State-Wide Planning and State-Wide Planning and F INAL RE PORT - - PowerPoint PPT Presentation
OPE GA RE VI E W State-Wide Planning and State-Wide Planning and F INAL RE PORT Management of Information Management of Information Technology Technology JANUARY a r e port by 2006 the Offic e o f Pro g ra m E va lua tio n
a r e port by
the Offic e o f Pro g ra m E va lua tio n & Go ve rnme nt Ac c o unta b ility
F INAL RE PORT
JANUARY
OPE GA RE VI E W
OPEGA Interim Report: State-Wide Information Systems Management Slide 2
OPEGA Final Report: State-Wide Information Technology Management Slide 3
OPE GA Se e ks to Answe r the Que stion…
OPEGA Final Report: State-Wide Information Technology Management Slide 4
Q4 ‘05 Q1 ‘06 Q2 ‘06 Q3 ‘06 Q4 ‘06 Q1 ‘07 Q2 ‘07 Q3 ‘07 Q4 ‘07 Q1 ‘08 Q2 ‘08 Q3 ‘08 Q4 ‘08 Q1 ‘09 Q2 ‘09 Q3 ‘09 Q1 ‘10 Q1 ‘10 Q3 ‘10 Q4 ‘10
Inhe r ite d c ur r e nt c onditions F r
e 2005 Ne w OIT Manage me nt te am hir e d Se pt ‘05 F ully imple me nte d E nte r pr ise Or ganization 2008 - 2010 OPE GA/ JWI Risk Asse ssme nt Se pt-Nov ‘05
OPEGA Final Report: State-Wide Information Technology Management Slide 5
I T Risk Asse ssme nt
– Sta te ’ s histo ry re la te d to I T – Curre nt o rg a niza tio n a nd pla ns fo r I T – Ro le o f I T in g o ve rnme nt – Mo de ls a nd b e st pra c tic e s re la te d to the pla nning a nd ma na g e me nt o f I T in g o ve rnme nt
T a udito rs to c o nduc t Risk Asse ssme nt
OPEGA Final Report: State-Wide Information Technology Management Slide 6
ide ntifie d b y:
– F e de ra l GAO a nd OMB – NASCI O – Custo me r Ma na g e me nt Co mmunity F
GA c o mpa re d c urre nt Sta te situa tio n a nd pla ns to mo de ls
T , a n industry sta nda rd fra me wo rk fo r I T risk ma na g e me nt
invo lving 31 Sta te o rg a niza tio na l units
OPEGA Final Report: State-Wide Information Technology Management Slide 7
Government/Quality Objectives What are we trying to ac hie ve ? Risks or Threats to Achievement What c o uld go wro ng? Ho w like ly is it? What’s the po te ntial impac t? Controls Ho w do we pre ve nt it, de te c t it o r re duc e its impac t?
Hig h Risk L
Risk
L ike lihood Impac t
Exposure What’s the like liho o d and impac t with c o ntro ls in plac e ?
OPEGA Final Report: State-Wide Information Technology Management Slide 8
de live re d a de ta ile d re po rt o f the ir re sults to OPE GA in No ve mb e r 2005; re po rt b e c a me pa rt
GA’ s wo rking pa pe rs
inc lude d de ta ile d Risk Ma trix a nd re c o mme nde d 3 ye a r a udit pla n
O & ke y sta ff; a lso sha re d with GOC a s I nte rim Re po rt
e va lua tio n to de ve lo p finding s/ o b se rva tio ns fo r this re po rt
OPEGA Interim Report: State-Wide Information Systems Management Slide 9
OPEGA Final Report: State-Wide Information Technology Management Slide 10
OPEGA Final Report: State-Wide Information Technology Management Slide 11
*Enterprise Architecture Management *IT Investment Management IT Human Capital Management Organizational Structure Management Stra trategic Pl tegic Planning anning *Risk Management Business Continuity & Security Management Fiscal Management Process Process Te Technol nology Peopl People
Fig Figure 3 re 3. Re Relat lation
ship ip amon among g Mana Management nt Contro Controls, Peo , People, le, Proc Processes, and esses, and Techno chnolo logy gy
Modified from US Modified from US GAO GAO
*Knowledge Management Customer Relations Management
I nstitutio na l pra c tic e s, tha t b ring to g e the r pe o ple , pro c e sse s a nd te c hno lo g y to a c hie ve g o a ls, se rve a s hig h- le ve l ma na g e me nt c o ntro ls to mitig a te I T risks. Ma ine ’ s I T is imma ture in re g a rd to ma ny
pra c tic e s. *Be st pra c tic e mo de ls fo r the mo st unfa milia r pra c tic e s a re disc usse d in re po rt.
