Why We Miss the Planning Mark

We’ve all been there asking why we missed the signs while others saw them head-on and benefited in some way. This happens with financial investments (e.g. I should’ve sold before this recent meltdown like my good buddy did), business opportunities (e.g. I should’ve opened up a chain of coffee stores like Starbucks before Howard Shultz got to it), military strategy (e.g. we should’ve seen the attacks on Pearl Harbor and 9-11 coming and been better prepared to try and stop them) and other numerous “should’ve” moments—and no I’m not talking about that” I should’ve had a V8!”

Why do we miss the signs and misread information?

Obviously, these are important questions for IT leaders, enterprise architects and IT governance pros who are often managing or developing plans for large and complex IT budgets. And where the soundness of decisions on IT investments can mean technological superiority, market leadership and profitability or failed IT projects and sinking organizational prospects.

An article in MIT Sloan Management Review, Winter 2009, provides some interesting perspective on this.

“Organizations get blindsided not so much because decision makers aren’t seeing signals, but because they jump to the most convenient or plausible conclusion, rather than fully considering other interpretations.”

Poor decision makers hone in on simple or what seems like obvious answers, because it’s easier in the short-term than perhaps working through all the facts, options, and alternative points of view to reach more precise conclusions.

Additionally, “both individual and organizational biases prevent…signals from getting through” that would aid decision making.

How do these biases happen?

SUBJECTIVITY: We subjectively listen almost exclusively to our own prejudiced selves and distort any conflicting information. The net effect is that we do not fully appreciate other possible perspectives or ways of looking at problems. We do this through:

• Filtering—We selectively perceive what we want to and block out anything that doesn’t fit what we want to or expect to see. For example, we may ignore negative information about an IT investment that we are looking to acquire.
• Distortions—Information that manages to get through our mental and emotional filters, may get rationalized away or otherwise misinterpreted. For example, we might “shift blame for a mistake we made to someone else.”
• Bolstering—Not only do we filter and distort information, but we may actually look for information to support our subjective view. For example, “we might disproportionately talk to people who already agree with us.”

GROUPTHINK: “a type of thought exhibited by group members who try to minimize conflict and reach consensus without critically testing, analyzing, and evaluating ideas.” (Wikipedia)

“In principle, groups should be better than individuals at detecting changes and responding to them. But often they are not, especially if the team in not managed well, under pressure, and careful not to rock the boat.”

Interestingly enough, many IT investment review boards, which theoretically should be helping to ensure sound IT investments, end up instead as prime examples of groupthink on steroids.

Concluding thoughts:

If we are going to make better IT decisions in the organization then we need to be honest with ourselves and with others. With ourselves, we need to acknowledge the temptation to take the simple, easy answer that is overwhelmingly directed by personal biases and instead opt for more information from all sources to get a clearer picture of reality.

Secondly, we need to be aware that domineering and politically powerful people in our organizations and on our governance boards may knowingly or inadvertently drown out debate and squash important alternate points of view.

If we do not fairly and adequately vet important decisions, then we will end up costing the enterprise dearly in terms of bad investments, failed IT projects, and talented but underutilized employees leaving for organizations where different perspectives are valued and decisions are honestly and more comprehensively vetted for the betterment of the organization.

If we shut our ears and close our eyes to other people’s important input, then we will miss the planning mark.

Why We Miss the Planning Mark

Challenges of a Change Agent

I have always been fascinated by leadership and how to grow an organization in spite of a broad variety of obstacles to change and maturity.

Indeed, as I have studied, read, watched, and practiced leadership and change initiatives for over two decades, I am always intrigued at the role of the change agent.

Certainly, it is hard to be a change agent for so many reasons. It is hard to change yourself let alone to get others to change. It is hard to exist in an environment where you see new and different possibilities, but others see only their way or the highway. It is hard to see others jockey for power and revel in the humiliation and shame of their peers. Change is only for the strong-hearted.

It’s interesting to me that change agents are often alone in the enterprise. They are specifically brought in fix highly ingrained problems that very often culturally rooted and that are damaging to the continuing maturation and success of the enterprise. But the change agent is coming in with “fresh eyes” and accompanying toolkit of best practices from outside the insular dynamics of the dysfunctional organization.

But the change agent is alone, or relatively so as they may be others who are “bucking the trend,” to try to bring a new openness and flexibility to the stagnant corporate culture and decaying ways of doing business that descend like death over complacent or arrogant organizations that think that once on top of the world, always on top.

Applause to the organizational leaders who are aware of processes, products, and ways of thinking that are broken and recognize the need for change and attract the agents of change and agility.

But the change agents run against the tide. They are new and are viewed as not knowing anything about the organization. Moreover, they are perceived as a danger to the comfortable long-standing held beliefs and ways of doing things. And moreover, they are seen as a threat to the incumbents. So from the incumbents perch, the change agents need to be shamed, humiliated, thwarted at almost any cost. And the change resisters in the established hierarchy “revel” in every obstacle they throw up.

There is an interesting article in the Wall Street Journal, 21-22 March 2009 about a website where people “revel in each other’s humiliation.”

The French site www.viedemerde.fr has 70,000 readers and it has “become a phenomenon in France…it receives a thousand or so new stories a day from which three young men who run it pick a dozen or so to post…the site now has 7,200 vignettes picked from nearly 400,000 sent in.”

It started a couple of years ago by the founder who “started posting stories online about the frustrations of modern life.”

The stories of life difficulty that are shared and read by others is closely aligned with Schadenfreude, a German word which means “One’s person’s misfortune is another’s happiness.” Or another version for the popularity of the site is that “one person’s misfortunes reassure another.”

Whichever explanation you adhere to for the popularity of people posting and reading about other people’s misfortunes and shame, points to people’s need to open up and release thoughts and feeling that are shameful and painful; people have a need to share, commiserate, and gain acceptance and to know that they are not alone.

Now there is an English language version of the popular website www.fmylife.com and “stories are flooding in. But the content is often similar. ‘It’s like there is a kind of solidarity among all countries when it comes to misfortune. We are all in a big, international pile of crap—but we’re in it together.”

