Forrester Research

Five steps to transforming the IT department

2009-10-16T11:50:25+01:00

Transforming an IT organisation typically requires dramatic changes to processes, structure, governance, and culture. To determine how best to do this, Forrester reviewed the results of several transformation projects and the methodologies of a number of consulting firms. We identified five steps required to successfully transform an IT organisation:

Create your business case

A business case describes the reason for the transformation and sets the project’s priority relative to other corporate initiatives. Furthermore, it is used to acquire resources, gain the commitment of stakeholders, and keep the project on track.

As problems occur, the business case can be used as a shield to remind people of the reasons for the project. A business case typically includes qualitative factors such as improvements in flexibility, customer service, or project execution, and quantitative factors such as savings, return on investment, or service-level improvements.

Develop your vision

A vision provides a picture of the future that is sufficiently detailed for people to envision where they fit into the new organisation. It provides a pull rather than a push to the future. Intuitively, it appears as if developing a vision should precede the business case, but we have found that creating the business case first results in a more focused and useful vision. Though the deliverables of this step vary more than other steps, elements of a vision often include the organisational model, required skills, key processes and sourcing alternatives.

Assess the current organisation

The vision provides a picture of the target model. By assessing the current organisation, you will identify gaps in reaching that future state. These gaps may be in areas including skills, processes, structure, or culture. Subsequent phases will attempt to fill those gaps.

Develop an organisational design

This step is the most crucial stage of the transformation process, and in some cases, it is divided into two phases. The first is the development of an operating model, and the second, an actual orgnisation chart and supporting material describing other changes.

Implement the new organisation

This is the most mechanical of the steps. It is also the potentially most disruptive as it changes people’s jobs and reporting relationships.

By Mark Cecere, principal analyst, Forrester Research.

Forrester makes several reports available free of charge to Computing readers; for more information click here: www.forrester.com/computingUK .

Shifting IT sourcing focus for business growth

2009-10-06T10:36:00+01:00

IT leaders must recognise business realities in re-setting their plans.

Since the credit crunch took hold, few UK firms have sustained a growth-led agenda. Shrivelling demand, evaporating credit, and overall negative sentiment took care of that. But lately the mood has begun to shift. Management teams start to move emphasis from cost control and stabilisation to exploiting growth. In turn, IT leaders must weigh up the implications for their own plans. And sourcing strategy will need a thorough review as part of the larger picture.

Your firm’s business status will dictate your strategy.

Crucially, not all companies are equal when it comes to planning for growth. Just consider the contrast between Vauxhall and Tesco. Vauxhall only narrowly survived recent turmoil at GM, and now faces grave uncertainty as its new owners establish control. Tesco, by contrast, has maintained both revenue and profitability growth through the recession, and its leaders continue bullish geographical expansion.

Does your company - like Tesco - combine strong financial status with sound leadership strategy? If so, then you will likely face a period of confident new investment and an ambitious drive for growth. But if your business has a weakness either on the financial or strategy dimension, this will inhibit confidence and hinder growth plans. And if - as with Vauxhall - both financials and strategy look shaky, then staying alive may be ambition enough – at least until economic clouds lift further.

Linking IT sourcing strategy to business reality

So what does this view of business context mean for your plans for IT sourcing? Here are some tips to consider, based on four possible scenarios that may fit your business.

Strong financials and sound leadership strategy. Like Tesco, your firm has a strong basis to capitalise on the upturn to come. For IT sourcing strategy, you need to consider the steps required to prepare for growth. Can your suppliers scale as you grow – for example by extending services into new geographies? Can they fund expansion in the wake of two years of disruption? What new products, skills or resources will you need from suppliers to support business growth? By asking such questions, you can establish the basis of a growth-oriented plan.

Strong financials but muddy or weak leadership. In this situation your first priority is personal: reinforcing your alliances with the business stakeholders who influence IT funding and strategy decisions. Your firm will likely face wrenching political battles and shifts in priorities – so you need all the support you can get to stabilise the position of IT. In terms of sourcing, look for opportunities coming out of the crisis – like using continuing economic challenges as a lever to gain better compliance with preferred supplier policies. After all the CFO and CEO will be your allies like never before – and you can call on their help to crack down on islands of non-compliance across the firm.

