We Need A Grand Vision—Let It Be Smart!

We can build systems that are stand-alone and require lots of hands-on monitoring, care, and feeding or we can create systems that are smart—they are self-monitoring providing on-going feedback, and often self-healing and they help ensure higher levels of productivity and up-time.

According to the Wall Street Journal, 17 February 2009, smart technology is about making systems that are “intelligent and improve productivity in the long run…they [makes use of] the latest advances in sensors, wireless communications and computing power, all tied together by the Internet.”

As we pour hundreds of billions of dollars of recovery funds into fixing our aging national infrastructure for roads, bridges, and the energy grid—let’s NOT just fix the potholes and reinforce the concrete girders and have more of the same. RATHER, let’s use the opportunity to leap forward and build a “smarter,” more cost–effective, and modernized infrastructure that takes us, as nation, to the next playing-level in the global competitive marketplace.”

- Smart transportation—the “best way to fight congestion is intelligent transportation systems, such as roadside sensors to measure traffic and synchronize traffic lights to control the flow of vehicles…real time information about road conditions, traffic jams and other events.” Next up is predictive technology to tell where jams happen before they actually occur and “roadways that control vehicles and make ‘driving’ unnecessary.”

- Smart grid—this would provide for “advanced electronic meters that send a steady stream of information back to the utility” to determine power outages or damage and reroute power around trouble areas. It also provides for consumer portals that show energy consumption of major appliances, calculate energy bills under different usage scenarios and allow consumers to moderate usage patterns. Additionally, a smart grid would be able to load balance energy from different sources to compensate for peaks and valleys in usage of alternative energy sources like solar and wind.

- Smart bridges—this will provide “continuous electronic monitoring of bridges structures using a network of sensors at critical points.” And there are 600,000 bridges in the U.S. As with other smart technologies, it can help predict problems before they occur or are “apparent to a human inspector…this can make the difference between a major disaster, a costly retrofit or a minor retrofit.”

Smart technology can be applied to just about everything we do. IBM for example, talks about Smart Planet and applying sensors to our networks to monitor computer and electronic systems across the spectrum of human activity.

Building this next level of intelligence into our systems is good for human safety, a green environment, productivity, and cost-efficiency.

In the absence of recovery spending on a grand vision such as a cure for cancer or colonization of Mars, at the VERY least, when it comes to our national infrastructure, let’s spend with a vision of creating something better—“Smarter”--for tomorrow than what we have today.

We Need A Grand Vision—Let It Be Smart!

6 CIO Tools for Managing IT Risk

“The consequences of not managing risk have hit Americans square in the jaw.”-- Government Executive magazine, March 2009

Too often CIOs see themselves very literally as managing IT. What they need to do is manage risk along with all of the other key leadership issues such as innovation, information-sharing, collaboration, and so on.

Context

The IT environment today is part of a larger social, political, and economic context that is more fraught with risk than ever. The mortgage meltdown, the financial crisis, job losses, volatility in commodity prices (e.g. oil), and so much more—it seems like it will never end. I would add that recently we had birds collide with an airline in NY, satellites that collided in space, and submarines that collided from France and the U.K. Oh, let’s not forget Russia’s invasion of Georgia and the terrorist attacks in India in November that killed at least 173 and wounded 308 and the Asian Tsunami in 2004 that killed over 225,000 people from 11 countries.

This is scary beyond belief!

Is G-d punishing us, teaching us, ignoring us?

Expectations

Whatever is going on, people are crying out for help--they are praying, and they are also turning to their government for “recovery” (as in the Recovery Act), “bailout” (as in taxpayer bailout), “relief” (as in the Troubled Asset Relief Program). The CIO is operating in an environment in which risk management is increasingly something that the average citizen expects from their leaders (and IT is not immune):

--“Citizens are increasingly calling on government to prevent bad things from happening and to ride in to help when they do.” (Donald Kettl).

--“American want life to be less risky…[and so] without realizing it, federal officials are risk managers at their core.”

--“The public, not only demands that the government manage the consequences of risk, but that it deals with problems before they turn into catastrophes. Merely reacting to risk is eroding the people’s trust in government.”

Challenges

While risk management is clearly a critical need, it is also more difficult than ever, for the following reasons:

--Pace and impact—“the problem now is the rapid pace of the challenges—that whatever it is that happens punishes and punishes instantly.”

--Scope—“’we obviously don’t want to get to a state where the government is running everything.’ But with no clear definition of the limit, the number of public risks the government should manage appears endless.”

In my opinion, cost is a huge factor as well. Just the financial crisis so far has cost us trillions of dollars and added to our debt probably for generations to come, and at a time when we are already on the brink with unfunded social security and Medicare liabilities for the baby boomers that are quickly nearing retirement and is feared will overwhelm the system. How much more financial burden can the system take before there are dire consequences?

Framework

There are no easy answers to these trying times or to how we manage the incredible risk that we seem to face virtually every day. However, there are three common approaches to risk management set forth by Moss:

--Reduce it (or eliminate it, if possible)

--Spread it

--Shift it

We often reduce risk, by having a backup plan (such as in IT having backup and recovery), and we mitigate risk by spreading or shifting it (such as through insurance policies or government social programs, and so forth).

6 Tools for CIOs

These lessons in risk management are critical to professionals in information technology, a field that is always in rapid transition with changing products, skill sets, and practices and where the scope of IT impacts almost everything we do (from online finance, health IT, e-commerce, robotics, and more). And where the price of keeping up with Jones in technology is does not come cheap to any organization these days.

In IT, where more than half of projects are over budget or behind schedule and many end up cancelled all together, we need to manage project risk. Here is a suggested toolkit for CIOs to do so:

--First, we need an architecture plan to ensure that we are aligning to business requirements and complying with technical requirements. This helps reduce the risk that we are doing IT the “wrong” way.