The enterprise, its diehard stalwarts, and the change agents are also in it together. And they will either sink or swim. Hopefully, they decide on the latter.

Challenges of a Change Agent

Leadership Should Integrate Spirituality and Mission

I remember learning in religious day school that people are half spiritual beings and half animal and that it was a person’s duty (or test in life) to imbue the carnal part of our existence with spirituality.

It was nice to see a book today that brought this topic home; it is called “G-d is My CEO” by Larry Julian.

The premise of the book is that “we usually want to do the right thing, but often succumb to the short-term, bottom line demands of daily business life.”

Julian states: “The bottom line had become their G-d. It was insatiable. No matter how hard they worked, it was never enough, nor would it ever be enough.”

As I see it, people have two faces (or more) and one is their weekend persona that is family and G-dly oriented and the other is the one for the rest of the week—for business—that is driven by materialism, accomplishment, and desire for personal success.

This is where the test of true leadership comes into play.

We can and must do better in our business lives by “doing the right thing regardless of the outcome” and “expanding the definition of success from making money to making a difference.”

BUT, BUT, BUT…

We’re all experts at making excuses, why we need to be successful in business, achieve results, make lots of money, get the next promotion (and the next and the next) and that “the end justifies the means; you get to the outcome regardless of how you accomplish it”!

In Information Technology, it’s no different than in any other business function. It’s a competitive environment and most of the time, people’s raw ambitions are somewhat obscured (but still operating there) and occasionally you see the worst come out in people—not working together (like system operating in stovepipes), or worse criticizing, bad-mouthing, and even back stabbing.

As a CIO or CTO, we must rise above this and lead by a different set of principles. To this end, I like the “Servant Leadership” doctrine put forward by Julian.

In short, the servant leader, leads by example and puts people first and in essence, spiritually elevates the baser ambitions of people.

The servant leader is “one who serves others, not one who uses others. He/she “serves employees so they can serve others.”

“When we [as leaders] serve others, we help them succeed” and thereby we can accomplish the mission even better than pure individual greed ever could.

WOW!

The CIO/CTO can lead people, modernize and transform the enterprise with innovation and technology, to accomplish the mission better than ever and we can do it by integrating spirituality and kindness to people into what we do every day in our working lives.

Unfortunately, IT organizations are often run not by elevating people and making them significant, but instead by running them into the ground. The mission is demanding the latest and greatest to stay competitive. The technology is changing rapidly. IT specialists are challenged to keep up with training on new hardware, programming languages, systems development and project management techniques, best practice frameworks, and so forth, The Help Desk and Desktop support people are routinely yelled at by the customers. Security and privacy issues are a constant threat to operations. IT is denigrated as a support function, whose people don’t understand the business; IT is viewed as a utility and it’s people often pushed out for outsourcing.

Truly, in this type of demanding and challenging environment, it is tough for any IT organization and its people to maintain their dignity and spirituality. But that is precisely where the CIO/CTO must lead and demonstrate humanity and care for people. The true IT leader will impose structures to create order out of chaos and in so doing elevate people as the critical asset they truly are to the organization.

Here’s some ways we can do this:

1. Treat all employees with respect and dignity by representing their interests in the organization, as well as abiding by at the very least minimal standards of professionalism and courtesy
2. Partner with the business so that it’s not us versus them, but just one big US.
3. Develop a meaningful architecture plan and sound IT governance so everyone understands the way ahead and is working off the “same sheet of music.”
4. Manage business expectations—don’t overpromise and under deliver, which leads to frustration and anger; instead set challenging but attainable goals.
5. Filter requirements through a “single belly button” of seasoned business liaisons, so that the rank and file employees aren’t mistreated for doing their sincere best.
6. Provide training and tools for people to do their jobs and stay current and understand not only the technology, but the business.

Through these and other servant leader examples, we can integrate our spiritual and material lives and be the types of leaders that not only deliver, but that we can really be proud to be.

Leadership Should Integrate Spirituality and Mission

Bridging the Business and IT Divide

Leadership is all about people. In the simplest terms, you can’t be a leader without followers. And to inspire and motivate people to follow, you need a clear vision and the ability to articulate it. Moreover, leaders need to be professionally and technically competent; they need to understand their industry and the competitive environment, and be able to effectively engage decision makers, subject matter experts, and employees across the enterprise and stakeholders outside of it.

For a CIO, leadership can be even more challenging because of the balance needed between the business and technical aspects of job and the need to communicate to those two communities in their respective languages and to be able to translate between them. Often, sitting in meetings I see the best intentioned IT folks often talking techie “right past” their business counterparts and the business folks discussing mission to IT people who may never have been outside the confines of the IT environment.

As the CIO, it’s key to bridge the divide and help the business and IT communities in the organization work together and learn to speak and understand each other. Only this way, can the IT folks understand the business requirements and the business folks understand the technical solutions being proposed.

To accomplish this, the CIO should have the business and IT people work together in integrated project teams (IPT’s), tiger teams, task forces, and so on to accomplish IT projects, rather than the business just being consulted at the beginning of the project on the requirements, and handed a “this is what we thought you wanted” deliverable at the end.

Further, the CIO should appoint business liaisons or customer relationship managers to routinely work with the business, understand their needs and work to address them—until completion and satisfaction. The business liaisons need to “own the customer” and should not just be a pass-through to the help desk with no follow up, closure, or performance measurement

Where appropriate, I think it is even a good idea to collocate the business and IT people together, rather than in their separate fiefdoms and functional silos to so they really become a cohesive team—sharing business and IT knowledge and working together to implement an IT enabled business.

Of course, the CIO should encourage training, field trips, work details, and other cross-pollinating initiatives.

Finally, a robust enterprise architecture and IT governance helps to effectively bring the business and IT people together to jointly build the plan and make the decisions, so that it is not one side or the other working in a vacuum or imposing little understood requirements or solutions on the other.

In the book, The New CIO Leader by Boardbent and Kitzis, one of the basic premises is that “every CIO will follow one of two paths:” as follows:

--either they will be a “chief technology mechanic,” narrowly focused on IT to the exclusion of the business.

- or they will be a “new CIO leader,” where “IT is at the heart of every significant business process and is crucial to innovation and enterprise success.”