OPEGA Final Report: State-Wide Information Technology Management Slide 12
T de ve lo pme nt in e nviro nme nt o f ra pid te c hno lo g y c ha ng e ; dra stic c ha ng e s in po lic y a nd ma nda te s
e de ra l g o ve rnme nt funding o f I T g o e s dire c tly to Sta te a g e nc ie s to suppo rt spe c ific pro g ra ms
mpe tus fo r ve rtic a l inte g ra tio n re sulte d in I T
“silo -e d” in e a c h Sta te a g e nc y; I T re so urc e de c isio ns ma de a t a g e nc y le ve l
Vertical IS Silos
Figu Figure 4. IS In re 4. IS Integration tegration
Silos = Agency Data Arrows = IS Compatibility
Federal State Local Legislature Education DHHS Program DHHS Program Corrections
OPEGA Final Report: State-Wide Information Technology Management Slide 13
– Curta ile d c a pa c ity to pe rfo rm c o re sta te -le ve l func tio ns – Unc o ntro lle d e xpe nditure o n unc o o rdina te d c o ntra c ts; la c k o f inve stme nt in I S infra struc ture – I ne ffic ie nc ie s, duplic a tio n o f e ffo rts, a nd misse d
OPEGA Final Report: State-Wide Information Technology Management Slide 14
– L a c k o f me a ning ful fina nc ia l a nd ma na g e me nt info rma tio n – No e nte rprise -wide stra te g ic pla nning fo r I T – L a c k o f sta nda rd, Sta te -wide pro je c t ma na g e me nt pro c e sse s – Ag e nc ie s c o nsta ntly re a c ting to I T c rise s – E xpe nsive re tro fitting o f ne w syste ms – We a k c he c ks a nd b a la nc e s in a c q uisitio ns a nd c o ntra c t o ve rsig ht – E mplo ye e s ha mpe re d b y o ut o f da te syste ms o r pro b le ma tic ne w o ne s
OPEGA Final Report: State-Wide Information Technology Management Slide 15
OPEGA Final Report: State-Wide Information Technology Management Slide 16
– inte g ra te s re la tive ly inde pe nde nt I T “unive rse s” tha t ha d va rying re so urc e s a nd prio ritie s – mo ve s Sta te to wa rd I T struc ture tha t a llo ws pla nning & ma na g ing fro m a n “e nte rprise ” pe rspe c tive
OPEGA Final Report: State-Wide Information Technology Management Slide 17
OIT Resource Sharing
CIO Council IT Executive Committee
CIO
Enterprise Technology Services IT Strategies, Policies and Planning Agency IT Leadership Boards & Committees Statutory: InforME, GeoLibrary, MCJUSTIS, etc. Non-statutory: GIS Executive Committee, ISMG, Accessibility, etc. Partnerships with Agencies focused
services & projects supporting Agency business initiatives Delivery of Managed Services Enterprise Strategic IT Planning, Policies, Performance Management, and Project Management Oversight Resource management based on service level agreements and priorities of the Administration's leadership Office of Information Technology Final Draft - June 16, 2005 Overall OIT Model
OPEGA Interim Report: State-Wide Information Systems Management Slide 18
OPEGA Final Report: State-Wide Information Technology Management Slide 19
e e ps risks to a c c e pta b le le ve ls
State is c ur r e ntly e xpose d to unac c e ptable le ve l
e late d r isk
OPEGA Final Report: State-Wide Information Technology Management Slide 20
Some additional e le me nts ne e d to be adde d to OIT ’s Str ate gic Plan. E nte r pr ise doe s not c ur r e ntly inc lude Judic ial and L e gislative br anc he s.
OPEGA Final Report: State-Wide Information Technology Management Slide 21
L e gislatur e has no r e al me c hanism for suppor ting and ove r se e ing e nte r pr ise -wide IT str ate gic plan and tr ansfor mation
OPEGA Interim Report: State-Wide Information Systems Management Slide 22
OPEGA Final Report: State-Wide Information Technology Management Slide 23
OPE GA has 3 findings/ obse r vations r e late d to E AM
OPEGA Final Report: State-Wide Information Technology Management Slide 24
F inding
De sc riptio ns o f “a s is” a nd “to b e ” e nviro nme nts ha ve no t ye t b e e n de ve lo pe d.