--Second we need to have sound IT governance to manage the selection of our investments, the control of cost, schedule, and performance, and the evaluation for lessons for the future. This helps reduce and spread the risk that we are doing the “wrong” IT investments.

--Third, we need solid project management to guide projects from initiation through close out in a defined, repeatable, and measureable way. This helps reduce the risk that we doing projects the “wrong” way.

--Fourth, we need robust IT security that protects our data from manipulation, interception, interjection, or other malice. This helps reduce and spread the risk of our IT working “wrong”.

--Fifth, we need adept customer relationship management so that we are fully engaged with our customers in building solutions that meet their needs and solves their business problems. This helps spread and shift the risk that we are managing our IT customers the “wrong” way.

--And sixth, and not least, we need to focus on our human capital to ensure they have the leadership, motivation, tools, and training to perform at their peak. This helps reduce and spread the risk of human error.

Together, these six CIO tools are the keys to the kingdom when it comes to managing IT risk and we can never take risk management for granted.

6 CIO Tools for Managing IT Risk

Cybots to the Rescue

In the Star Trek series Voyager, the (cyb)Borg wants to assimilate everyone (literally every species and they are given numbers to keep track of them) throughout the galaxies into their collective. They are an existential threat to humankind. And it makes for some great science fiction entertainment.

In real life though, the cybots are coming not to harm, but to help people.

Government Computer News, 23 February 2009, reports that Oak Ridge National Lab is working on developing cybots (software robots) to defend us in cyberspace.

Cybots are “intelligent enough to cooperate with one another to monitor and defend the largest networks.”

What makes cybots more effective than the software and hardware security we have today?

“Instead of independent devices doing a single task and reporting to a central console, the cybots would collaborate to accomplish their missions.”

The end state is a virtual cybot army deployed so those seeking to do us harm in cyber-warfare will themselves be the ones for whom “resistance is futile”.

Could cybots end up like the the Cylones in Battlestar Galactica or the machines in Terminator that turn on humans?

The Cybots have a programmed mission such as “network monitoring and discovery, intrusion detection, and data management.” So the hope is that they stay true to those things.

However, to me it seems completely plausible that just as cybots can be developed for defensive capabilities, they can also be programmed for offensive cyber warfare. And if they can be used offensively, then we can end up on the wrong side of the cybots someday.

Where does this leave us?

It seems like cyberspace is about to get a whole lot more complicated and dangerous—with not only human cyber-criminals and –warriors, but also cyber robots that can potentially wreak Internet havoc.

In terms of planning for future IT security, we need to stay technologically on the cutting edge so that we stay ahead of our adversaries as well as in constant control of the new defensive and offensive cyber-weapons that we are developing.

Cybots to the Rescue

It’s Time to Invest in The Cloud

Cloud computing is "shorthand for centralized computing services that are delivered over the Internet (a.k.a. the 'cloud')."

Cloud computing is to traditional computing as electricity is to rubbing two twigs together to make a fire. Ok. That’s a little bit of an exaggeration, but not by much.

Years ago, people made a fire in their home or workspace which they continually fed to get warmth, lighting, and cooking; now they get these from centralized utilities that distribute it to them on an as needed basis. It’s a lot more efficient that way!

With cloud computing—it’s very similar. Currently, we have our own computing resources (like a hearth and firewood) that we must purchase and regularly maintain to do basic information technology processes for transaction and analytical processing, information sharing and collaboration. Now, we can get these functions from centralized computing facilities or data centers that distribute them, as needed on a subscription or metered basis. This gives us a predictable, stable source of computing at reduced prices, delivered via the Internet, when we want and need it, and without the hassle of having to purchase and maintain the hardware and software infrastructure. It’s a user-centric model!

Most of us with very busy and already complex lives inherently understand and are drawn to a model that is convenient and cost-effective. Flip on the switch and voila—lights/heat in one case or email, e-Commerce, and online entertainment in another.

To me, if its not a mission-specific or highly sensitive application, the question is why shouldn't it be in the cloud?

Fortune Magazine, 2 March 2009, on the rise of cloud computing juggernauts like Salesforce “a public company with a market capitalization of $3.5 billion, generates revenue of more than $1 billion a year—a 60% five-year annual growth rate—all from providing software subscriptions to business.”

Marc Benioff, their CEO says “We’ve always believe everything’s going into the cloud.”

Even detractors, like Larry Ellison, the CEO of Oracle, has helped fund Saleforce and another major cloud computing vendor, NetSuite. Moreover, “Oracle at the end of January lauched a new version of its online sales-management product…CRM on Demand” —so you see where Mr. Ellison is strategically placing some of his chips.

What about the other major application vendors?

“SAP said it would be releasing a software-as-a-service product in May…and Microsoft also has customer-management software available. IBM just named a cloud computing czar, and Google and Amazon are launching ambitions initiatives.”

So what’s holding up the transition?

Generally, the biggest cited obstacle to moving to cloud computing is security. Yet, “Salesforce has recorded only one security breach, a phishing attack in November 2007.” Moreover, because of the scope, scale, resources, and expertise that these vendors have, they can actually deploy and maintain a level of security that other organizations may only dream of.

Never-the-less, “companies remain committed to owning and hosting their own software and despite the tough economic times, they are loath to try something new, especially if it means making additional investments, however meager.”

But in the end “cost cutting and convenience are expected to prompt more firms to rent software that will be delivered over the Internet cloud.” IDC projects that by the end of 2009, “76% of U.S. organizations will use at least one web-delivered application for business use.”

Further, according to research firm, Gartner, "of the approximately $64 billion spent on business applications in 2008, about 10% or $6.4 billion, was spent on applications housed remotely and delivered via the Net."

The writing is on the wall or should I say in the cloud!

It’s Time to Invest in The Cloud

Lessons from Space for CIOs

There are no CIOs in space. At least not yet. Someday, as we colonize space, there will be. And information technology will be more important then ever as communications, information sharing, collaboration, and new ways of doing things enable people to live and work in distances that are now just the realm of science fiction.