Weak financials combined with clear and consistent leadership. Firms facing this scenario often experience a period of consolidation that can involve steps like business divestments and market retrenchment. Your business stakeholders will have highly differentiated expectations of IT, as some drive for growth while others continue to headline cost control. Plan with suppliers to differentiate their support to these different elements of the business. And you will likely need to review the metrics and incentives for your sourcing staff as some work mostly on cost reduction while others become more directly involved in areas of expansion.

Financial and strategy weakness combined. Survival is the watchword for firms in this boat. You will need all the help you can get from your suppliers on an ongoing basis – like lower rates, and help with restructuring. Focus your planning on the creative ways you can encourage this support from – for example – your outsourcing partners, like offering them access to new business in future in return for favourable short term treatment.

For a deeper discussion of these and a wide range of other IT sourcing issues, look no further than IT leaders must recognise business realities in re-setting their plans.

Your firm’s business status will dictate your strategy.

Linking IT sourcing strategy to business reality

So what does this view of business context mean for your plans for IT sourcing? Here are some tips to consider, based on four possible scenarios that may fit your business.

Strong financials and sound leadership strategy. Like Tesco, your firm has a strong basis to capitalise on the upturn to come. For IT sourcing strategy, you need to consider the steps required to prepare for growth. Can your suppliers scale as you grow – for example by extending services into new geographies? Can they fund expansion in the wake of two years of disruption? What new products, skills or resources will you need from suppliers to support business growth? By asking such questions, you can establish the basis of a growth-oriented plan.

Strong financials but muddy or weak leadership. In this situation your first priority is personal: reinforcing your alliances with the business stakeholders who influence IT funding and strategy decisions. Your firm will likely face wrenching political battles and shifts in priorities – so you need all the support you can get to stabilise the position of IT. In terms of sourcing, look for opportunities coming out of the crisis – like using continuing economic challenges as a lever to gain better compliance with preferred supplier policies. After all the CFO and CEO will be your allies like never before – and you can call on their help to crack down on islands of non-compliance across the firm.

Weak financials combined with clear and consistent leadership. Firms facing this scenario often experience a period of consolidation that can involve steps like business divestments and market retrenchment. Your business stakeholders will have highly differentiated expectations of IT, as some drive for growth while others continue to headline cost control. Plan with suppliers to differentiate their support to these different elements of the business. And you will likely need to review the metrics and incentives for your sourcing staff as some work mostly on cost reduction while others become more directly involved in areas of expansion.

Financial and strategy weakness combined. Survival is the watchword for firms in this boat. You will need all the help you can get from your suppliers on an ongoing basis – like lower rates, and help with restructuring. Focus your planning on the creative ways you can encourage this support from – for example – your outsourcing partners, like offering them access to new business in future in return for favourable short term treatment.

For a deeper discussion of these and a wide range of other IT sourcing issues, look no further than Forrester’s upcoming Services & Sourcing Forum, to be held 22-23 October, in London.

Andrew Parker is a vice president and principal analyst at Forrester Research, where he serves Sourcing & Vendor Management professionals.

Managed services thrive in tough times

2009-08-13T13:32:33+01:00

Every six months, Forrester Research produces a report tracking the managed services contracts signed by telecom service providers with firms based in Europe. We do this by requesting information from the service providers themselves, as well as taking information from public sources such as press releases.

We have recently published our analysis of the deals completed in the second half of 2008, when the financial crisis was reaching its peak. So it was a surprise to us that the number of deals we identified was not only higher than the previous six months, but greater than any six-month period in the past three years. However, the total deal value was down to less than half the figure for the previous six months. So what is going on, and why?

Three strong trends became clear. Deals are getting smaller and shorter, and the number of multi-service deals has fallen rapidly 75 per cent of all the deals that we tracked were for a contract value of less than €5m (£4.3m), and two thirds were for three-year terms or less.

We talked to a number of service providers and users. This is what emerged:

Companies are looking to reduce costs by signing simple contracts for single services that can be negotiated and implemented quickly, delivering savings in the current budget year.

IT budgets are under great pressure, with many firms reporting cuts in spending and staff levels.

The requirement for flexibility is paramount long-term multi-service contracts take too long to negotiate and are too inflexible.

Under these circumstances, infrastructure managed services are attractive to firms. They enable them to reduce or avoid capital expenditure (capex) and to focus IT on areas of their business that are key to success and are not a commodity.