To be the new CIO leader, and truly integrate IT into the very fabric of the mission, you need to “weave business and IT strategy together” and also integrate the business and IT people to work effectively together.

Of course, this starts with building a high-performing IT organization, but must also involve regularly reaching out to the business at every opportunity and including them as full partners in build effective and efficient enterprise architecture planning, IT governance, and full systems life cycle execution.

In my opinion, the new CIO leader, does not think just IT, but lives and breathes the business and does everything in their power to bring the two not just in alignment, but in true partnership.

How important is this?

As Broadbent and Kitzis state: “If you don’t think like a constantly ‘re-new-ing’ CIO, you may be on our way to becoming an ex-CIO.

Bridging the Business and IT Divide

What It Means to Get Madoff-ed

"Saying he was 'deeply sorry and ashamed,' Bernard Madoff pleaded guilty Thursday to pulling off perhaps the biggest swindle in Wall Street history and was immediately led off to jail in handcuffs to the delight of his seething victims. Madoff, 70, could get up to 150 years in prison when he is sentenced in June." -Associated Press

In enterprise architecture, defining data terms and usage is very important. So everyone is talking the same language!

Well with Bernie Madoff's plea of guilt to all 11 charges against him today involving a $50 billion Ponzi scheme (named after another financial crook), I believe are witnessing the birth of a new word in the English lexicon.

Here on in, Madoff will mean:

-verb
to swindle, cheat, defraud, deceive.

-noun
a person who swindles, cheats, defrauds, and deceives.

Congratulations Bernie, you lousy Madoff!

Another way to think of this new word...he MADe OFF with a lot of people's hard-earned money.

What It Means to Get Madoff-ed

We Need A Grand Vision—Let It Be Smart!

We can build systems that are stand-alone and require lots of hands-on monitoring, care, and feeding or we can create systems that are smart—they are self-monitoring providing on-going feedback, and often self-healing and they help ensure higher levels of productivity and up-time.

According to the Wall Street Journal, 17 February 2009, smart technology is about making systems that are “intelligent and improve productivity in the long run…they [makes use of] the latest advances in sensors, wireless communications and computing power, all tied together by the Internet.”

As we pour hundreds of billions of dollars of recovery funds into fixing our aging national infrastructure for roads, bridges, and the energy grid—let’s NOT just fix the potholes and reinforce the concrete girders and have more of the same. RATHER, let’s use the opportunity to leap forward and build a “smarter,” more cost–effective, and modernized infrastructure that takes us, as nation, to the next playing-level in the global competitive marketplace.”

- Smart transportation—the “best way to fight congestion is intelligent transportation systems, such as roadside sensors to measure traffic and synchronize traffic lights to control the flow of vehicles…real time information about road conditions, traffic jams and other events.” Next up is predictive technology to tell where jams happen before they actually occur and “roadways that control vehicles and make ‘driving’ unnecessary.”

- Smart grid—this would provide for “advanced electronic meters that send a steady stream of information back to the utility” to determine power outages or damage and reroute power around trouble areas. It also provides for consumer portals that show energy consumption of major appliances, calculate energy bills under different usage scenarios and allow consumers to moderate usage patterns. Additionally, a smart grid would be able to load balance energy from different sources to compensate for peaks and valleys in usage of alternative energy sources like solar and wind.

- Smart bridges—this will provide “continuous electronic monitoring of bridges structures using a network of sensors at critical points.” And there are 600,000 bridges in the U.S. As with other smart technologies, it can help predict problems before they occur or are “apparent to a human inspector…this can make the difference between a major disaster, a costly retrofit or a minor retrofit.”

Smart technology can be applied to just about everything we do. IBM for example, talks about Smart Planet and applying sensors to our networks to monitor computer and electronic systems across the spectrum of human activity.

Building this next level of intelligence into our systems is good for human safety, a green environment, productivity, and cost-efficiency.

In the absence of recovery spending on a grand vision such as a cure for cancer or colonization of Mars, at the VERY least, when it comes to our national infrastructure, let’s spend with a vision of creating something better—“Smarter”--for tomorrow than what we have today.

We Need A Grand Vision—Let It Be Smart!

6 CIO Tools for Managing IT Risk

“The consequences of not managing risk have hit Americans square in the jaw.”-- Government Executive magazine, March 2009

Too often CIOs see themselves very literally as managing IT. What they need to do is manage risk along with all of the other key leadership issues such as innovation, information-sharing, collaboration, and so on.

Context

The IT environment today is part of a larger social, political, and economic context that is more fraught with risk than ever. The mortgage meltdown, the financial crisis, job losses, volatility in commodity prices (e.g. oil), and so much more—it seems like it will never end. I would add that recently we had birds collide with an airline in NY, satellites that collided in space, and submarines that collided from France and the U.K. Oh, let’s not forget Russia’s invasion of Georgia and the terrorist attacks in India in November that killed at least 173 and wounded 308 and the Asian Tsunami in 2004 that killed over 225,000 people from 11 countries.

This is scary beyond belief!

Is G-d punishing us, teaching us, ignoring us?

Expectations

Whatever is going on, people are crying out for help--they are praying, and they are also turning to their government for “recovery” (as in the Recovery Act), “bailout” (as in taxpayer bailout), “relief” (as in the Troubled Asset Relief Program). The CIO is operating in an environment in which risk management is increasingly something that the average citizen expects from their leaders (and IT is not immune):

--“Citizens are increasingly calling on government to prevent bad things from happening and to ride in to help when they do.” (Donald Kettl).

--“American want life to be less risky…[and so] without realizing it, federal officials are risk managers at their core.”

--“The public, not only demands that the government manage the consequences of risk, but that it deals with problems before they turn into catastrophes. Merely reacting to risk is eroding the people’s trust in government.”

Challenges

While risk management is clearly a critical need, it is also more difficult than ever, for the following reasons:

--Pace and impact—“the problem now is the rapid pace of the challenges—that whatever it is that happens punishes and punishes instantly.”

--Scope—“’we obviously don’t want to get to a state where the government is running everything.’ But with no clear definition of the limit, the number of public risks the government should manage appears endless.”