As I read about space tourism in MIT Technology Review, January/February 2009, I realized there are already lessons for CIOs from space travel even in its nascent stages.

• Modernize, as needed—as technologists, some erroneously think that everything has to be swapped out and modernized every few years (for example, many organizations are on na 3 year refresh cycle—whether they need it or not!), but the Russian space program teaches us differently. They modernize, not on a fixed time, but rather as needed. They work by the principle “if it’s not broken don’t fix it.” Here’s an excerpt: “You can look at the original Soyuz, and the same physical design—same molds, even—appear to have been used throughout its history…But anything that has ever gone wrong or failed, they fix. Or if there is some new technology that comes along that would be of significant benefit, they change it also. Isn’t this a novel principle that we can adapt for sound IT investment management?


• Functional minimalism--for many organizations and individuals, there is a great desire to have the latest and greatest technology gadgets and tools. Some call these folks technology enthusiasts or cutting-edge. And while, IT is incredibly exciting and some missions really need to be cutting-edge to safeguard lives for example. Many others don’t need to have a closet with one of every software package, hardware gadget, or new tool out there. I’ve seen mid-size organizations that literally have thousands of software products—almost as many as people in the entire company! However, on the Russian Soyuz space vehicle, we see a different way. One space tourist noted: “It’s sort of a functional minimalism.” You don’t need tons of gadgets, just what is operationally necessary. CIO’s, as IT strategists and gatekeepers for sound IT investing, should keep this principle in mind and spend corporate investment dollars wisely, strategically, and with careful selection criteria. We don’t need one of everything, especially when half of the investments are sitting in a closet somewhere collecting organizational dust!


• Technology is 3-D—Our IT environment is still mostly stuck in a two-dimensional paradigm. Our user-interfaces, controls, and displays are still primarily flat. Of course, many have conceived of IT in a more real three-dimensional portrayal for example using 3-D graphics, modeling and simulation, holograms, virtual controls, and even virtual world’s in gaming and online. As CIO’s, we need to encourage the IT industry to continue rapid transformation from a 2-D to 3-D technology paradigm. As a corollary, in space where there is little to no gravity such as on the International Space Station, “It is cluttered, but then after a while you realize, well that’s true if you’re thinking in 2-D, but once your brain shift to 3-D, you realize that it isn’t.”


• Think strategic and global—The CIO and his/her staff gets lot of calls everyday based on operational issues. From simple password resets to the dreaded “the network is down.” When firefighting, it is easy to fall into a purely operational way of thinking. How am I going to get this or that user back up. But getting all consumed by operational issues is counterproductive to long-term planning, strategy, and monumental shifts and leaps in technology and productivity. One space tourist looking out the window in space summed it up nicely for CIOs (and others) to get perspective: “You’re out there in space looking back at Earth, and in a way, you’re also looking back at your life, yourself, your accomplishments. Thinking about everything you own, love, or care for, and everything else that happens in the world. Thinking bigger picture. Thinking in a more global fashion.” Maybe every CIO need a picture window view from the Internation Space Station to keep perspective?

Lessons from Space for CIOs

Security Architecture Q&A

Recently, I was interviewed on the subject of Security Architecture and was given permission to share the Q&A:

In general, what kinds of information security issues does an organization face?

The overarching information security issue in any organization is one of communication, collaboration and the need for transparency vs. the need to protect information from being compromised. Information security is about more than just "stopping leaks." It is also about making sure that people don't intercept, interject or otherwise manipulate agency information for their own ends.

A related issue has to do with protecting the agency's critical IT infrastructure from physical or cyber attack. It's the age-old conflict: If you lock it down completely, then you're protecting it, but you also can't use it. And if you open yourself up altogether, then obviously it won't be long before somebody takes aim.

Finally, the largest threat to an organization's information is clearly from insiders, who have the "keys to the kingdom." And so one must pay great attention to not only the qualifications, but also the background, of the employees and contractors entrusted with access to IT systems. Additionally we must institute checks and balances so that each person is accountable and is overseen.

How do leaders demonstrate security leadership?

Leadership in the area of security is demonstrated in a variety of ways. Obviously the primary method for demonstrating the importance of this function is to formalize it and establish a chief information security officer with the resources and tools at his or her disposal to get the job done.

But security leadership also means building an awareness of risk (and countermeasures) into everything we do: education, awareness, planning, designing, developing, testing, scanning and monitoring.

When new applications or services are being planned and rolled out, does security have a seat at the table?

I can't imagine any organization these days that doesn't consider security in planning and rolling out new applications or services. The real question is, does the organization have a formal process in place to provide certification and accreditation for IT systems? By law, federal agencies are required to do this.

Would you say that information security is generally tightly integrated into organizational culture?

I think that a security mindset and culture predominate in professions where security is paramount, such as law enforcement, defense and intelligence, for obvious reasons.

But the larger question is, how would other organizations make the transition to a culture of greater information security? And this is actually a really important question in today's age of transparency, social networking, Web 2.0, etc., where so much information is freely flowing in all directions. One approach that I have adopted as a culture-changing mechanism is to treat key initiatives as products to be marketed to a target audience. The IT security professional needs to be a master communicator as well as a technical expert, so that employees not only grudgingly comply with necessary measures, but are actively engaged with, and support, their implementation.

At the end of the day, the organization's information security is only as strong as its weakest link. So security has to be as deeply ingrained into the culture and day-to-day operations as possible.

Is information security an inhibitor to new initiatives?

Information security is one of many requirements that new initiatives must meet. And of course there will always be people who see compliance as an inhibitor. But the reality is that security compliance is an enabler for initiatives to achieve their goals. So the key for IT security professionals is to keep educating and supporting their stakeholders on what they need to do to achieve success and security at the same time.