Manage me nt Ac tion
OI T will c re a te de sc riptio ns o f “a s is” a nd “to b e ” e nviro nme nts with a ll a ppro pria te e le me nts inc luding se q ue nc ing ste ps. CI O will pro vide re g ula r upda te
a dviso ry b o die s.
OPEGA Final Report: State-Wide Information Technology Management Slide 25
F inding
Writte n po lic ie s a nd pro c e dure s a re e ithe r no n- e xiste nt, ina de q ua te o r inc o nsiste nt a c ro ss E xe c utive b ra nc h in a numb e r o f I T a re a s.
Manage me nt Ac tion
Sta nd a rdize d po lic ie s a nd pro c e dure s will b e de ve lo pe d, c o mmunic a te d a nd imple me nte d a c ro ss the e nte rprise . Hig h prio rity issue s first; o the rs a s time a nd re so urc e s pe rmit.
OPEGA Final Report: State-Wide Information Technology Management Slide 26
Obse r vation
E nte rprise a ppro a c h is c urre ntly fo c use d o n E xe c utive b ra nc h a nd do e s no t inc lude Judic ia l o r L e g isla tive b ra nc he s; so me impro ve me nt
re a lize d.
Re c omme ndations
A. Co nstitutio na l Offic e rs a nd re ps fro m Judic ia l a nd L e g isla tive b ra nc h sho uld a c tive ly pa rtic ipa te o n CI O Co unc il B. Judic ia l a nd L e g isla tive b ra nc he s sho uld e xplo re
with OI T
e g isla ture c o uld e sta b lish spe c ific g ro up to ma na g e E A a nd I T inve stme nt fo r who le sta te .
OPEGA Final Report: State-Wide Information Technology Management Slide 27
OPE GA has 2 findings r e late d to IM
OPEGA Final Report: State-Wide Information Technology Management Slide 28
F inding
Curre nt a c c o unting struc ture s a nd fina nc ia l pra c tic e s do no t pro vide vie w o f I T b udg e ts a nd e xpe nditure s a c ro ss the Sta te a s a who le , o r b y a ny spe c ific a c tivity, pro g ra m o r sta tute .
Manage me nt Ac tions
1. CI O will study fe a sib ility o f e sta b lishing I T a s a “pro g ra m” 2. CI O will initia te e ffo rt to mo dify a c c o unt c o de struc ture s 3. OI T is de ve lo ping ra te struc ture to re fle c t a c tua l c o sts
Re c omme ndation
Judic ia l a nd L e g isla tive b ra nc he s sho uld e xplo re e sta b lishing I T a s “pro g ra m”
OPEGA Final Report: State-Wide Information Technology Management Slide 29
F inding
De c isio ns o n I T inve stme nts ha ve no t b e e n ma de fro m a n e nte rprise pe rspe c tive o r b y a c e ntra lize d Sta te e ntity.
Manage me nt Ac tions
1. OI T ’ s e nte rprise a rc hite c ture will g uide I T inve stme nts 2. Pro po se d o r re q ue ste d c a pita l inve stme nts in I T will b e re vie we d a nd a ppro ve d b y OI T ’ s Pro je c t Re vie w Co mmitte e
OPEGA Final Report: State-Wide Information Technology Management Slide 30
OPE GA has 1 finding r e late d to RM
OPEGA Final Report: State-Wide Information Technology Management Slide 31
F inding
Risk a sse ssme nt fo und 1% o f I T e nviro nme nt hig hly c o ntro lle d; 11% sa tisfa c to rily c o ntro lle d a nd 88% with unde sira b le le ve l
una c c e pta b le le ve l o f I T
Spe c ific e xpo sure s a ddre sse d in o the r finding s a nd
indic a te ne e d fo r risk ma na g e me nt pro c e ss.
Manage me nt Ac tion
OI T will c o nstruc t risk ma na g e me nt pla n tha t b uilds o n risk a sse ssme nt re sults a nd wo rks to mitig a te prio rity risks. Pla n will inc lude
risk o n spe c ific pro je c ts.
Re c omme ndation
OPE GA sho uld e sta b lish sc he dule o f I T re vie w to inc lude in future wo rk pla ns.