In my opinion, cost is a huge factor as well. Just the financial crisis so far has cost us trillions of dollars and added to our debt probably for generations to come, and at a time when we are already on the brink with unfunded social security and Medicare liabilities for the baby boomers that are quickly nearing retirement and is feared will overwhelm the system. How much more financial burden can the system take before there are dire consequences?

Framework

There are no easy answers to these trying times or to how we manage the incredible risk that we seem to face virtually every day. However, there are three common approaches to risk management set forth by Moss:

--Reduce it (or eliminate it, if possible)

--Spread it

--Shift it

We often reduce risk, by having a backup plan (such as in IT having backup and recovery), and we mitigate risk by spreading or shifting it (such as through insurance policies or government social programs, and so forth).

6 Tools for CIOs

These lessons in risk management are critical to professionals in information technology, a field that is always in rapid transition with changing products, skill sets, and practices and where the scope of IT impacts almost everything we do (from online finance, health IT, e-commerce, robotics, and more). And where the price of keeping up with Jones in technology is does not come cheap to any organization these days.

In IT, where more than half of projects are over budget or behind schedule and many end up cancelled all together, we need to manage project risk. Here is a suggested toolkit for CIOs to do so:

--First, we need an architecture plan to ensure that we are aligning to business requirements and complying with technical requirements. This helps reduce the risk that we are doing IT the “wrong” way.

--Second we need to have sound IT governance to manage the selection of our investments, the control of cost, schedule, and performance, and the evaluation for lessons for the future. This helps reduce and spread the risk that we are doing the “wrong” IT investments.

--Third, we need solid project management to guide projects from initiation through close out in a defined, repeatable, and measureable way. This helps reduce the risk that we doing projects the “wrong” way.

--Fourth, we need robust IT security that protects our data from manipulation, interception, interjection, or other malice. This helps reduce and spread the risk of our IT working “wrong”.

--Fifth, we need adept customer relationship management so that we are fully engaged with our customers in building solutions that meet their needs and solves their business problems. This helps spread and shift the risk that we are managing our IT customers the “wrong” way.

--And sixth, and not least, we need to focus on our human capital to ensure they have the leadership, motivation, tools, and training to perform at their peak. This helps reduce and spread the risk of human error.

Together, these six CIO tools are the keys to the kingdom when it comes to managing IT risk and we can never take risk management for granted.

6 CIO Tools for Managing IT Risk

Cybots to the Rescue

In the Star Trek series Voyager, the (cyb)Borg wants to assimilate everyone (literally every species and they are given numbers to keep track of them) throughout the galaxies into their collective. They are an existential threat to humankind. And it makes for some great science fiction entertainment.

In real life though, the cybots are coming not to harm, but to help people.

Government Computer News, 23 February 2009, reports that Oak Ridge National Lab is working on developing cybots (software robots) to defend us in cyberspace.

Cybots are “intelligent enough to cooperate with one another to monitor and defend the largest networks.”

What makes cybots more effective than the software and hardware security we have today?

“Instead of independent devices doing a single task and reporting to a central console, the cybots would collaborate to accomplish their missions.”

The end state is a virtual cybot army deployed so those seeking to do us harm in cyber-warfare will themselves be the ones for whom “resistance is futile”.

Could cybots end up like the the Cylones in Battlestar Galactica or the machines in Terminator that turn on humans?

The Cybots have a programmed mission such as “network monitoring and discovery, intrusion detection, and data management.” So the hope is that they stay true to those things.

However, to me it seems completely plausible that just as cybots can be developed for defensive capabilities, they can also be programmed for offensive cyber warfare. And if they can be used offensively, then we can end up on the wrong side of the cybots someday.

Where does this leave us?

It seems like cyberspace is about to get a whole lot more complicated and dangerous—with not only human cyber-criminals and –warriors, but also cyber robots that can potentially wreak Internet havoc.

In terms of planning for future IT security, we need to stay technologically on the cutting edge so that we stay ahead of our adversaries as well as in constant control of the new defensive and offensive cyber-weapons that we are developing.

Cybots to the Rescue

It’s Time to Invest in The Cloud

Cloud computing is "shorthand for centralized computing services that are delivered over the Internet (a.k.a. the 'cloud')."

Cloud computing is to traditional computing as electricity is to rubbing two twigs together to make a fire. Ok. That’s a little bit of an exaggeration, but not by much.

Years ago, people made a fire in their home or workspace which they continually fed to get warmth, lighting, and cooking; now they get these from centralized utilities that distribute it to them on an as needed basis. It’s a lot more efficient that way!

With cloud computing—it’s very similar. Currently, we have our own computing resources (like a hearth and firewood) that we must purchase and regularly maintain to do basic information technology processes for transaction and analytical processing, information sharing and collaboration. Now, we can get these functions from centralized computing facilities or data centers that distribute them, as needed on a subscription or metered basis. This gives us a predictable, stable source of computing at reduced prices, delivered via the Internet, when we want and need it, and without the hassle of having to purchase and maintain the hardware and software infrastructure. It’s a user-centric model!

Most of us with very busy and already complex lives inherently understand and are drawn to a model that is convenient and cost-effective. Flip on the switch and voila—lights/heat in one case or email, e-Commerce, and online entertainment in another.

To me, if its not a mission-specific or highly sensitive application, the question is why shouldn't it be in the cloud?

Fortune Magazine, 2 March 2009, on the rise of cloud computing juggernauts like Salesforce “a public company with a market capitalization of $3.5 billion, generates revenue of more than $1 billion a year—a 60% five-year annual growth rate—all from providing software subscriptions to business.”

Marc Benioff, their CEO says “We’ve always believe everything’s going into the cloud.”

Even detractors, like Larry Ellison, the CEO of Oracle, has helped fund Saleforce and another major cloud computing vendor, NetSuite. Moreover, “Oracle at the end of January lauched a new version of its online sales-management product…CRM on Demand” —so you see where Mr. Ellison is strategically placing some of his chips.

What about the other major application vendors?

“SAP said it would be releasing a software-as-a-service product in May…and Microsoft also has customer-management software available. IBM just named a cloud computing czar, and Google and Amazon are launching ambitions initiatives.”

So what’s holding up the transition?

