CIO Assessment...Checking the Vital Signs Checkup #4 – Maturity Assessment IT Score Analyst Reviews Checkup #3 - Surveys Customer ComIT Members Checkup #2 - Environment Products

City of Virginia Beach | ComIT Master Technology Plan (Appendix C) 1

CIO AssessmentAppendix C

ComIT Master Technology Plan (Apendix C) | City of Virginia Beach2

CIO Assessment

COMIT HEALTH CHECK


Bottom Line Up Front

Organizational Opportunities Empower Virginia Beach Members and Citizens with Technology Innovations

Create New Collaborative Relationships Improve System Sustainability and System Performance

Leverage Strategic Investments

ComIT Opportunities Develop Virginia Beach’s first Comprehensive IT Strategic Plan

Develop a New IT Technology Architecture Roadmap Perform Benchmarking

Improve Budget Management Improve Operations and Support

Develop a Continuous Improvement Program


Checking the Vital Signs

Checkup #4 – Maturity Assessment

IT Score Analyst Reviews

Checkup #3 - Surveys

Customer ComIT Members

Checkup #2 - Environment

Products Processes

Checkup #1 - Customer Interviews

One on One Small Groups


4


5


6


7


8


9


10


11


12


13


5

Diagnosis #1 - Customer Interviews

Customer Themes

Good Smart People

Good Technologists

Risk Averse

Inhibitor vs. Enabler

Be More Responsive

Need for Better Relationships

Develop Collaborative Relationship with Schools

14








Products Processes



15


5

Checkup # 2 - Products and Processes

Products/Facilities

InSITE, Accela, RAC’s, Hansen, GIS, Email

VBGOV.com

Phone System and Radios

Network, Servers and Storage

Desktop/Laptops/MDCs

Datacenters

Processes

Budget

CIP

Program Groups

SIT Teams

EOC

Service Desk

Project Management


5

Checkup # 2 - Products and Processes

Products

• Networking Devices ~1198 (Approx. 30% 6yrs and older)

• Radios Public Safety ~1100 (2007) School Bus ~900 (2007) Non-Public Safety - City ~ 2065 (1999+) No Replacement Plan Schools Subscribers - ~1311 (1999 +) No Replacement Plan

• Desktops/Laptops 4764 Desktops (Approx. 32% 5yrs and older) 1352 Laptops (Approx. 52% 5yrs or older) Servers (~240 –Physical; ~300 -Virtual) Replacement Fund Started FY14

• Telecommunications Mix of Copper and Fiber; Leased and Owned Various speeds, Ad-hoc design (not optimal)

• Applications 800+ in Portfolio

Processes • Service Desk

Average 600 Calls/Month Backlog of 573 tickets/month

• Project Management 86 Projects in Portfolio 66 – Active; 20 – Pending

Average Time to Completion: FY12 and FY13 – 588 days (33 Projects)

Cost - Project Managers FY12 Costs: 6 FTE - $528,387; 3.5 FTC - $648,015

FY13 Year to Date (March 2013): 6 FTE - $366,185; 5 FTC - $697,906

FY13 Full Year Projected: 6 FTE - $$549,278; 5 FTC - $992,000

Average of 6 Projects per Project Manager Gartner Metrics: Industry Standard– 4; Best Practice- 2


5

Diagnosis # 2 - Products and Processes

Products

• Review current hardware refresh plans and funding sources; Propose modifications to programs to increase transparency and leverage technology investments.

• Develop a new technology architecture roadmap.

• Design a current state-of-the-art fiber communications architecture for the city.

• Create framework to support mobility devices to create efficiencies within organization. – Tablet Transformation

• Create framework to properly manage the organizations application portfolio.