Telecom service providers’ strengths lie in providing services that are close to their core networks’ business, such as operating datacentre infrastructure and providing network-based services.

This explains why we are seeing rapid growth in managed services for infrastructure services such as managed LANs, PBXs and firewalls. These are all well-defined commodity services for which responsibility can be quickly transferred to the service provider, which has the economies of scale and processes to reduce a company’s costs compared to a DIY approach.

Hosting services are also looking attractive not many firms can or want to raise capex to build or expand a datacentre while cost pressures remain.

In Forrester’s Enterprise and SME Networks and Telecommunications Survey, North America And Europe, Q1 2009, 40 per cent of firms said they are interested in managed services beyond infrastructure and network services such as network-based security services and application hosting.

As a result, even at firms where overall budgets for IT are being cut, spending on managed services is increasing. Make-or-buy decisions for new and often complex applications such as unified communications, collaboration and Web 2.0 are looking easy with no staff and no capex available for the project, managed services make perfect sense.

Budgets for managed network and telecoms services, for desktop and server hardware outsourcing, and for applications and management outsourcing are planned to be larger in 2009 than 2008 spending at more than one fifth of firms.

Will the trend continue, even when the crisis eases? That is down to the service providers. If they deliver good service and value for money, the future for managed services looks very bright.

By Phil Sayer, principal analyst at Forrester Research.

Please visit www.forrester.com/computinguk for several complimentary reports made available to Computing readers by Forrester Research.

The frustrations of e-discovery

2009-07-14T17:30:28+01:00

As escalating volumes and types of information drive swelling e-discovery costs, many firms are exploring how information retrieval technology can support critical steps in the e-discovery process. Manually reviewing documents represents the largest direct cost associated with e-discovery. To control this expense and mitigate legal risk, businesses are re-examining strategies, processes and technology investments.

Currently, few companies report having a holistic approach to e-discovery. Forrester’s research suggests just 23 per cent have an end-to-end approach to gather and filter data. And two-thirds consider their e-discovery strategy reactive rather than proactive.

We asked if firms were confident that, if challenged, their organisation could demonstrate that its electronically stored information was accurate, accessible and trustworthy. Fewer than one in five was very confident.

Several factors account for this lack of confidence. These include large and growing volumes of content; diverse applications, tools, and file types; undocumented, disorganised data architectures; increased litigation and rapidly changing case law; and a fragmented vendor ecosystem.

Although a variety of electronically stored information can be relevant to e-discovery, most litigation to date has focused on email, loose files, and employee desktops. Other content types will become increasingly important for e-discovery.

To illustrate, 18 per cent of respondents reported plans to add voicemail access by e-discovery this year. The survey highlights that structured content in databases and line-of-business applications will be increasingly important to e-discovery.

Search and retrieval technology can play an important role in easing e-discovery cost burdens. However, a relatively small percentage of the decision-makers Forrester surveyed use enterprise-grade search tools for e-discovery purposes today. A larger proportion use operating system (OS) search, native search within applications, and desktop search tools.

Complicating the limitations of basic OS and desktop search, information retrieval to support e-discovery faces several key challenges. Expanding international requirements complicates e-discovery support for many firms.

IT leaders report facing increasing challenges in meeting foreign language requirements and different and sometimes conflicting demands for e-discovery with numerous national, regional, and local regulatory and privacy requirements.

Given these challenges, many firms simply outsource a range of e-discovery processes to third parties. The significant expense associated with heavy reliance on service providers, however, is increasingly leading many organisations to bring certain e-discovery steps in-house to cut costs.

Currently, a single, unbroken search and retrieval infrastructure is not realistic or feasible. Most firms use a mix of point solutions at different stages of the process.

These fragmented applications, however, can contribute to e-discovery headaches. In fact, survey respondents cited synchronising e-discovery, records management, and archiving efforts as being highly problematic.

Poor internal communications, disjointed applications, and ad hoc efforts make e-discovery a painful process, while effective information retrieval applications can bolster business e-discovery efforts. But without appropriate focus on the people and process aspects and application rationalisation, organisational success at mitigating legal risk will be limited.