Security Architecture Q&A

Disruptive Technologies

When companies get cozy, the marketplace gets innovative and from out of nowhere...a disruptive technology upends things.

We've seen this happen countless of times in big ways.

In the auto industry, 50 years ago neither GM nor Ford would have ever dreamed that they would lose their virtual monopoly on the U.S. auto industry to foreign car companies that would dislodge them with compact vehicles and hybrid engine technologies.

More recently in the music industry, Apple seized the day by combining functionality, stylishness and price on their iPod player with an accessible online iTunes music store.

More generally, the whole world of e-Commerce has stolen much of the show from the brick and mortar retail outlets with internet marketing, online transaction processing, supply chain management and electronic funds transfer.

Now, another disruption is occurring in the computer market. For years, the computer industry has made every effort to provide more raw computing power, memory, and functionality with every release of their computers. And Moore’s law encapsulated this focus with predictions of doubling every two years.

Now, on the scene comes the Netbook—a simpler, less powerful, less capable computing device that is taking off. Yes, this isn’t the first time that we’ve had a drive toward smaller, sleeker devices (phones, computers, and so on), but usually the functionality is still growing or at the very least staying the same. But with Netbooks smaller truly does mean less capable.

Wired magazine, March 2009, states “ The Netbook Effect: Dinky keyboard. Slow chip. Tiny hard drive. And users are going crazy for them.”

How did we get here?

“For years now, without anyone really noticing, the PC industry has functioned like a car company selling SUVs: It pushed absurdly powerful machines because the profit margins were high, which customers lapped up the fantasy that they could go off-roading, even though they never did.”

So what happened?

“What netbook makers have done is turn back the clock: Their machine perform the way laptops did four years ago. And it turns out that four years ago (more or less) is plenty.”

“It turns out that about 95%...can be accomplished through a browser…Our most common tasks—email, Web surfing, watching streaming videos—require very little processing power.”

The netbook manufactures have disrupted the computer market by recognizing two important things:

1. Computer users have adequate computing power for their favorite tasks and what they really want now is more convenience and at a price that says buy me.
2. Cloud computing is no longer an idea full of hot air, but it is a technology that is here now and can do the job for consumers. We can get our applications over the web and do not have to run them on our client machines. We can afford to have computers that do less, because the cloud can do more!

The result?

Foreign companies are running away with the Netbook market. “By the end of 2008, Asustek had sold 5 million netooks, and other brands together had sold 10 million…In a single year, netbooks had become 7 percent of the world’s entire laptop market. Next year it will be 12%.”

“And when Asustek released the Eee notbook, big firms like Dell, HP, and Apple did nothing for months.” They were taken off guard by miscalculation and complacency.

The future?

Of course, the big boys of computing are hoping that the netbook will be a “secondary buy—the little mobile thing you get after you already own a normal size laptop. But it’s also possible, that the next time your replacing an aging laptop, you’ll walk away into the store and wonder, ‘why exactly am I paying so much for a machine that I use for nothing but email and the Web?’ And Microsoft and Intel and Dell and HO and Lenovo will die a little bit inside that day.”

Implications for CIOs?

• End complacency and always be on the lookout for disruptive technologies and ways of doing business. There is always a better way!
• Hardware becomes a commodity over time and supplying the infrastructure for the organization is moving the way that electricity generation did at the turn of the 20^th century—to outside vendors that can do it more effectively and efficiently.
• Cloud computing means that commonly used software applications are available over the internet and can be provide the foundation business functionality for the organization.

The important future value add from the Office of CIO is in IT strategy, planning, governance, and mission-focused solutions. We need CIOs that are true leaders, innovative, and focused on the business and not just on the technology.

Disruptive Technologies

No Choice But to Change

It’s easy to get into a rut and just follow the status quo that we’re used to.

People do it all the time. It’s doing what we know. It’s comfortable. It’s less challenging. It feels less risky. It doesn’t “cause waves” with various stakeholders.

Don’t we often hear people say, “don’t fix it, if it ain’t broke”?

Here’s another more arrogant and obnoxious version of the anti-change sentiment: “don’t mess with perfection!”

And finally, the old and tried and true from the nay-sayer crowd: “we tried that one before.”

Unfortunately, what many of these die-hard obstructionists fail to acknowledge is that time does not stand still for anyone; “Time marches on.” Change is a fact of life, and you can either embrace it or make a futile attempt to resist.

If you embrace it and moreover become a champion of it, you can influence and shape the future—you are not simply a victim of the tide. However, if you resist change, you are standing in front of a freight train that will knock you out and drag you down. You will lose and lose big: Change will happen without you and you will be run over by it.

In short, it is more risky to avoid change than to embrace it.

Therefore, as a leader in an organization, as The Total CIO, you have an obligation to lead change:

• to try to foresee events that will impact the organization, its products/services, its processes, its technology, and its people.
• to identify ways to make the most of changing circumstances—to take advantage of opportunities and to mitigate risks, to fill gaps and to reduce unnecessary redundancies.
• to develop and articulate a clear vision for the organization (especially in terms of the use of information technology) and to steer the organization (motivate, inspire, and lead) towards that end state.
• to course correct as events unfold; the CIO is not a fortuneteller with all knowing premonition. Therefore, the CIO must be prepared to adjust course as more information becomes available. Sticking to your guns is not leadership, its arrogance.
• to integrate people, process, technology, and information; the CIO is not siloed to technology issues. Rather, the CIO must look across the enterprise and develop enterprise solutions that integrate the various lines of business and ensures true information sharing, collaboration, and streamlined integration and efficiency. The CIO is a unifier.
• to institutionalize structured planning and governance to manage change. It’s not a fly by night or put your finger up to see which way the wind is blowing type of exercise. Change management is an ongoing programmatic function that requires clear process, roles and responsibilities, timelines, and decision framework.
• to bring in management best practices to frame the change process. Change is not an exact science, but we can sure learn from how others have been and are successful at it and try to emulate best practices, so we are not reinvesting the wheel.