Generally, the biggest cited obstacle to moving to cloud computing is security. Yet, “Salesforce has recorded only one security breach, a phishing attack in November 2007.” Moreover, because of the scope, scale, resources, and expertise that these vendors have, they can actually deploy and maintain a level of security that other organizations may only dream of.

Never-the-less, “companies remain committed to owning and hosting their own software and despite the tough economic times, they are loath to try something new, especially if it means making additional investments, however meager.”

But in the end “cost cutting and convenience are expected to prompt more firms to rent software that will be delivered over the Internet cloud.” IDC projects that by the end of 2009, “76% of U.S. organizations will use at least one web-delivered application for business use.”

Further, according to research firm, Gartner, "of the approximately $64 billion spent on business applications in 2008, about 10% or $6.4 billion, was spent on applications housed remotely and delivered via the Net."

The writing is on the wall or should I say in the cloud!

It’s Time to Invest in The Cloud

Lessons from Space for CIOs

There are no CIOs in space. At least not yet. Someday, as we colonize space, there will be. And information technology will be more important then ever as communications, information sharing, collaboration, and new ways of doing things enable people to live and work in distances that are now just the realm of science fiction.

As I read about space tourism in MIT Technology Review, January/February 2009, I realized there are already lessons for CIOs from space travel even in its nascent stages.

• Modernize, as needed—as technologists, some erroneously think that everything has to be swapped out and modernized every few years (for example, many organizations are on na 3 year refresh cycle—whether they need it or not!), but the Russian space program teaches us differently. They modernize, not on a fixed time, but rather as needed. They work by the principle “if it’s not broken don’t fix it.” Here’s an excerpt: “You can look at the original Soyuz, and the same physical design—same molds, even—appear to have been used throughout its history…But anything that has ever gone wrong or failed, they fix. Or if there is some new technology that comes along that would be of significant benefit, they change it also. Isn’t this a novel principle that we can adapt for sound IT investment management?


• Functional minimalism--for many organizations and individuals, there is a great desire to have the latest and greatest technology gadgets and tools. Some call these folks technology enthusiasts or cutting-edge. And while, IT is incredibly exciting and some missions really need to be cutting-edge to safeguard lives for example. Many others don’t need to have a closet with one of every software package, hardware gadget, or new tool out there. I’ve seen mid-size organizations that literally have thousands of software products—almost as many as people in the entire company! However, on the Russian Soyuz space vehicle, we see a different way. One space tourist noted: “It’s sort of a functional minimalism.” You don’t need tons of gadgets, just what is operationally necessary. CIO’s, as IT strategists and gatekeepers for sound IT investing, should keep this principle in mind and spend corporate investment dollars wisely, strategically, and with careful selection criteria. We don’t need one of everything, especially when half of the investments are sitting in a closet somewhere collecting organizational dust!


• Technology is 3-D—Our IT environment is still mostly stuck in a two-dimensional paradigm. Our user-interfaces, controls, and displays are still primarily flat. Of course, many have conceived of IT in a more real three-dimensional portrayal for example using 3-D graphics, modeling and simulation, holograms, virtual controls, and even virtual world’s in gaming and online. As CIO’s, we need to encourage the IT industry to continue rapid transformation from a 2-D to 3-D technology paradigm. As a corollary, in space where there is little to no gravity such as on the International Space Station, “It is cluttered, but then after a while you realize, well that’s true if you’re thinking in 2-D, but once your brain shift to 3-D, you realize that it isn’t.”


• Think strategic and global—The CIO and his/her staff gets lot of calls everyday based on operational issues. From simple password resets to the dreaded “the network is down.” When firefighting, it is easy to fall into a purely operational way of thinking. How am I going to get this or that user back up. But getting all consumed by operational issues is counterproductive to long-term planning, strategy, and monumental shifts and leaps in technology and productivity. One space tourist looking out the window in space summed it up nicely for CIOs (and others) to get perspective: “You’re out there in space looking back at Earth, and in a way, you’re also looking back at your life, yourself, your accomplishments. Thinking about everything you own, love, or care for, and everything else that happens in the world. Thinking bigger picture. Thinking in a more global fashion.” Maybe every CIO need a picture window view from the Internation Space Station to keep perspective?

Lessons from Space for CIOs

Security Architecture Q&A

Recently, I was interviewed on the subject of Security Architecture and was given permission to share the Q&A:

In general, what kinds of information security issues does an organization face?

The overarching information security issue in any organization is one of communication, collaboration and the need for transparency vs. the need to protect information from being compromised. Information security is about more than just "stopping leaks." It is also about making sure that people don't intercept, interject or otherwise manipulate agency information for their own ends.

A related issue has to do with protecting the agency's critical IT infrastructure from physical or cyber attack. It's the age-old conflict: If you lock it down completely, then you're protecting it, but you also can't use it. And if you open yourself up altogether, then obviously it won't be long before somebody takes aim.

Finally, the largest threat to an organization's information is clearly from insiders, who have the "keys to the kingdom." And so one must pay great attention to not only the qualifications, but also the background, of the employees and contractors entrusted with access to IT systems. Additionally we must institute checks and balances so that each person is accountable and is overseen.

How do leaders demonstrate security leadership?

Leadership in the area of security is demonstrated in a variety of ways. Obviously the primary method for demonstrating the importance of this function is to formalize it and establish a chief information security officer with the resources and tools at his or her disposal to get the job done.

But security leadership also means building an awareness of risk (and countermeasures) into everything we do: education, awareness, planning, designing, developing, testing, scanning and monitoring.

When new applications or services are being planned and rolled out, does security have a seat at the table?

I can't imagine any organization these days that doesn't consider security in planning and rolling out new applications or services. The real question is, does the organization have a formal process in place to provide certification and accreditation for IT systems? By law, federal agencies are required to do this.

Would you say that information security is generally tightly integrated into organizational culture?

I think that a security mindset and culture predominate in professions where security is paramount, such as law enforcement, defense and intelligence, for obvious reasons.