Brian Hill is a senior analyst at Forrester Research

Please visit www.forrester.com/computinguk for several complimentary reports made available to Computing readers by Forrester Research

A value focus for enterprise IT

2009-05-05T17:20:14+01:00

Recently, Forrester Research has been picking up signals of a shift in mindset among IT executives. For weeks after the credit crunch hit, most IT leaders welcomed “survive the recession” advice. But, after months of firefighting, downturn fatigue has set in. No one thinks our troubles are over, but apparently many IT leaders feel they have taken or at least defined the steps needed to support business stability in the short term. Now they want to refocus on more thoughtful topics.
Most senior IT leaders recognise that enterprise IT is in a period of sweeping change that does not simply reflect the economic crisis. As computing becomes ever more embedded in all aspects of business, the control of IT has moved out of the datacentre and into the hands of business leaders.
Meanwhile, commodity IT has become more stable, for example through the adoption of infrastructure virtualisation, application rationalisation and the uptake of standardisation tools, such as service-oriented architecture. As IT leaders drive these ongoing shifts, they must focus on business issues and business architecture as well as maintain operational management of the rationalised systems they control.
For a typical chief executive or chief financial officer, cost containment may have been the dominant issue for managing IT in 2008, but longer term it is the business-value impact of IT that matters. IT leaders know that in future they will be judged on value impact, based on business performance metrics, such as time to market with new products, or improved customer retention.
Forrester believes this value-oriented agenda for IT will increasingly reassert itself over the course of 2009. To stay ahead of this, IT leaders must focus on three agenda items:
Linking what IT does to business value. All IT staff need to understand that their success will be judged in business terms in future. More business and IT leaders will jointly agree objectives, metrics, and governance structures that couple IT activity and outputs to overall business goals.
US financial firm USAA has used technology to support its drive for improved customer relationships. As a result, it consistently scores best among leading US finance firms in Forrester’s annual consumer survey on customer-centric finance providers. It is this kind of IT value outcome that leaders will expect IT to facilitate.
IT leaders must drive value individually. The CIO and direct reports must engage with business leaders to identify and execute on areas of value delivery. Inside the IT group this means leading by example for instance, by devoting time to business issues and prominently featuring business impact in internal communications. Outside IT, building personal networks across the wider business, and marketing IT activities to business leaders.
Focusing IT’s collaboration with others on value outcomes for example, building a business-value focus into relationships with external suppliers. For example, coaching the vendor management team to focus on value-generating supplier contributions. Linking supplier governance and performance criteria to value outcomes will support external partners that contribute to overall business objectives.
These three lines of attack represent a vital aspect of the renewal and rebuilt momentum that IT leaders need to achieve with their teams during the coming six to 12 months.
Forrester’s thinking about Redefining IT’s Value For The Enterprise is the overarching theme of its European IT Forum in Berlin, 3-5 June 2009. For more information on this event please visit www.forrester.com/ITForumEMEA2009.
For complimentary research from Forrester, visit http://forrester.com/computing.uk.
Andrew Parker is vice president for sourcing and vendor management at analyst Forrester Research