Change is a fact of life, even if it is often painful.

I’d like to say that maybe it doesn’t have to be, but I think that would be lying, because it would be denying our humanity—fear, resistance, apathy, weariness, physical and mental costs, and other elements that make change difficult.

But while the CIO cannot make change pain-free, he can make change more understandable, more managed (and less chaotic), and the results of change more beneficial to the long term future of the organization.

No Choice But to Change

It's Not The Systems, Stupid

Being a CIO is not just about information technology—IT is a service. The real job of a CIO is truly understanding the IT needs of their customers (those who actually carry out the mission of the organization) and leading the IT people to fulfill those needs.

In essence, the CIO leads his IT staff to deliver on the mission needs of the organization. So being the CIO is far from being just a technical job; it is very much a people job.

To deliver IT then, the CIO must understand how to effectively lead and motivate his people.

There is a terrific book on this subject called “What People Want” by Terry Bacon that identifies 7 primary needs of people in work relationships and particularly how an effective leader can fulfill those needs and in so doing build a high performing workforce.

Here are the primary people needs in relationships:

TRUST—“the most fundamental relationship need. Without trust, there will not be much of a basis for a relationship at all.”
CHALLENGE/GROWTH—“with rare exception, people are not content in trivial, boring, or stagnant jobs…they need to feel that their work is challenging and that they are developing their skills, capabilities, and possibilities.”
SELF-ESTEEM—"appearance, intelligence, talents, autonomy, integrity, awards, titles, positions, job responsibilities, memberships in special groups, acceptance or recognition.”
COMPETENCE—“people want to be expert at something.”
APPRECIATED—“feel pride in who they are and be genuinely accepted for what they contribute.”
EXCITED—“people want to be energized and enthused…it’s more fun than the alternative.”
RELEVANT—“contributing to something they believe in.”

You’ll notice that monetary compensation and benefits are not mentioned here, because that’s not what this is about. Yes, we all need to be able to pay our bills at the end of the month, but beyond that we have basic human needs (trust, challenge, self-esteem…) that are fundamental to people being effective on the job through their interactions with others.

And indeed, every leader can become a better, more effective leader by understanding these relationship needs and developing their abilities to genuinely help people feel fulfilled on these.

For the CIO, I think it is very easy—too much so—to focus on technology. The field is technically intriguing, quickly changing, futuristic, and fundamental to mission. Intentionally or not, the CIO can easily overlook the people that are behind the technical solutions—those that he/she depends on to really tech-enable the organization (it’s not the systems, stupid).

CIOs, take care of your hard-working and talented people—develop their trust, provide challenging work, grow their self-esteem, help them to mature their competences, appreciate them, inspire and excite, and show them they are contributing to something important. And you and they will be more than the sum of the parts and deliver IT solutions to the organization that will truly amaze!

It's Not The Systems, Stupid

The Stimulus Plan and User-Centric Enterprise Architecture

Just something I am thinking about...

Per Wall Street Journal, 14-15 February 2008, Stimulus Plan = 1,073 pages.

Imagine this...alternative stimulus plan--one sentence: Give everyone a debit card for $2500 that is good for 3 months.

(That's per every man, women, and child in this country!)

Result: spending will be pervasive and immediate, jump-starting the stalled economy.

(This can still be supplemented by long-term infrastructure projects and national investments as appropriate.)

This point is that the enemy of problem-solving is over-complexity.

We start with a problem that is so complex almost no one can understand it. For example, the financial market melt-down was tied in large part to dizzyingly constructed financial instruments that confounded and some say manipulated, even the most sophisticated investors.

And the answer was developed to respond to the problem. Sure, a complex problem may deserve a multi-faceted and even a thousand page answer.

But, perhaps it is time to step out of the trees and look at the forest. Is it time for a little simplicity?

Even if the answer is ok, maybe it needs to be communicated simply and straightforwardly--it's got to be user-centric!

Obviously, the point is not to over-simplify and miss the mark, but do be direct and to draw a clear relationship between problem and solution. Have we done that?

The Stimulus Plan and User-Centric Enterprise Architecture

Reflections On The Role of a Federal Chief Technology Officer

Had interview today with Federal News Radio on the role of the Chief Technology Officer.

Here are some key points:

1. The CTO is a subject matter expert on technology modernization, transformation and deployment of new technology in the agency.

2. The CTO is responsible to work with the lines of business and IT to ensure that technology is meeting the needs of customers, that enterprise architecture and governance are in place, and that agency is incorporating best practices from all sources into technology operations.

3. The CIO's focus is on the business while that of the CTO is technology. Everything the CTO does is to support the CIO to operationalize his or her decisions and those of the senior leadership team. The CTO also serves as principal advisor to the CIO on IT management best practices, so that these get incorporated into the decision process.

4. A federal CTO would be a positive development because it will give a more prominent voice to the nation’s technology needs.

If there had been more time I would have added that in my view, the most important issue for a federal CTO is to address the need to raise the technology competitiveness of the United States. Technology is our future and we need to be number one.

Reflections On The Role of a Federal Chief Technology Officer

Change Agents--Poisoned or promoted?

Let’s fantasize for a moment about what it must be like to be an enterprise architect/change agent.

Here we go.

Our stereotypical organization, let’s call it ABC Company has a talented group of enterprise architects. They have worked hard, built partnerships, learnt the organization and its needs, and have done a remarkable job working with leadership, subject matter experts, and other stakeholders in identifying an accurate baseline, determining a promising target, and have helped the organization navigate a well thought out transition plan. The organization reaches its target—success—and the process continues.

Hooray for the architects. Praise and promotion be upon ABC company’s enterprise architects.