But the larger question is, how would other organizations make the transition to a culture of greater information security? And this is actually a really important question in today's age of transparency, social networking, Web 2.0, etc., where so much information is freely flowing in all directions. One approach that I have adopted as a culture-changing mechanism is to treat key initiatives as products to be marketed to a target audience. The IT security professional needs to be a master communicator as well as a technical expert, so that employees not only grudgingly comply with necessary measures, but are actively engaged with, and support, their implementation.

At the end of the day, the organization's information security is only as strong as its weakest link. So security has to be as deeply ingrained into the culture and day-to-day operations as possible.

Is information security an inhibitor to new initiatives?

Information security is one of many requirements that new initiatives must meet. And of course there will always be people who see compliance as an inhibitor. But the reality is that security compliance is an enabler for initiatives to achieve their goals. So the key for IT security professionals is to keep educating and supporting their stakeholders on what they need to do to achieve success and security at the same time.

Security Architecture Q&A

Disruptive Technologies

When companies get cozy, the marketplace gets innovative and from out of nowhere...a disruptive technology upends things.

We've seen this happen countless of times in big ways.

In the auto industry, 50 years ago neither GM nor Ford would have ever dreamed that they would lose their virtual monopoly on the U.S. auto industry to foreign car companies that would dislodge them with compact vehicles and hybrid engine technologies.

More recently in the music industry, Apple seized the day by combining functionality, stylishness and price on their iPod player with an accessible online iTunes music store.

More generally, the whole world of e-Commerce has stolen much of the show from the brick and mortar retail outlets with internet marketing, online transaction processing, supply chain management and electronic funds transfer.

Now, another disruption is occurring in the computer market. For years, the computer industry has made every effort to provide more raw computing power, memory, and functionality with every release of their computers. And Moore’s law encapsulated this focus with predictions of doubling every two years.

Now, on the scene comes the Netbook—a simpler, less powerful, less capable computing device that is taking off. Yes, this isn’t the first time that we’ve had a drive toward smaller, sleeker devices (phones, computers, and so on), but usually the functionality is still growing or at the very least staying the same. But with Netbooks smaller truly does mean less capable.

Wired magazine, March 2009, states “ The Netbook Effect: Dinky keyboard. Slow chip. Tiny hard drive. And users are going crazy for them.”

How did we get here?

“For years now, without anyone really noticing, the PC industry has functioned like a car company selling SUVs: It pushed absurdly powerful machines because the profit margins were high, which customers lapped up the fantasy that they could go off-roading, even though they never did.”

So what happened?

“What netbook makers have done is turn back the clock: Their machine perform the way laptops did four years ago. And it turns out that four years ago (more or less) is plenty.”

“It turns out that about 95%...can be accomplished through a browser…Our most common tasks—email, Web surfing, watching streaming videos—require very little processing power.”

The netbook manufactures have disrupted the computer market by recognizing two important things:

1. Computer users have adequate computing power for their favorite tasks and what they really want now is more convenience and at a price that says buy me.
2. Cloud computing is no longer an idea full of hot air, but it is a technology that is here now and can do the job for consumers. We can get our applications over the web and do not have to run them on our client machines. We can afford to have computers that do less, because the cloud can do more!

The result?

Foreign companies are running away with the Netbook market. “By the end of 2008, Asustek had sold 5 million netooks, and other brands together had sold 10 million…In a single year, netbooks had become 7 percent of the world’s entire laptop market. Next year it will be 12%.”

“And when Asustek released the Eee notbook, big firms like Dell, HP, and Apple did nothing for months.” They were taken off guard by miscalculation and complacency.

The future?

Of course, the big boys of computing are hoping that the netbook will be a “secondary buy—the little mobile thing you get after you already own a normal size laptop. But it’s also possible, that the next time your replacing an aging laptop, you’ll walk away into the store and wonder, ‘why exactly am I paying so much for a machine that I use for nothing but email and the Web?’ And Microsoft and Intel and Dell and HO and Lenovo will die a little bit inside that day.”

Implications for CIOs?

• End complacency and always be on the lookout for disruptive technologies and ways of doing business. There is always a better way!
• Hardware becomes a commodity over time and supplying the infrastructure for the organization is moving the way that electricity generation did at the turn of the 20^th century—to outside vendors that can do it more effectively and efficiently.
• Cloud computing means that commonly used software applications are available over the internet and can be provide the foundation business functionality for the organization.

The important future value add from the Office of CIO is in IT strategy, planning, governance, and mission-focused solutions. We need CIOs that are true leaders, innovative, and focused on the business and not just on the technology.

Disruptive Technologies

No Choice But to Change

It’s easy to get into a rut and just follow the status quo that we’re used to.

People do it all the time. It’s doing what we know. It’s comfortable. It’s less challenging. It feels less risky. It doesn’t “cause waves” with various stakeholders.

Don’t we often hear people say, “don’t fix it, if it ain’t broke”?

Here’s another more arrogant and obnoxious version of the anti-change sentiment: “don’t mess with perfection!”

And finally, the old and tried and true from the nay-sayer crowd: “we tried that one before.”

Unfortunately, what many of these die-hard obstructionists fail to acknowledge is that time does not stand still for anyone; “Time marches on.” Change is a fact of life, and you can either embrace it or make a futile attempt to resist.

If you embrace it and moreover become a champion of it, you can influence and shape the future—you are not simply a victim of the tide. However, if you resist change, you are standing in front of a freight train that will knock you out and drag you down. You will lose and lose big: Change will happen without you and you will be run over by it.

In short, it is more risky to avoid change than to embrace it.

Therefore, as a leader in an organization, as The Total CIO, you have an obligation to lead change:

• to try to foresee events that will impact the organization, its products/services, its processes, its technology, and its people.
• to identify ways to make the most of changing circumstances—to take advantage of opportunities and to mitigate risks, to fill gaps and to reduce unnecessary redundancies.
• to develop and articulate a clear vision for the organization (especially in terms of the use of information technology) and to steer the organization (motivate, inspire, and lead) towards that end state.
• to course correct as events unfold; the CIO is not a fortuneteller with all knowing premonition. Therefore, the CIO must be prepared to adjust course as more information becomes available. Sticking to your guns is not leadership, its arrogance.
• to integrate people, process, technology, and information; the CIO is not siloed to technology issues. Rather, the CIO must look across the enterprise and develop enterprise solutions that integrate the various lines of business and ensures true information sharing, collaboration, and streamlined integration and efficiency. The CIO is a unifier.
• to institutionalize structured planning and governance to manage change. It’s not a fly by night or put your finger up to see which way the wind is blowing type of exercise. Change management is an ongoing programmatic function that requires clear process, roles and responsibilities, timelines, and decision framework.
• to bring in management best practices to frame the change process. Change is not an exact science, but we can sure learn from how others have been and are successful at it and try to emulate best practices, so we are not reinvesting the wheel.