Processes

• Create IT Strategic Plan

• Perform Benchmarking • Infrastructure & Operations

• Applications Management (Including Project Management)








Products Processes




5

Checkup #3 - Survey Results

3.8

0

3.5

2

3.3

2

3.6

0

3.7

0

3.4

4

3.5

2

3.3

7

C IT Y BUSINESS UNITS ARE PROVIDED WITH

EFFECTIVE TECHNOLOGY TOOLS TO DO THEIR JOB

CIT Y HAS MADE GOOD DECISIONS ON IT

INVESTMENTS

IT SYSTEMS PROVIDE EXCELLENT SUPPORT

FOR BUSINESS PROCESSES

IT SYSTEMS ARE EASY TO USE

Customers ComIT Members

Note: Based on Likert Scale 1 – 5; 1 = Strongly Disagree and 5 = Strongly Agree


5


3.2

4

3.0

8

3.9

6

3.7

6

2.8

9

3.1

7

4.0

6

3.2

7

CHANGES TO IT SYSTEMS ARE

DELIVERED IN A TIMELY MANNER

IT PROJECTS ARE DELIVERED IN A COST

EFFECTIVE MANNER

CRITICAL BUSINESS INFORMATION/DATA IS

APPROPRIATELY PROTECTED

EFFECTIVE TRAINING IS PROVIDED FOR THE IT

SYSTEMS I USE




5


3.8

8

3.6

8

2.7

2

2.6

8

3.9

6

3.5

6

2.8

8

3.2

1

C IT Y SHOULD HAVE A TECHNOLOGY

INNOVATION FUND SPECIFICALLY

EARMARKED FOR NEW AND INNOVATIVE

BUSINESS PROJECTS

COMIT DELIVERS EFFECTIVE IT SERVICES

COMIT IS AGILE AND FLEXIBLE

COMIT IS A TECHNOLOGY ENABLER, BUT NOT THE DECISION-

MAKER




5


3.7

6

2.9

2 3

.80

3.5

2

3.6

8

3.4

3

3.5

4

3.4

3

COMIT PROVIDES EFFECTIVE HELP WHEN I

NEED IT.

COMIT WORKS CLOSELY WITH DEPARTMENTS TO

DEVELOP INNOVATIVE APPLICATIONS

COMIT STAFF MEMBERS HAVE THE RIGHT SKILLS

COMIT STAFF MEMBERS HAVE THE

RIGHT ATTITUDE





3.64

3.56

3.28

3.37

3.27

2.95

OUR EXTERNAL/THIRD PART Y IT SERVICE

PROVIDERS DELIVER EFFECTIVE SERVICES

THE COMIT MANAGEMENT TEAM

PROVIDES SOUND GUIDANCE AND

LEADERSHIP

OVERALL, OUR CUSTOMERS ARE

EXTREMELY SATISFIED WITHY COMIT'S

CONTRIBUTIONS TO THE ORGANIZATOIN



Checkup #3 - Survey Results Directors/Line of Business Leaders - Only

0.010.020.030.040.050.060.070.080.090.0

100.0

Over the past five years,has ComIT become more

or less critical to yourbusiness?

In the upcoming fiveyears, do you think

ComIT will become moreor less critical to city

lines of business?

More CriticalNo ChangeLess Critical


Checkup #3 - Survey Results ComIT Members - Only

0.010.020.030.040.050.060.070.080.090.0

100.0

Over the past five years,has ComIT become more

or less critical to yourbusiness?

In the upcoming fiveyears, do you think

ComIT will become moreor less critical to city

lines of business?

More CriticalNo ChangeLess Critical



0.010.020.030.040.050.060.070.080.090.0

100.0

Who is responsible fortechnology innovation forthe organization, ComITor the business units?

Completeley ComIT'sresponsibilityMostly ComIT'sresponsibilityComIT and LOB share theresponsibilityMostly the business units'responsibilityCompletely the businessunits' responsibility


Checkup #3 - Survey Results ComIT - Only

0.010.020.030.040.050.060.070.080.090.0

100.0

Who is responsible fortechnology innovation forthe organization, ComITor the business units?

Completeley ComIT'sresponsibilityMostly ComIT'sresponsibilityComIT and LOB share theresponsibilityMostly the business units'responsibilityCompletely the businessunits' responsibility


5 29


30



0.010.020.030.040.050.060.070.080.090.0

100.0

Do you consider ComITan innovator compared

to other localgovernments?

Yes, they're a leader

Somewhat

No, they tend to follow theherdI don't know


Checkup #3 - Survey Results ComIT Members - Only

0.010.020.030.040.050.060.070.080.090.0

100.0

Do you consider ComITan innovator compared

to other localgovernments?