Wait. Not so fast. Let’s back up. Rewind and see what often really happens when architects or anyone else for that matter tries to change the status quo:

R—E—S—I—S—T—A—N—C—E!!

Research shows that change agents are often scorned by their organizations and their peers. In immature organizations that do not embrace constructive change, change agents like enterprise architects are often not looked upon favorably.

Remember what happened to Socrates more than two millennium ago (and countless others innovators, inventors, and thought leaders since)?

Strategy + Business Magazine, Issue 53, has an article called “Stand by Your Change Agent.”

The article states: “research shows that most transformation leaders go unpromoted, unrecognized, and unrewarded. And their companies suffer in the long run.”

In a study of 84 major change initiatives at Fortune 500 companies between 1995 and 2005, “some 70 percent of executives who led these major transformations went unrewarded or were sidelined, fired, or spurred to leave.”

Why are change agents treated adversely?

The research shows that “deep down, a great many people and organizations fear change. People do not like to move out of their comfort zones. Powerful institutional forces help maintain the status quo. In such companies, change simply has no constituency.”

In these change-averse organizations, change agents often “find their efforts impeded, undermined, or rejected outright. Change agents may also suffer from the delusion that others see the urgent need for action just as they do, and may be frustrated to discover how little key stakeholders care about the initiatives and outcomes they hold dear.”

What is the impact to companies that treat their change agents this way?

Both the companies and people suffer. Change initiatives remain unfinished. Investments do not see their payback. Highly talented change agents are lost. And worse, other potential leaders will think many times over before taking on a change effort that “could derail their careers.”

Well, which companies did best with change?

“Companies that scored highest in leadership development and embracing change were most likely to improve performance.”

The lesson is clear: If companies want to grow, mature, and improve performance, then they need leaders who are visionaries and change agents to step up to the plate.

Those organizations that recognize this truth will embrace their change agents—encourage, recognize, reward, promote, and retain them.

Talented and motivated change agents (like enterprise architects) are an organization’s best hope for innovation, energizing creative potential, and long-term organizational success.

Change Agents--Poisoned or promoted?

The Perilous Pitfalls of Unconscious Decision Making

Every day as leaders, we are called upon to make decisions—some more important than others—but all having impacts on the organization and its stakeholders. Investments get made for better or worse, employees are redirected this way or that, customer requirements get met or are left unsatisfied, suppliers receive orders while others get cancelled, and stakeholders far and wide have their interests fulfilled or imperiled.

Leadership decisions have a domino effect. The decisions we make today will affect the course of events well into the future--especially when we consider a series of decisions over time.

Yet leadership decisions span the continuum from being made in a split second to those that are deliberated long and hard.

In my view, decision makers can be categorized into three types: “impulsive,” “withholding,” and “optimizers.”

1. Impulsive leaders jump the gun and make a decision without sufficient information—sometimes possibly correctly, but often risking harm to the organization because they don’t think things through.
2. Withholding leaders delay making decisions, searching for the optimal decision or Holy Grail. While this can be effective to avoid overly risky decisions, the problem is that they end up getting locked into “analysis paralysis”. They never get off the dime; decisions linger and die while the organization is relegated to a status quo—stagnating or even declining in times of changing market conditions.
3. Optimizers rationally gather information, analyze it, vet it, and drive towards a good enough decision; they attempt to do due diligence and make responsible decisions in reasonable time frames that keep the organization on a forward momentum, meeting strategic goals and staying competitive. But even the most rational individuals can falter in the face of an array of data.

So it is clear that whichever mode decision makers assume, many decisions are still wrong. In my view, this has to do with the dynamics of the decision-making process. Even if they think they are being rational, in reality leaders too often make decisions for emotional or even unconscious reasons. Even optimizers can fall into this trap.

CIOs, who are responsible for substantial IT investment dollars, must understand why this happens and how they can use IT management best practices, structures, and tools to improve the decision-making process.

An insightful article that sheds light on unconscious decision-making, “Why Good Leaders Make Bad Decisions,” was published this month in Harvard Business Review.

The article states: “The reality is that important decisions made by intelligent, responsible people with the best information and intentions are sometimes hopelessly flawed.”

Here are two reasons cited for poor decision making:

• Pattern Recognition—“faced with a new situation, we make assumptions based on prior experiences and judgments…but pattern recognition can mislead us. When we’re dealing with seemingly familiar situations, our brains can cause us to think we understand then when we don’t.”
• Emotional Tagging—“emotional information attaches itself to the thoughts and experiences stored in our memories. This emotional information tells us whether to pay attention to something or not, and it tells us what sort of action we should be contemplating.” But what happens when emotion gets in the way and inhibits us from seeing things clearly?

The authors note some red flags in decision making: the presence of inappropriate self-interest, distorting attachments (bonds that can affect judgment—people, places, or things), and misleading memories.

So what can we do to make things better?

According to the authors of the article, we can “inject fresh experience or analysis…introduce further debate and challenge…impose stronger governance.”

In terms of governance, the CIO certainly comes with a formidable arsenal of IT tools to drive sound decision making. In particular, enterprise architecture provides for structured planning and governance; it is the CIO’s disciplined way to identify a coherent and agreed to business and technical roadmap and a process to keep everyone on track. It is an important way to create order of organizational chaos by using information to guide, shape, and influence sound decision making instead of relying on gut, intuition, politics, and subjective management whim—all of which are easily biased and flawed!

In addition to governance, there are technology tools for information sharing and collaboration, knowledge management, business intelligence, and yes, even artificial intelligence. These technologies help to ensure that we have a clear frame of reference for making decisions. We are no longer alone out there making decisions in an empty vacuum, but rather now we can reach out –far and wide to other organizations, leaders, subject matter experts, and stakeholders to get and give information, to analyze, to collaborate and to perhaps take what would otherwise be sporadic and random data points and instead connect the dots leading to a logical decision.