Adopting a frugal approach to the web

2009-03-12T12:15:43+00:00

In the era of the consumer-centric web, people expect rich, engaging and satisfying online interactions with companies and brands. Since the recession will do nothing to depress this expectation – indeed, it will likely make consumers more fickle and demanding – firms should avoid the temptation to apply across-the-board IT budget reductions to external web projects.
Before cutting the budget of their web content management (WCM) initiatives, executives should consider their responsibility to do no harm to what is frequently the company’s primary channel for attracting and servicing customers. Rather than radical changes in the name of cost savings, Forrester recommends that businesses adopt a strategic approach we call “frugal WCM”.
Instead of slashing budgets in a panicked reaction to an immediate crisis, frugality should combine the wise use of what you have with careful consideration of what you acquire, all in the service of long-term health and sustainability.
Companies can practice frugal WCM by extracting the maximum value from their existing systems and investigating lower-cost alternatives for specific enhancements.
Many firms use only a fraction of the capabilities of their WCM tool and poor adoption by contributors remains a key reason for under-performing WCM projects. Despite improvements, the user interfaces of many leading WCM products remain hostile to users. Companies can increase adoption by allowing business users to create content in favoured desktop applications or team collaboration sites and designating a few power users to manage content in the WCM system.
Creating content is hard enough – yet some teams create the same content multiple times due to lack of co-ordination on multi-lingual sites, multiple web properties, or across non-web channels. By the same token, companies should review whether existing content can add value to other sites. For example, one European resort chain significantly improved revenue simply by displaying floor plans during the booking process.
Web teams can begin to experiment with personalisation features despite the stranglehold on their budgets. Most WCM tools are able to support basic content targeting, for example, with simple modifications to visitor profiles and the rules that control delivery. As it is best to start small with site personalisation, experimenting now will allow a team to move more quickly after the recovery.
Frugal WCM is not only about getting more out of what you have. It can also reap benefits when making new investments.
Given the potential for top-line growth from optimising the online customer experience, firms will continue to justify large investments in new or existing WCM projects during the recession. But supporters can expect intense scrutiny of business need and return on investment.
As the web shifts from information delivery to customer experience, more projects are opportunistic. They may require quick turnaround, such as a sales promotion; focus on social elements, such as a fan site for a sporting event; and be highly interactive.
Frugal WCM counsels investigating lower-cost alternatives to custom development of the firm’s WCM, even at the risk of multiplying the number of systems you need to manage.
Smart firms will use the recession to adopt new approaches, such as frugal WCM, that will contribute to their success long after the crisis ebbs.
Tim Walters is senior analyst at Forrester Research
Please visit www.forrester.com/computinguk for several complimentary reports made available to Computing readers by Forrester Research

Slump exacerbates internal threats

2009-02-05T10:16:57+00:00

The dire state of the economy will have a direct impact on enterprises in 2009. Financial losses initially confined to the sub-prime loan market infected broader financial services and, in turn, rippled outward to the construction, retail, and transportation industries.
All businesses are now under pressure to cut costs – and that means eliminating jobs. With more mass layoffs expected to come later this year, chief information security officers (CISOs) will be asked to take decisive measures to keep their firms’ confidential data from walking out the door along side their employees.
To this end, Forrester expects that in 2009 data protection tools will be seen as a critical technology for limiting the loss of sensitive information before layoffs happen. Employers will buy data leak prevention (DLP), device control, and Web filtering technologies to help them clamp down on nervous employees sending themselves attachments to outside Webmail addresses, copying documents to USB thumb drives, or posting to outside blogs.
Full disk encryption will also be a key tool in the CISO’s bag as a complement to DLP. Disk encryption protects the entire contents of a worker's computer in the event of theft or loss. Of 500 large enterprises Forrester recently surveyed, 35 per cent have already deployed full-disk encryption. Forrester expects that by 2011, three-quarters of large and very large enterprises will make full-disk encryption a standard part of their PC builds.
In addition to taking steps to safeguard company data and documents, CISOs will be asked to watch another worrying concern: the abuse of privileges by authorised. Enterprises often grant employees too many application privileges, or fail to remove access to applications when they take new positions within the company.

In 2009 entitlements will give business leaders major headaches; personally identifiable information will cause much of the discomfort. Some of the drivers of the problem may include employee curiosity. Forrester predicts that more high-profile stories about unauthorised snooping will become much more common next year. If 2008 was "The Year of the Lost Laptop," 2009 will be "The Year of the Curious Customer Service Representative."
Another driver may be the temptation to earn ‘quick money’, as customer information used to manufacture identities and open credit continues to be valuable. Recent security intelligence from Symantec, for example, states that underground prices for consumer credit card details range from $0.50(£0.35) to $12 (£8.40) per card. By that measure, an entitled employee with excessive privileges at an online merchant with sloppy internal controls could sell 10,000 card numbers and make a quick $100,000 (£70,000).
Further to spirited and public debates over wide-open healthcare records, interoperability and access control of electronic personal health records will become a more significant priority and drive greater awareness of entitlements in healthcare, life sciences, and beyond.
As auditors have gained more experience assessing compliance with Sarbanes-Oxley and other statutes, they have become increasingly aware of the perils of excessive entitlements. Greater awareness has led to tougher audits. Now enterprises must be prepared to explain who got access to what application features, and why.
Forrester expects that deployments of hosted application and desktop virtualisation technologies, such as those from Citrix, Microsoft, and VMware will rise in 2009. Client virtualisation has long been used to address remote access and manageability concerns. But today, the majority of Forrester clients justify new client virtualisation deployments by the need to secure data on the user PCs. Increased data concerns will make client virtualisation more palatable to CIOs because enterprises will see it increasingly as a dual-use technology that can increase productivity and security at the same time.
Historically, highly regulated industries such as healthcare and financial services adopted client virtualisation first because of the clear linkages to security. Throughout 2009, increased turnover in employee ranks will offer further justification to these and other industries, based on client virtualisation's potential for decreasing the possibility of data breaches. As a result, data security will continue to be the No. 1 driver of client virtualisation initiatives through 2011.
By Andrew Jaquith, senior analyst at Forrester Research
Please visit www.forrester.com/computinguk for several complimentary reports made available to Computing readers by Forrester Research.

