHilary Creed-Kanashiro, Instituto de Investigación Nutricional, Lima, PeruAgnes Guyon, John Snow Incorporated, Washington D.C.Edith Heines, World Food Programme, RomeSandra Huffman, Senior Technical Advisor, Global Alliance for Improved Nutrition,Shanghai, ChinaKatharine Kreis, The Bill & Melinda Gates Foundation, SeattleNune Mangasaryan, United Nations Children’s Fund, New YorkDominic Schofield, Global Alliance for Improved Nutrition, GenevaTina van den Briel, World Food Programme, RomeElizabeth Zehner, Consultant, ScotlandThe opinions expressed herein are those of the authors and neither necessarilyreflect the views of the officers and/or staff of the contributors’ organizations nor theviews of other members of the Sub-group and/or their organizations.ii

Changing IT Skills for SuccessOld Worldbuildingdeveloping/deployingsoftware designtechnology supportNew Worldsourcingintegratingenterprise architecturevendor management

What's your cloud maturity?OrganizationalAd hoc RepeatableContractsProcurementService MgmtProvisioningIAMAd hoc RepeatableTechnical

Types of Cloud ComputingEngagements ... Who

3 Categories of Cloud EngagementsIndividualTeamEnterprise"I think I'd like tosign up forDropBox.""We should useSalesForce inour unit.""We should moveUniversity email toGoogle."

What help do each of thesegroups need?

IndividualHelp me...Keep my information secure and private.Understand any risks that I'm taking.Know what other people on campus are using(and what tools are already available to me).Get others to use the same tools I do.Connect my tools to University systems.

TeamsHelp us...Find out what others are using.Find others who may want the same service.Acquire the service and sign a contract.Integrate services with University infrastructure.Keep our data secure and private.

EnterpriseHelp us...Accelerate acquisition and negotiation.By providing guidelines, templates and short cuts.Integrate services with University Infrastructure.Keep University data secure and private.

What capabilities could weprovide to meet these needs?

Basic Capabilities?Capabilities to help with cloud adoption whichrequire relatively low levels of investment...Contract TemplatesStandardsPoliciesDocumentationAuthentication IntegrationMore...

Advanced Capabilities?ConsultingContract ManagementDemand AggregationCatalog IntegrationSecurity ReviewsUser EducationTechnical IntegrationsOthers?Would any of these capabilities acceleratecloud adoption on your campus?

Types of Cloud ComputingEngagements... How?

Be explicit about the role you play ineach cloud engagementAdvisorBrokerReseller(VAR)Be a coach to unitsentering into theirown contract with acloud vendorCentral IT managescontract & vendorrelationship.Consumer directlyengages withvendor for serviceCentral IT ownsand managesservice (obscurecloud's role inservice delivery)

Challenges

Challenges of Change...• Difficult for people with operationalresponsibilities to totally step back andadopt the new paradigm.• Managing risk (procurement, audit, legal)is taking a lot of time and resources.• Changing core business processes (e.g.procurement) can be difficult.

Challenges of Change...• Before outsourcing, consider whether weeven need a service, or need it to changeradically.• Bad business process doesn't lend itself togood outsourcing

What are our organizationsdoing to try to address thesechallenges?

Outsourced Servicesand Cloud Initiative●●●Purposeful disruption ofstatus quo provisioningOpportunistically acceleratecloud adoptionDrive value up, cost down●Facilitate/coordinate effortsof key stakeholders:○ IT Governance○ IT Management○ Purchasing○ Legal○ Audit○ Risk Management○ Security○ IT Service Management○ Enterprise Architecture○ Vendor Management

Cloud Strategy focused on"Cloud First" with 3 workstreams...1Build-out reliable on-premise cloud services.2Adopt public cloud services opportunistically.●Google, Box, Concur, Amazon, more...3Establish organizational capabilities●●Cloud Sourcing Manager Role Posted (link here)Cross-campus work team in placewill define "to be" capabilities by August 2012

Cloud ComputingCoordinating CommitteeKey Risk & ProcessStakeholdersRisk ManagementCISOLegalPurchasingBusiness Stakeholders& Data OwnersRegistrarUW ITData Mgmt CmteeService Owners/Managers

I2 NET+ Cloud Sourcing Working GroupGoals:●●●Cloud Advocacy and ManagementNet+ Services - inform and support development of Internet2 NET+servicesGeneral cloud advice - collective wisdomProgress to date:●●●●CharterSurveyEmail to CIOs to appoint one rep. from their institutionWorking on social media tool for working groups to self-organize and actindependently (but transparently)Contacts:●●Your CIO or the person they appointedKhalil Yazdi

Questions?More Discussion?

Extra Slides

What's the problem?Ask:LegalProcurementSecurityCentral ITUsersYou'll Hear...Need to limit risk.Need to make the best deal.Need to make it secure/compliant.Need to integrate with IAM.Need to have an exit strategy.Need defined service levels.Needs to support my work.Needs to be in place, now.

Cloud Maturity Model?Level 1:UnawareLevel 2:OpportunisticLevel 3:OrganizedLevel 4:EnterpriseLevel 5:TransformativeNo StrategyNoCoordinationEveryone forthemselvesSome campusopportunitiesidentifiedBeginning toframe campusstrategyStrategyarticulatedStandards andpoliciesestablishedCoordination &aggregationStrategyimplementationTechnicalintegrationcapabilitiesBrokeringcapabilitiesConsulting &supportservicesBroadunderstanding ofmodelProactive markettrackingEffective topdown and bottomup engagements"Cloud First"approach broadlysupportedAdapted from Gartner Group generic maturity model but content developed independently

Alternative Environments/ Approaches1CurrentEnvironment2Adopt “Use”Policy3NegotiateContractIndividuals use cloudservices as they wishNo policy, training orcontract termsInform individualsabout appropriateuseNo contract in placeMutually acceptableterms to address riskissuesAlong with policy

Risk AssessmentLIKELIHOOD x IMPACT= RISK RATING

Risk Rating ScaleHighest LikelihoodHighest ImpactLowest LikelihoodLowest ImpactLegendExtremeHighSubstantialMediumLowMeaningSignificant capability loss and the achievementof objectives is unlikelySignificantly degrades the achievement ofobjectives or capabilityWill degrade the achievement of objectives orcapabilityMay degrade achievement of some objectivesor capabilityLittle or no impact on the achievement ofobjectives or capability

Risk Ratingsof Alternative Environments1CurrentEnvironment2Adopt “Use”Policy3NegotiateContractFail to meet data mgtrequirementsmedium low lowFail to demonstratedue carehighsubstantiallowLose data integrity,accessmediumlowlowUnnecessary breachnoticelowlowextremeData theft,unauthorized expensesubstantialmediummedium

KEY PRINCIPLESfor Cloud Computing ContractsSecurityIndustry standards; security audits; responsible for breachesIndemnificationMutual for negligent acts; no indemnity for end usersLimits of LiabilityPrefer no limit on vendor’s liability unless loss caused by UWFERPAVendor is “school official” and accepts certain dutiesData OwnershipUniversity owns data stored on vendor’s systems