To help safeguard the decision process (and no it will never be failsafe), I would suggest greater organizational investments in enterprise architecture planning and governance and in technology investments that make heavily biased decisions largely a thing of the past.

The Perilous Pitfalls of Unconscious Decision Making

Vision and The Total CIO

Vision is often the telltale demarcation between a leader and a manager. A manager knows how to climb a ladder, but a leader knows where the ladder needs to go—leaders have the vision to point the organization in the right direction!

Harvard Business Review, January 2009, asks “what does it mean to have vision?”

First of all, HBR states that vision is the “central component in charismatic leadership.” They offer three components of vision, and here are my thoughts on these:

1. “Sensing opportunities and threats in the environment”—(recognizing future impacts) this entails “foreseeing events” and technologies that will affect the organization and one’s stakeholders. This means not only constantly scanning the environment for potential impacts, but also making the mental connections between, internal and external factors, the risks and opportunities they pose, and the probabilities that they will occur.
2. “Setting strategic direction”—(determining plans to respond) this means identifying the best strategies to get out ahead of emerging threats and opportunities and determining how to mitigate risks or leverage opportunities (for example, to increase mission effectiveness, revenue, profitability, market share, and customer satisfaction).
3. “Inspiring constituents”—(executing on a way ahead) this involves assessing change readiness, “challenging the status quo” (being a change agent), articulating the need and “new ways of doing things”, and motivating constituent to take necessary actions.

The CIO/CTO is in a unique position to provide the vision and lead in the organization, since they can bring alignment between the business needs and the technologies that can transform it.

The IT leader cannot afford to get bogged down in firefighting the day-to-day operations to the exclusion of planning for the future of the enterprise. Firefighting is mandatory when there is a fire, but he fire must eventually be extinguished and the true IT leader must provide a vision that goes beyond tomorrow’s network availability and application up-time. Sure the computers and phones need to keep working, but the real value of the IT leader is in providing a vision of the future and not just more status quo.

The challenge for the CIO/CTO is to master the business and the technical, the present and the future—to truly understand the mission and the stakeholders as they are today as well as the various technologies and management best practices available and emerging to modernize and reengineer. Armed with business and technical intelligence and a talent to convert the as-is to the to-be, the IT leader can increase organizational efficiency and effectiveness, help the enterprise better compete in the marketplace and more fully satisfy customers now and in the future.

Vision and The Total CIO

Information: Knowledge or B.S.?

With modern technology and the Internet, there is more information out there than ever before in human history. Some argue there is too much information or that it is too disorganized and hence we have “information overload.”

The fact that information itself has become a problem is validated by the fact that Google is world’s #1 brand with a market capitalization of almost $100 billion. As we know the mission statement of Google is to “to organize the world's information and make it universally accessible and useful.”

The key to making information useful is not just organizing it and making it accessible, but also to make sure that it is based on good data—and not the proverbial, “garbage in, garbage out” (GIGO).

There are two types of garbage information:

1. Incorrect, incomplete, or dated
2. Misleading /propagandistic or an outright lie

When information is not reliable, it causes confusion, rather than bringing clarity. And then, the information can actually result in worse decision making, then if you didn’t have it in the first place. This is an enterprise architecture that is not only worthless, but is harmful or poison to the enterprise.

Generally, in enterprise architecture, we are optimistic about human nature and focus on #1, i.e., we assume that people mean to provide objective and complete data and try to ensure that they can do that. But unfortunately there is a darker side to human nature that we must grapple with, and that is #2.

Misinformation by accident or by intent is used in organizations all the time to make poor investment decisions. Just think how many non-standardized, non-interoperable, costly tools your organization has bought because someone provided “information” or developed a business case, which “clearly demonstrated” that is was a great investment with a high ROI. Everyone wants their toys!

Wired Magazine, February 2009, talks about disinformation in the information age in “Manufacturing Confusion: How more information leads to less knowledge” (Clive Thompson).

Thompson writes about Robert Proctor, a historian of science from Stanford, who coined the word “Agnotology,” or “the study of culturally constructed ignorance.” Proctor theorizes that “people always assume that if someone doesn’t know something, it’s because they haven’t paid attention or haven’t yet figured it out. But ignorance also comes from people literally suppressing truth—or drowning it out—or trying to make it so confusing that people stop hearing about what’s true and what’s not.” Thompson offers as examples:

1. “Bogus studies by cigarette companies trying to link lung cancer to baldness, viruses—anything but their product.”
2. Financial firms creating fancy-dancy financial instruments like “credit-default swaps [which] were designed not merely to dilute risk but to dilute knowledge; after they changed hands and been serially securitized, no one knew what they were worth.”

We have all heard the saying that “numbers are fungible” and we are also all cautious about “spin doctors” who appear in the media telling their side of the story rather than the truth.

So it seems that despite the advances wrought by the information revolution, we have some new challenges on our hands: not just incorrect information but people who literally seek to promote its opposite.

So we need to get the facts straight. And that means not only capturing valuable information, but also eliminating bias so that we are not making investment decisions on the basis of B.S.

Information: Knowledge or B.S.?

Decentralization, Technology, and Anti-Terror Planning

Given that 9/11 represented an attack on geographically concentrated seats of U.S. financial and government power, is it a good enterprise architecture decision to centralize many or all government headquarters in one single geographic area?

Read about Decentralization, Technology, and Anti-Terror Planning in The Total CIO.

Decentralization, Technology, and Anti-Terror Planning

Decentralization, Technology, and Anti-Terror Planning

Even though there hasn’t been a successful terrorist attack against the United States since 9/11, we are all aware that terrorists continue to seek ways to harm us. Of course, we have assets deployed nationally as well as internationally to protect our interests. However, there is always more that can be done. And one thing that immediately comes to my mind is decentralization.