Yes, they're a leader

Somewhat

No, they tend to follow theherdI don't know


5 33


5 34


5 35


5

Diagnosis #3 – Director/LOB Survey Results


5 37


5 38


5

Diagnosis #3 – ComIT Member Survey Results








Products Processes




5

Checkup #4 - Maturity Assessment

Gartner

• The world's leading information technology research and advisory company.

• Founded in 1979, Gartner is headquartered in Stamford, Connecticut, U.S.A., and has 5,300 associates, including 1,280 research analysts and consultants, and clients in 85 countries.

• Their clients range from CIOs and senior IT leaders in corporations and government agencies, to business leaders in high-tech and telecom enterprises and professional services firms, to technology investors, which encompass 12,400 distinct organizations.


5 42


5 43


5 44


5

Functional LEVEL 1

Enabling LEVEL 2

Contributing LEVEL 3

Differentiating LEVEL 4

Transformational LEVEL 5

Process management disciplines are adopted. People programs shift from skills to results orientation.

Integrated tools support IT processes and cost

compensation.

IT is run like a

business

Technology Strategy is explicitly aligned to business goals. IT Performance Measures are tied to key business indicators. IT service and solution capabilities are rock-solid. Sourcing is approached strategically and based on explicit business models.

CIO is a fully-vested business leader reporting to CEO. Strategic human capital management processes, maintain appropriate short, mid, and long term talent pipelines. IT organization proactively identifies and pursues opportunities to leverage technology for strategic advantage.

CIO has formal accountability for at least some business outcomes. IT Leaders drive innovation, pursuing IT enabled opportunity where external competitors find constraint. IT leaders fuel agility through extensive external relationships, partnerships, and personal networks.

2.4

Service and Solution outcomes are measured against formal performance obligations.

CIO Assessment

Purpose: Enables leaders to determine their IT organization’s capacity for helping the enterprise advantageously leverage information technology.

Level 2 - Enabling: IT gives business leaders the leeway to use technology as required to achieve their objectives. IT organization is cast in the role of supporters, meeting expectations and providing tools and solutions as required by business leaders. CIOs focus on responsiveness, services and tools.

Recommendations:

1. Build front office capabilities for sensing and managing demand, influencing decisions, and managing stakeholder relationships.

2. Invest in effective governance. Build disciplined planning, investment and portfolio management.


5

Awareness LEVEL 1

Committed LEVEL 2

Proactive LEVEL 3

Service Aligned LEVEL 4

Business Partner LEVEL 5

Reactive, pro-fighting culture. Ad-hoc processes.

Low Customer confidence

Looking at industry best practices. Initial process formalization.

Working on implementing industry best practices. Application SLAs. Widespread virtualization. Systems management tools integration.

Industry best practices in place. Service SLAs. Process automation. Trusted service provided.

Real-time infrastructure/ private cloud computing. Strategic relationship managers. Proactively pilots new technology for business innovation.

2.3

Tiered Support.

Consolidation/ Standardization

Infrastructure and Operations Assessment

Purpose: Enables I&O leaders to identify shortcomings, determine priorities, and establish goals for improving their organizations

Level 2 - Committed: Managers have started to standardize software and hardware and are documenting processes. They are studying best practices and putting together plans for improvement. They are talking with vendors and looking at ROI of various technologies and implementations.

Recommendations:

1. Improve Quality of Service – Improve and standardize on tools that alert, monitor and report on systems (Pro-active vs. Reactive).

2. Establish Key Performance Indicators (KPI’s) and Operational Metrics. Example KPI’s: - % LAN/WAN utilization - Avg./Peak Storage capacity utilization - Avg./Peak Server capacity utilization - Call abandonment rate/% abandoned calls - % of calls answered within X seconds - % of problems resolved on initial call - % uptime of core applications - # of Severity 1 and 2 outages - % availability of systems

3. Improve Disaster Recovery Planning.


5

Infrastructure and Operations - Detail


5

Reactive LEVEL 1

Emerging Discipline LEVEL 2

Initial Integration

LEVEL 3

Effective Integration

LEVEL 4

Effective Innovation

LEVEL 5

All internal processes centered on management of official projects Projects have budgetary estimates. No formal management tools.