OPEGA Final Report: State-Wide Information Technology Management Slide 32
OPE GA has 2 findings r e late d to PM
OPEGA Final Report: State-Wide Information Technology Management Slide 33
F inding
T he re ha s b e e n little e ffo rt to e nsure tha t individua ls ma na g ing I T pro je c ts, whe the r Sta te sta ff o r ve ndo rs, ha ve stro ng pro je c t ma na g e me nt c a pa b ilitie s.
Manage me nt Ac tions
1. OI T sta ff will b e e duc a te d in PM a nd will suppo rt a g e nc ie s 2. OI T will e sta b lish po lic y/ pro c e dure s re q uiring a g e nc ie s to e ng a g e OI T PMO b e fo re fo rmula ting syste m so lutio ns 3. OI T no w ha s re spo nsib ility fo r c o ntra c ting with ve ndo rs o n I T pro je c ts a nd will c o nside r PM c a pa b ilitie s during ve ndo r se le c tio n
OPEGA Final Report: State-Wide Information Technology Management Slide 34
F inding
Sta te o f Ma ine la c ks e ffe c tive Syste m De ve lo pme nt L ife Cyc le (SDL C) pro c e ss a nd a tte nda nt pro je c t ma na g e me nt me tho do lo g y.
Manage me nt Ac tion
OI T Pro je c t Ma na g e me nt Offic e ha s a do pte d T e n Ste p PM me tho do lo g y a nd will b e a do pting a SDL C me tho do lo g y
OPEGA Final Report: State-Wide Information Technology Management Slide 35
OPE GA has 3 findings r e late d to the se ar e as
OPEGA Final Report: State-Wide Information Technology Management Slide 36
F inding
Risk a sse ssme nt ide ntifie d we a kne sse s in physic a l a c c e ss se c urity c o ntro ls, pa rtic ula rly in re g a rd to Sta te ’ s prima ry da ta c e nte r.
Manage me nt Ac tions
OI T Se c urity Offic e r ha s de ve lo pe d a c tio n pla n to a ddre ss physic a l a c c e ss se c urity we a kne sse s in o rde r
a sso c ia te d with e a c h. Ac tio n pla n wa s sub mitte d to OPE GA o n Ja nua ry 9, 2006. De ta ile d a c tio ns a re de sc rib e d in OPE GA re po rt.
OPEGA Final Report: State-Wide Information Technology Management Slide 37
F inding
Syste m a c c e ss c o ntro ls do no t me a sure up to industry sta nda rds. Pro c e dure s a re ina de q ua te o r inc o nsiste ntly a pplie d a c ro ss e nte rprise ; fire wa ll rule s a re no t we ll do c ume nte d.
Manage me nt Ac tions
1. Ne w I T Se c urity Po lic y will c la rify tha t e sta b lishe d pa sswo rd po lic ie s a nd pro c e dure s a pply to who le E xe c utive b ra nc h 2. Pla ns a re b e ing de ve lo pe d to e nsure pa sswo rd po lic ie s a re e nfo rc e d a nd pa sswo rds a re e nc rypte d 3. I nde pe nde nt a udit o f fire wa ll rule s is pla nne d a nd sho uld pro duc e impro ve d do c ume nta tio n
OPEGA Final Report: State-Wide Information Technology Management Slide 38
F inding
Busine ss Co ntinuity Pla nning is ina de q ua te a c ro ss E xe c utive b ra nc h; Sta te ’ s a b ility to c o ntinue to pe rfo rm func tio ns a nd pro vide se rvic e s fo llo wing lo ss o r da ma g e to I S infra struc ture is a t risk.
Manage me nt Ac tion
OI T will fa c ilita te BCP b y:
de ntifying we a kne sse s
Sig nific a nt fina nc ia l a nd huma n re so urc e s re q uire d
Re c omme ndation
E a c h a g e nc y in a ll b ra nc he s o f Sta te g o ve rnme nt sho uld a lso de ve lo p its o wn BCP
OPEGA Final Report: State-Wide Information Technology Management Slide 39
OPE GA has 5 obse r vation r e late d to KM
OPEGA Final Report: State-Wide Information Technology Management Slide 40
Obse r vation
I na de q ua te a tte ntio n ha s b e e n g ive n to de sig ning info rma tio n syste ms tha t c re a te a c c o unta b ility a nd a re the mse lve s a c c o unta b le .