Change is a fact of life, even if it is often painful.

I’d like to say that maybe it doesn’t have to be, but I think that would be lying, because it would be denying our humanity—fear, resistance, apathy, weariness, physical and mental costs, and other elements that make change difficult.

But while the CIO cannot make change pain-free, he can make change more understandable, more managed (and less chaotic), and the results of change more beneficial to the long term future of the organization.

No Choice But to Change

It's Not The Systems, Stupid

Being a CIO is not just about information technology—IT is a service. The real job of a CIO is truly understanding the IT needs of their customers (those who actually carry out the mission of the organization) and leading the IT people to fulfill those needs.

In essence, the CIO leads his IT staff to deliver on the mission needs of the organization. So being the CIO is far from being just a technical job; it is very much a people job.

To deliver IT then, the CIO must understand how to effectively lead and motivate his people.

There is a terrific book on this subject called “What People Want” by Terry Bacon that identifies 7 primary needs of people in work relationships and particularly how an effective leader can fulfill those needs and in so doing build a high performing workforce.

Here are the primary people needs in relationships:

TRUST—“the most fundamental relationship need. Without trust, there will not be much of a basis for a relationship at all.”
CHALLENGE/GROWTH—“with rare exception, people are not content in trivial, boring, or stagnant jobs…they need to feel that their work is challenging and that they are developing their skills, capabilities, and possibilities.”
SELF-ESTEEM—"appearance, intelligence, talents, autonomy, integrity, awards, titles, positions, job responsibilities, memberships in special groups, acceptance or recognition.”
COMPETENCE—“people want to be expert at something.”
APPRECIATED—“feel pride in who they are and be genuinely accepted for what they contribute.”
EXCITED—“people want to be energized and enthused…it’s more fun than the alternative.”
RELEVANT—“contributing to something they believe in.”

You’ll notice that monetary compensation and benefits are not mentioned here, because that’s not what this is about. Yes, we all need to be able to pay our bills at the end of the month, but beyond that we have basic human needs (trust, challenge, self-esteem…) that are fundamental to people being effective on the job through their interactions with others.

And indeed, every leader can become a better, more effective leader by understanding these relationship needs and developing their abilities to genuinely help people feel fulfilled on these.

For the CIO, I think it is very easy—too much so—to focus on technology. The field is technically intriguing, quickly changing, futuristic, and fundamental to mission. Intentionally or not, the CIO can easily overlook the people that are behind the technical solutions—those that he/she depends on to really tech-enable the organization (it’s not the systems, stupid).

CIOs, take care of your hard-working and talented people—develop their trust, provide challenging work, grow their self-esteem, help them to mature their competences, appreciate them, inspire and excite, and show them they are contributing to something important. And you and they will be more than the sum of the parts and deliver IT solutions to the organization that will truly amaze!

It's Not The Systems, Stupid

The Stimulus Plan and User-Centric Enterprise Architecture

Just something I am thinking about...

Per Wall Street Journal, 14-15 February 2008, Stimulus Plan = 1,073 pages.

Imagine this...alternative stimulus plan--one sentence: Give everyone a debit card for $2500 that is good for 3 months.

(That's per every man, women, and child in this country!)

Result: spending will be pervasive and immediate, jump-starting the stalled economy.

(This can still be supplemented by long-term infrastructure projects and national investments as appropriate.)

This point is that the enemy of problem-solving is over-complexity.

We start with a problem that is so complex almost no one can understand it. For example, the financial market melt-down was tied in large part to dizzyingly constructed financial instruments that confounded and some say manipulated, even the most sophisticated investors.

And the answer was developed to respond to the problem. Sure, a complex problem may deserve a multi-faceted and even a thousand page answer.

But, perhaps it is time to step out of the trees and look at the forest. Is it time for a little simplicity?

Even if the answer is ok, maybe it needs to be communicated simply and straightforwardly--it's got to be user-centric!

Obviously, the point is not to over-simplify and miss the mark, but do be direct and to draw a clear relationship between problem and solution. Have we done that?

The Stimulus Plan and User-Centric Enterprise Architecture

Reflections On The Role of a Federal Chief Technology Officer

Had interview today with Federal News Radio on the role of the Chief Technology Officer.

Here are some key points:

1. The CTO is a subject matter expert on technology modernization, transformation and deployment of new technology in the agency.

2. The CTO is responsible to work with the lines of business and IT to ensure that technology is meeting the needs of customers, that enterprise architecture and governance are in place, and that agency is incorporating best practices from all sources into technology operations.

3. The CIO's focus is on the business while that of the CTO is technology. Everything the CTO does is to support the CIO to operationalize his or her decisions and those of the senior leadership team. The CTO also serves as principal advisor to the CIO on IT management best practices, so that these get incorporated into the decision process.

4. A federal CTO would be a positive development because it will give a more prominent voice to the nation’s technology needs.

If there had been more time I would have added that in my view, the most important issue for a federal CTO is to address the need to raise the technology competitiveness of the United States. Technology is our future and we need to be number one.

Reflections On The Role of a Federal Chief Technology Officer

Change Agents--Poisoned or promoted?

Let’s fantasize for a moment about what it must be like to be an enterprise architect/change agent.

Here we go.

Our stereotypical organization, let’s call it ABC Company has a talented group of enterprise architects. They have worked hard, built partnerships, learnt the organization and its needs, and have done a remarkable job working with leadership, subject matter experts, and other stakeholders in identifying an accurate baseline, determining a promising target, and have helped the organization navigate a well thought out transition plan. The organization reaches its target—success—and the process continues.