Time to hone your sourcing skills

2008-11-20T11:41:51+00:00

Making sourcing decisions against a background of economic crisis should be easier during a recession companies focus on cost and cost alone. Right now, the ability of vendors to respond rapidly to business needs will be thoroughly tested by recession, and Forrester expects most firms to renegotiate their sourcing contracts or reduce the number of service providers with which they engage.

That has many ramifications for IT leaders.

First, you should cut costs wherever you can. Focus on what you can do to rationalise your infrastructure and applications environments to cut costs this will mean working across the business to identify any redundancies.

Accelerate those sourcing projects that will avoid near-term expenses for example, rapidly migrating remaining applications from a “burning” database engine could avoid software licence maintenance fees for the coming year.

Solicit proposals from your vendors to get a better understanding of what they can offer in terms of service automation or application rationalisation frameworks.

Identify labour-intensive areas as candidates for sourcing. The largest efficiency improvements should be possible in the areas that consume the most labour resources. For example, look at your internal application-testing processes testing occurs on every project, and test data generation, test setup, and test execution can be extremely resource intensive. Vendors that we track continue to strengthen service offerings in these areas, helping firms reduce the cost of this key activity.

Meanwhile, it is important to scrutinise all the IT sourcing proposals available, and to take a jaded view of them all. Make sure all the evidence from a vendor is convincing to all the decision makers involved before you reach any conclusions. Send the statement of work to a dedicated team to analyse proposed project plans and make the necessary adjustments to ensure any initial investments from your side are kept to a bare minimum.

Vendors are great at painting a picture of a happy ending but they lack the clarity to undertake the transitioning, and it often costs more than you realise. Go back to the RFP and include targeted questions concerning what investments they have made to accelerate project delivery. For example, do they use fast deployment methods or testing automation?

Encourage your internal stakeholders to voice their views and take on board what they have to say. Reach out to those business managers who are not already knocking on your door so that the entire organisation has an opportunity to benefit from your expertise and experience. Be ready to offer advice on consolidating vendors, proactive suggestions on changes to upcoming renegotiations, and information on how to get more value through better vendor management what Forrester terms “activist sourcing”.

Most importantly, market yourself. IT leaders must explain to key stakeholders what they can do. In addition to offering advice based on your stakeholders’ stated needs, use this as an opportunity to offer consultative help that they might not realise you can provide.

For example, many users do not realise that sourcing teams can be brought in even before the decision is made to bid a piece of work or hire a vendor. Use your research skills to help colleagues understand some of the emerging contracting mechanisms, such as shared risk and reward or managed outcomes, which can de-risk projects from a cost perspective. This makes the sourcing role more consultative and proactive.

Please visit www.forrester.com/computinguk for several complimentary reports made available to Computing readers by Forrester Research.

Euan Davis is a principal analyst at Forrester Research.

Paying by results can reduce costs

2008-09-25T09:54:40+01:00

Many enterprises turn to external service providers for application-related services. Forrester Research surveys show that between one- fifth and one-third of large companies in the US and Europe use external service providers for each of a number of categories of application services. Established services include staff augmentation for software development projects, application outsourcing, maintenance and support, testing and quality assurance, and newer forms of provision such as software-as-a-service. Forrester estimates the European market for these services at more than $40bn (£32bn) in 2008.

Too many companies focus on the time and effort involved in delivering these services, rather than the outcomes required, when negotiating contracts with providers. Worse still, the cost or price benchmark is too often the most important yardstick for the initial selection of a service provider. These numbers have their uses, of course, but by themselves they give very little indication of the value for money achieved.