Project processes are standardized. PMO(s) established. Projects are aligned to strategy. Projects and Programs are prioritized

Specialized PPM leader roles formalized. Cross-functional groups are easily formed and collaboration is the norm. Programs increasingly managed in-house. Career paths defined.

Centers of competency improve workload management. The portfolio is modeled and appropriately optimized, factoring in risk. Multiple methods exist and are used by all PMs. Benefit realization is being tracked.

Charge Operations provides a constant stream of mini-projects. Rapid Strategy Execution is the focus of Enterprise Programs. Change Management and Communications are core capabilities of the EPMO.

2.7

Project and Portfolio Management

Assessment

Purpose: Enables PPM leaders to identify shortcomings to determine priorities and establish goals for improving their organizations.

Level 2 - Emerging Discipline: The concept of disciplined teams working on a project is developed and project collaboration and team workspaces are supported. Nevertheless, “stovepipe” systems and inconsistent data still bedevil business processes. Relationships tend to breakdown, and the term “the business” begins to be heard.

Recommendations:

1. Tailor processes to the needs of the organization. Avoid the potential trap that says, “If some processes are good, more is better”.

2. Focus must shift to looking at IT staff as “generic” resources available to support projects. Preserve as many opportunities as possible for them to make unique contributions.

3. Establish an advisory committee that should include stakeholders to help prioritize projects based on resource capacity. This enables full transparency with all projects on the table. IT fails when they work more projects than they can really complete.


5

Initial LEVEL 1

Developing LEVEL 2

Defined LEVEL 3

Managed LEVEL 4

Optimizing LEVEL 5

Automation limited to backup recovery software. Governance and recovery activities are ad hoc, improvised, and reactive. Knowledge, responsibilities, and skill are lacking. Activities are IT centric. Basic plans

No program management or recovery plan automation. Management processes support event response only. IT DRM responsibility assigned. Limited business involvement and commitment.

Vision and program strategy definition in progress. BCM roles, responsibilities, and Steering Committee in place. IT DRM classes and plans for all mission-critical applications.

Program management and recovery plan automation in place. BCM processes standardized and exercised across enterprise. BCM governance is formalized. IT DRAM classes and plans cover more than mission-critical applications. Business recovery plans in place. .

Program management automation enables continuous improvement. KFIs and KPIs linked and reported. BCM program responsibility aligned with strategic business management. Comprehensive BCM plans are in place and regularly exercised. .

1.5

Business and Continuity Management

Assessment

Purpose: Enables BCM leaders to identify shortcomings, determine priorities and establish goals for improving their organizations. This maturity model is intended to support crisis management, emergency management, IT disaster recovery management, business recovery, contingency planning/supply chain availability and pandemic planning enterprise-wide.

Level 1 - Initial: The enterprise is broadly aware of the need for improvements in its recovery capabilities, but lacks the knowledge base to build a true BCM program. Its activities and processes (where they exist) are ad hoc, improvised and reactive, and largely IT-centric and extremely siloed.

Recommendations:

1. Begin a process of developing an IT DRM program, naming an individual within the IT organization who will be responsible for developing IT DRM strategies for the various “siloed” areas.

2. Align business unit IT DRM delivery expectations with what IT can realistically provide given both current and projected budget allocations.

3. Perform an assessment against business expectations of recovery needs. Develop a gap report of current capabilities to recovery need expectations.


5

Initial LEVEL 1

Developer LEVEL 2

Defined LEVEL 3

Managed LEVEL 4

Optimizing LEVEL 5

Ad hoc activities. Initial executive awareness. IT-centric approach.

CISO appointed. User awareness outreach. Formal program initiated

Policies and processes defined. Security organization defined. Improving user awareness.

Governance body established. Info-centric approach Effective metrics. Security organization working well

Information owners accountable. Risk-aware culture. Refine for changes in business, technology, compliance, and economic environments.

3.2

Information Security Assessment

Purpose: Assessment to help identify the organizations current and desired levels of maturity and both drive and justify improvements in tier information security efforts.

Level 3 - Defined: The enterprise has created a solid body of policies, and may also have the beginnings of a responsibility matrix defining individual information security roles. Rules are in place, but accountability for and enforcement of these rules are in their earliest stages. Information security activities are still heavily IT-centric. Most progress in information security is still driven by “top down” concerns from senior management, and enterprise security awareness remains limited.