Hooray for the architects. Praise and promotion be upon ABC company’s enterprise architects.

Wait. Not so fast. Let’s back up. Rewind and see what often really happens when architects or anyone else for that matter tries to change the status quo:

R—E—S—I—S—T—A—N—C—E!!

Research shows that change agents are often scorned by their organizations and their peers. In immature organizations that do not embrace constructive change, change agents like enterprise architects are often not looked upon favorably.

Remember what happened to Socrates more than two millennium ago (and countless others innovators, inventors, and thought leaders since)?

Strategy + Business Magazine, Issue 53, has an article called “Stand by Your Change Agent.”

The article states: “research shows that most transformation leaders go unpromoted, unrecognized, and unrewarded. And their companies suffer in the long run.”

In a study of 84 major change initiatives at Fortune 500 companies between 1995 and 2005, “some 70 percent of executives who led these major transformations went unrewarded or were sidelined, fired, or spurred to leave.”

Why are change agents treated adversely?

The research shows that “deep down, a great many people and organizations fear change. People do not like to move out of their comfort zones. Powerful institutional forces help maintain the status quo. In such companies, change simply has no constituency.”

In these change-averse organizations, change agents often “find their efforts impeded, undermined, or rejected outright. Change agents may also suffer from the delusion that others see the urgent need for action just as they do, and may be frustrated to discover how little key stakeholders care about the initiatives and outcomes they hold dear.”

What is the impact to companies that treat their change agents this way?

Both the companies and people suffer. Change initiatives remain unfinished. Investments do not see their payback. Highly talented change agents are lost. And worse, other potential leaders will think many times over before taking on a change effort that “could derail their careers.”

Well, which companies did best with change?

“Companies that scored highest in leadership development and embracing change were most likely to improve performance.”

The lesson is clear: If companies want to grow, mature, and improve performance, then they need leaders who are visionaries and change agents to step up to the plate.

Those organizations that recognize this truth will embrace their change agents—encourage, recognize, reward, promote, and retain them.

Talented and motivated change agents (like enterprise architects) are an organization’s best hope for innovation, energizing creative potential, and long-term organizational success.

Change Agents--Poisoned or promoted?

The Perilous Pitfalls of Unconscious Decision Making

Every day as leaders, we are called upon to make decisions—some more important than others—but all having impacts on the organization and its stakeholders. Investments get made for better or worse, employees are redirected this way or that, customer requirements get met or are left unsatisfied, suppliers receive orders while others get cancelled, and stakeholders far and wide have their interests fulfilled or imperiled.

Leadership decisions have a domino effect. The decisions we make today will affect the course of events well into the future--especially when we consider a series of decisions over time.

Yet leadership decisions span the continuum from being made in a split second to those that are deliberated long and hard.

In my view, decision makers can be categorized into three types: “impulsive,” “withholding,” and “optimizers.”

1. Impulsive leaders jump the gun and make a decision without sufficient information—sometimes possibly correctly, but often risking harm to the organization because they don’t think things through.
2. Withholding leaders delay making decisions, searching for the optimal decision or Holy Grail. While this can be effective to avoid overly risky decisions, the problem is that they end up getting locked into “analysis paralysis”. They never get off the dime; decisions linger and die while the organization is relegated to a status quo—stagnating or even declining in times of changing market conditions.
3. Optimizers rationally gather information, analyze it, vet it, and drive towards a good enough decision; they attempt to do due diligence and make responsible decisions in reasonable time frames that keep the organization on a forward momentum, meeting strategic goals and staying competitive. But even the most rational individuals can falter in the face of an array of data.

So it is clear that whichever mode decision makers assume, many decisions are still wrong. In my view, this has to do with the dynamics of the decision-making process. Even if they think they are being rational, in reality leaders too often make decisions for emotional or even unconscious reasons. Even optimizers can fall into this trap.

CIOs, who are responsible for substantial IT investment dollars, must understand why this happens and how they can use IT management best practices, structures, and tools to improve the decision-making process.

An insightful article that sheds light on unconscious decision-making, “Why Good Leaders Make Bad Decisions,” was published this month in Harvard Business Review.

The article states: “The reality is that important decisions made by intelligent, responsible people with the best information and intentions are sometimes hopelessly flawed.”

Here are two reasons cited for poor decision making:

• Pattern Recognition—“faced with a new situation, we make assumptions based on prior experiences and judgments…but pattern recognition can mislead us. When we’re dealing with seemingly familiar situations, our brains can cause us to think we understand then when we don’t.”
• Emotional Tagging—“emotional information attaches itself to the thoughts and experiences stored in our memories. This emotional information tells us whether to pay attention to something or not, and it tells us what sort of action we should be contemplating.” But what happens when emotion gets in the way and inhibits us from seeing things clearly?

The authors note some red flags in decision making: the presence of inappropriate self-interest, distorting attachments (bonds that can affect judgment—people, places, or things), and misleading memories.

So what can we do to make things better?

According to the authors of the article, we can “inject fresh experience or analysis…introduce further debate and challenge…impose stronger governance.”

In terms of governance, the CIO certainly comes with a formidable arsenal of IT tools to drive sound decision making. In particular, enterprise architecture provides for structured planning and governance; it is the CIO’s disciplined way to identify a coherent and agreed to business and technical roadmap and a process to keep everyone on track. It is an important way to create order of organizational chaos by using information to guide, shape, and influence sound decision making instead of relying on gut, intuition, politics, and subjective management whim—all of which are easily biased and flawed!

In addition to governance, there are technology tools for information sharing and collaboration, knowledge management, business intelligence, and yes, even artificial intelligence. These technologies help to ensure that we have a clear frame of reference for making decisions. We are no longer alone out there making decisions in an empty vacuum, but rather now we can reach out –far and wide to other organizations, leaders, subject matter experts, and stakeholders to get and give information, to analyze, to collaborate and to perhaps take what would otherwise be sporadic and random data points and instead connect the dots leading to a logical decision.

To help safeguard the decision process (and no it will never be failsafe), I would suggest greater organizational investments in enterprise architecture planning and governance and in technology investments that make heavily biased decisions largely a thing of the past.

The Perilous Pitfalls of Unconscious Decision Making