One of my colleagues, Bill Martorelli, has recently investigated the potential benefits to companies from a more outcome-led approach to negotiating. He calls this the managed outcome model, and describes it as “an application development and/or maintenance relationship based on defined outcomes and priced on a fixed-bid basis”. This relies on defining the service relationship in terms of deliverables, service levels, and price, rather than according to the number of resource hours or days committed.

Enterprises stand to reap significant benefit from transferring more work to the managed outcome model. Payoffs include a one-off cost/benefit boost from moving work across from internal processes to those of the service provider.

Additional advantages may include more effective knowledge retention through the provider’s more industrialised knowledge systems, avoidance of lengthy and challenging negotiations over appropriate levels of effort under time-and-materials contracts, and a more defined approach to innovation and business value delivery through building these goals into the expectations placed on the service provider.

Of course, this change of approach involves challenges, too. Not least of these will be winning the internal debate inside the buyer company about loss of control or increased risk from handing over day-to-day service management to the provider. What’s more, some internal stakeholders may not find the benefits from the changed approach so obvious. And, of course, the internal change management involved in the transition from one approach to the other for the buyer company can be tough to execute on a day-by-day basis.

So where should companies considering this transition make a start? Forrester’s research indicates that large opportunities ¬ like a major application development project ¬ work best. For the provider this means more scale of work, which makes it worthwhile for the supplier to take on the risk of working on a fixed-price basis. For the client, it means more potential cost savings.

Martorelli also recommends that buyer companies should favour opportunities that can be well specified, and where historical data exists. It may seem obvious, but in practice too few firms embark on a service engagement with a clear set of outcomes defined upfront. If it is possible to specify the requirements clearly, then the chances of a managed outcome approach succeeding are that much higher.

Please visit www.forrester.com/computinguk where several key studies on this topic are available to Computing readers free of charge.

Andrew Parker is research director at analyst Forrester Research

People are your best defence

2008-07-24T09:32:34+01:00

As many as 81 per cent of chief information security officers (CISOs) rank data protection as an important or very important priority for their organisation during the next year, according to Forrester Research.

The prioritisation of data protection is correct, as few IT issues let alone IT security issues have achieved such interest at the executive level.

Data security is a top priority because breaches can be incredibly costly. If you collect sensitive customer data, you are not only bound by regulatory and legal requirements, but also by potential fines and legal costs.

In addition, breaches of corporate intellectual property or other sensitive corporate data might not make the headlines, but they can have a catastrophic business impact.

CISOs often view data protection as desktop and storage-level encryption, and perhaps deploy data leak prevention technologies.

While these have their place, what is missing, or not emphasised, is the process and people aspect of data security application security, training and awareness.

Many security professionals that grew up concentrating on infrastructure are often unaware of the types of development environments and processes that are now dominant.

And as with any unfamiliar technology area, security leaders hold a diminished level of influence. CISOs often struggle to establish application security processes as part of a company’s software development lifecycle.

Application developers often view security as an annoying layer of cost and inconvenience. Security controls can slow application development and testing, and reduce the actual performance of tools.

With data security now high priority, there are strong arguments in favour of a more proactive approach to application security. Applications are the primary target of hackers roughly two-thirds of vulnerabilities discovered by Symantec are web
application-related.

Estimates from the National Institute of Standards and Technology have also shown that fixing vulnerabilities after applications are developed has produced costs up to 30 times more than fixing during the design phase.

Given the inevitability of vulnerabilities and the trends in hacker behaviour, there are clear risk and cost arguments for proactive application security - finding and fixing vulnerabilities as early in the development process as possible.

Security training and awareness is another area that is rightfully getting more attention, because the little training that takes place usually tends to be superficial.

Your workers serve as a critical line of defence, and security training ties directly into the effectiveness of other initiatives.

For example, incident management equips the organisation to deal with unforeseen events, so a lack of training will result in chaos and confusion at the time of security breaches.

Lack of training also leads to unreported security incidents. Many people do not know what activities should be viewed with suspicion, or whether to report them.

Both endeavours - application security and training - promise to enhance data security, deliver good return on investment and improve programme effectiveness.

Jonathan Penn is vice president of security and risk management at Forrester Research. Computing readers can download free Forrester reports at: www.forrester.com/computinguk