Recommendations:

1. Create a formal cross-organizational committee to discuss and collaborate on information security issues. This may be a high-level policy approval committee, with membership drawn from line-of-business managers, or a lower-level operational security committee, with members from the IT organization and representatives of the lines of business.

2. Conduct a gap analysis to identify and prioritize areas where improvement is required.

3. Begin to separate operational security functions from strategic risk management functions.


5

Ad-hoc LEVEL 1

Repeatable LEVEL 2

Defined LEVEL 3

Optimized LEVEL 4

Innovating LEVEL 5

Processes not specified. Reinvent wheel each time. Individuals determine

Teams establish processes. Little cross- discipline activity. Repeatable within team.

Processes and defined and documented. Consistently followed across the organization. Synergy among disciplines strengthens, interdependency emerges.

Measures indicate process performance. Clear improvement responsibility assigned. Interdependency among disciplines is essential. Continuous improvement driven by measures

Anticipates technology and industry trends. Competency in change management. Creative and collaborative culture. Rapid ability to adjust strategy and plans. .

2.0

Applications Management Assessment

Purpose: The assessment measures the maturity of an application organization's processes, not of the applications themselves.

Level 2 Repeatable: Processes are established in work teams or departments, but there is little consistency in approach across the application organization. There's not much cross activity definition; each discipline is conducted independently, like a stovepipe. Little proactive work is done to change or improve things.

Recommendations:

1. Manage projects from budget, commitment, and actual expense perspective.

2. Identify a Project Portfolio Manager

3. Engage in continuous improvement by focusing on the pain points. Cost, agility and responsiveness are typically at the forefront while reliability and usability are less commonly noted as pain points.

4. Establish Key Performance Indicators (KPI’s) and Operational Metrics. Example KPI’s: - % of post implementation reviews rated as “Good” or “Very Good” - % of systems uptime for which a group of specified “business applications” are unavailable during a given period of time.


5

Enterprise Assessment

Purpose: Enterprise Capacity to Leverage IT is a factor of the role IT plays in the organization, the predispositions and effectiveness of business and IT leaders, and the robustness of certain critical capabilities in the IT organization.

Level 2 Enabling: Enterprises expect IT to enable and potentially improve back-office business operations, but through an arm's length relationship. Top executives engage with IT leaders only as necessary to place orders for tools and solutions. CIOs are not engaged in business planning and focus on discovery processes to identify business demands as early as possible, instituting basic relationship management roles and rudimentary project management.

Recommendations:

1. Start the transformation by bringing performance management discipline and rigor to infrastructure and operations.

2. Improve IT's ability to operationally sustain the IT environment so applications and data are available as expected by the organization.

3. Improve IT's ability to deliver new capabilities and solutions through effective project management

Functional LEVEL 1

Enabling LEVEL 2

Contributing LEVEL 3

Differentiating LEVEL 4

Transformational LEVEL 5

The enterprise regards IT as a commodity most useful for cost-effective transaction processing. IT is a utility that efficiently delivers a limited set of core capabilities.

The enterprise is focused on continuous improvement. Business unit leaders independently leverage IT as and when they consider it necessary. IT reliably and predictably delivers technology services and solutions on demand.

IT is critical to achieving business performance goals. IT is engaged in addressing explicit business problems or opportunities. IT contributions to business performance are well understood.

Enterprise is committed to dominating its industry. IT is a source of agility and product/service innovation. IT collaborates with other disciplines like R&D, BPM, and OT to deliver new products, services , and differentiating operations.

Enterprise is on a path of continuous reinvention. IT is a primary driver of business model innovation. IT is leveraged to redefine markets and rules of competition. .

2.5


Final Diagnosis

Business processes depend on IT. When IT fails due to immature capabilities, business processes start

to breakdown and fail.