Manage me nt Ac tion
OI T will inve stig a te using kno wle dg e ma na g e me nt c o nc e pts inc luding :
pe rfo rma nc e da ta o n pro g ra ms
pe rfo rma nc e me tric s fo r info rma tio n syste ms
Re c omme ndation
L e g isla tive b o die s re spo nsib le fo r
imple me nta tio ns sho uld ta ke a n inte re st in syste m d e sig n
OPEGA Final Report: State-Wide Information Technology Management Slide 41
Obse r vation
Ab ility to c o mb ine da ta fro m diffe re nt so urc e s o r syste ms a c ro ss the e nte rprise is ve ry limite d. Sa me da ta is o fte n duplic a te d in se ve ra l syste ms.
Manage me nt Ac tions
1. OI T will de ve lo p da ta sta nda rds to b e g in c o difying c o mmo n da ta e le me nts a c ro ss multiple info rma tio n syste ms 2. Ne w syste ms will b e e va lua te d fo r c o mmo n da ta e le me nts tha t c a n b e sha re d o r a rc hite c te d a s a c o mmo n re so urc e ra the r tha n duplic a te d 3. OI T is inve stig a ting to o ls to a ssist in e xc ha ng ing da ta b e twe e n le g a c y syste ms
OPEGA Final Report: State-Wide Information Technology Management Slide 42
Obse r vation
Pro fe ssio na l de ve lo pme nt
T sta ff ha ve b e e n limite d b y re so urc e c o nstra ints thus limiting e xpo sure to ne w ide a s a nd te c hno lo g ie s tha t c o uld he lp ke e p Ma ine c urre nt.
Manage me nt Ac tions
OI T will fa c ilita te pro fe ssio na l de ve lo pme nt pro g ra m to ke e p te c hnic a l sta ff c urre nt a nd a ssure e me rg ing tre nds a re a ssimila te d to suppo rt the b usine ss.
OPEGA Final Report: State-Wide Information Technology Management Slide 43
Obse r vation
T he we a lth o f a c c umula te d kno wle dg e po sse sse d b y OI T sta ff ma y b e lo st a s the y c ho o se to re tire o r o the rwise le a ve sta te e mplo yme nt.
Manage me nt Ac tions
Suc c e ssio n pla nning a nd kno wle dg e tra nsfe r we re c o nside ra tio ns in hiring the initia l OI T e nte rprise ma na g e me nt te a m; this fo c us will e xte nd thro ug ho ut the e nte rprise
OPEGA Final Report: State-Wide Information Technology Management Slide 44
Obse r vation
T he Sta te ’ s I T is no t ye t b e ing we ll utilize d to sha re kno wle dg e a ro und pa rtic ula r to pic s.
Manage me nt Ac tions
OI T will wo rk to inc re a se use o f te c hno lo g y fo r info rma tio n sha ring o ve r time a nd a s re so urc e s pe rmit. OI T e xpe c ts to :
nve stig a te fe a sib ility o f a ppo inting a Chie f K no wle dg e Offic e r
a nd Pro duc t Ma na g e rs b e de sig na te d
te c hno lo g y fo r sha ring info rma tio n whe ne ve r
OPEGA Final Report: State-Wide Information Technology Management Slide 45
OPE GA has 2 obse r vations r e late d to this r isk
OPEGA Final Report: State-Wide Information Technology Management Slide 46
Obse r vation Po litic a l pro c e ss c re a te s risk tha t fre q ue nt sho rt-te rm le a de rship c ha ng e s will inte rfe re with lo ng - te rm stra te g ic pla nning fo r I T . CI O ma y c ha ng e a s e a rly a s Ja nua ry 2007.
Manage me nt Ac tion CI O ha s initia te d two pro ng e d a ppro a c h to mitig a te risk o f c ha ng e in le a de rship:
T ma na g e me nt te a m
stra te g ic pla n Re c omme ndation L e g isla ture sho uld furthe r mitig a te this risk thro ug h:
GA re vie ws
O to ha ve c e rta in q ua lific a tio ns
OPEGA Final Report: State-Wide Information Technology Management Slide 47
Obse r vation
L e g isla tive o ve rsig ht a c tivitie s de vo te d e xc lusive ly to the Sta te ’ s info rma tio n te c hno lo g y
a re a b se nt.
Re c omme ndations
A. L e g isla ture sho uld suppo rt a ny a c tio ns ta ke n to e sta b lish I T a s a “pro g ra m” B. L e g isla ture sho uld a ssig n re spo nsib ility fo r o ve rsig ht o f e nte rprise -wide I T to e ithe r:
a nd E ne rg y; OR
a nd L
OPEGA Final Report: State-Wide Information Technology Management Slide 48