Maturity Assessment

Products and

Processes

Interviews and Surveys


5

24 – 36 Month Action Plan

1. Align ComIT with Organization i. Create VB’s first IT Strategic Plan

ii. Create Technology Architecture Roadmap based on IT Strategic Plan

iii. Empower/Enable Customers a) Mobile Data Computer Project

b) Development of Mobile Strategy

a) Mobile Device Management

b) Mobile Application Development

c) Opening Wireless in Conference Rooms

d) Create New Fiber Optic Communications Design

2. Operational Improvements i. Perform in-depth Benchmarking within the

Infrastructure & Operations and Applications and Portfolio Management Domains

ii. Proceed with Proposed Network Optimization Analysis

i. Motorola: $300,000 Analysis; No Charge to VB

iii. Establish KPI’s and Operational Metrics

iv. Standardize and invest in appropriate tools

v. Create divisional staffing and skills matrix

vi. Create divisional training programs

Assessment Maturity Level Score CIO 2- Enabling 2.4

Infrastructure & Operations 2- Committed 2.3

Project & Portfolio Management

2- Emerging Discipline 2.7

Business Continuity Management

1- Initial 1.5

Information Security 3 - Defined 3.2

Applications Management 2 - Repeatable 2.0

Enterprise 2 - Enabling 2.5

Checkup #1 - Customer Interviews One on One Small Groups

Checkup #2 - Environment Products Processes

Checkup #3 - Surveys Customer ComIT Members

Checkup #4 – Maturity Assessment IT Score Analyst Reviews


5

24 – 36 Month Action Plan

3. Management Improvements i. Hire new CTO

ii. Reduce Vacancy Rate

iii. Improve Budgeting: Planned vs. Actual

iv. Establish Bi-Monthly Operational Meetings

v. Strengthen the ComIT Business Center to become the centralized financial center






1- Initial 1.5









5

Initiatives Underway

1. Budget Improvements 1. Projected Planned vs. Actual – Lowest in Years

2. Lowest Vacancy Rate in two years

2. Management Improvements 1. Performance Management Program

2. Continuous Improvement Program Based on Maturity Model – To Be Done Yearly

3. Capacity Planning

3. Hire CTO • Interviews Completed March 21 and 22

4. Proposed Network Optimization Analysis • Motorola: $300,000 Analysis; No Charge to VB

5. Create New Fiber Optic Communications Design

6. New Direction for MDC CIP Project • No longer a one-to-one computer replacement

7. Developing a Mobile Strategy • Mobile Device Management Platform

• Mobile Application Development Cell

8. Creating Team Culture • New Budget Process

• Bi-Monthly Operational Meetings

• IT Score – Maturity Modeling






1- Initial 1.5









5

IT Strategic Plan

57

Strategy is about doing the right things; operations are about doing things right. As such, strategy defines the potential value of an enterprise, while operations are

about delivering on that potential.

Today’s new realities require continuous planning to ensure strategic fit with constantly changing business needs: Maximize demand and supply by balancing and integrating imperatives for

growth, optimization, and risk-taking. Do the right amount of things, with a level of investment commensurate with

expected return. Monitoring trends and drivers for impacts to ROI, time to market, capability

effectiveness and future business requirements. Engage in continual strategic planning processes, not simply once and-done

strategic plans, which are invariably outdated and forgotten.

A sustainable technology plan should address three fundamental questions: Demand: What does the business need and how will IT contribute? Control: How will business and IT balance opportunities for growth,

optimization, and risk-taking given changing demand conditions and with the appropriate investment in supply?

Supply: What capabilities will IT provide to meet demand?


5

Gartner Consulting IT Strategic Planning Approach

Business Capability Needs and IT Implications

Understand Business Demand

Strategy

Business Imperatives

IT Implications

Pro

ject

In

itia

tio

n

Exe

cuti

ve B

rie

fin

gs

Determine IT Direction

Vision

IT Imperatives

Operating Principles

Directional Guidance for IT

Determine Required Actions

IT Initiatives

Operating Model

Governance

Actions to Close Gaps

Develop Road Map

Programs

Timeline and Resources

Communication Plan

Three to Five Year Plan to Move Forward

2 3 4 5 6 1 7

Assess Capabilities

People

Process

Technology

Key IT Capability Gaps

Benchmark


Transforming ComIT Culture

59


Health Check

Documents

CIO Assessment...Checking the Vital Signs Checkup #4 – Maturity Assessment IT Score Analyst Reviews Checkup #3 - Surveys Customer ComIT Members Checkup #2 - Environment Products