The concept of decentralization is very simple. Rather than concentrating all your vital assets in one place, you spread them out so that if one is destroyed, the others remain functional. The terrorists already do this by operating in dispersed “cells.” Not only that, but we know that very often one “cell” doesn’t know what the other one is doing or even who they are. All this to keep the core organization intact in case one part of it is compromised.

Both the public and private sectors understand this and often strategically decentralize and have backup and recovery plans. However, we still physically concentrate the seat of our federal government in a geographically close space. Given that 9/11 represented an attack on geographically concentrated seats of U.S. financial and government power, is it a good enterprise architecture decision to centralize many or all government headquarters in one single geographic area?

On the one hand the rationale for co-locating federal agencies is clear: The physical proximity promotes information-sharing, collaboration, productivity, a concentrated talent pool, and so on. Further, it is a signal to the world that we are a free and proud nation and will not cower before those who threaten us.

Yet on the other hand, technology has advanced to a point where physical proximity, while a nice-to-have, is no longer an imperative to efficient government. With modern telecommunications and the Internet, far more is possible today than ever before in this area. Furthermore, while we have field offices dispersed throughout the country, perhaps having some headquarters outside DC would bring us closer to the citizens we serve.

On balance, I believe that both centralization and decentralization have their merits, but that we need to more fully balance these. To do this, we should explore the potential of decentralization before automatically reverting to the former.

It seems to me that decentralization carries some urgency given the recent report “World At Risk,” by The Commission on the Prevention of Weapons of Mass Destruction Proliferation and Terrorism—it states that “terrorists are determined to attack us again—with weapons of mass destruction if they can. Osama bin Laden has said that obtaining these weapons is a ‘religious duty’ and is reported to have sought to perpetuate another ‘Hiroshima.’

Moreover, the report goes on to state that the commission “believes that unless the world community acts decisively and with great urgency, it is more likely than not that a weapon of mass destruction will be used in a terrorist attack somewhere in the world by the end of 2013.”

Ominously the report states “we know the threat we face. We know our margin of safety is shrinking, not growing. And we know what we must do to counter the risk.”

Enterprise architecture teaches us to carefully vet and make sound investment decisions. Where should we be investing our federal assets—centrally or decentralized and how much in each category?

Obviously, changing the status quo is not cheap and would be especially difficult in the current global economic realty. But it is still something we should carefully consider.

Decentralization, Technology, and Anti-Terror Planning

Choice Architecture and Enterprise Architecture

In a free society like America, we are generally all strong believers in our rights and freedoms—like those often cited from the Bill of Rights-- speech, press, religion, assembly, bearing arms, due process and so forth. More broadly, we cherish our right and freedom to choose.

According to an recent article in Harvard Business Review, December 2008, one way that enterprises can better architect their products and services is by “choice architecture.”

Choice Architecture is “design of environments to order to influence decisions.” By “covertly or overly guiding your choices,” enterprises “benefit both company and consumer by simplifying decision making, enhancing customer satisfaction, reducing risk, and driving profitable purchases.”

For example, companies set “defaults” for products and services that are “the basic form customers receive unless they take action to change it.”

“At a basic level, defaults can serve as manufacturer recommendations, and more often than not we’re happy with what we get by accepting them. [For example,] when we race through those software installation screens and click ‘next’ to accept the defaults, we’re acknowledging that the manufacturer knows what’s best for us.”

“Of course, defaults can be nefarious as well. They have caused many of us to purchase unwanted extended warranties or to inadvertently subscribe to mailing lists.”

“Given the power of defaults to influence decisions and behaviors both positively and negatively, organizations must consider ethics and strategy in equal measure in designing them.”

Here are some interesting defaults and how they affect decision making:

Mass defaults—“apply to all customers…without taking customers; individual preferences into account.” This architecture can result in suboptimal offerings and therefore some unhappy customers.

Some mass defaults have hidden options—“the default is presented as a customer’s only choice, although hard-to-find alternatives exist.” For example, computer industry vendors, such as Microsoft, often use hidden options to keep the base product simple, while at the same time having robust functionality available for power users.

Personalized defaults—“reflect individual differences and can be tailored to better meet customers’ needs.” For example, information about an individual’s demography or geography may be taken into account for product/service offerings.

One type of personalized default is adaptive defaults—which “are dynamic: they update themselves based on current (often real-time) decisions that a customer has made.” This is often used in online retailing, where customers make a series of choices.

There are other defaults types such as benign, forced, random, persistent, and smart: each limiting or granting greater amounts of choice to decision makers.

When we get defaults right (whether we are designing software, business processes, other end-user products, or supplying services), we can help companies and customers to make better, faster, and cheaper decisions, because there is “intelligent” design to guide the decision process. In essence, we are simplifying the decision making process for people, so they can generally get what they want in a logical, sequenced, well-presented way.

Of course, the flip side is that when choice architecture is done poorly, we unnecessarily limit options, drive people to poor decisions, and people are dissatisfied and will seek alternative suppliers and options in the future.

Certainly, we all love to choose what we want, how we want, when we want and so on. But like all of us have probably experienced at one time or another: when you have too many choices, unconstrained, not guided, not intelligently presented, then consumers/decision makers can be left dazed and confused. That is why we can benefit from choice architecture (when done well) to help make decision making simple, smarter, faster, and generally more user-centric.

Choice Architecture and Enterprise Architecture

Why We Make Bad Decisions and Enterprise Architecture

With the largest Ponzi scheme in history ($50 billion!!) still unfolding, and savvy investors caught off guard, everyone is asking how can this happen—how can smart, experienced investors be so gullible and make such big mistakes with their savings?

To me the question is important from an enterprise architecture perspective, because EA is seeks to help organizations and people make better decisions and not get roped into decision-making by gut, intuition, politics, or subjective management whim. Are there lessons to be learned from this huge and embarrassing Ponzi scheme that can shed light on how people get suckered in and make the wrong decision?

The Wall Street Journal, 3-4 January, has a fascinating article called the “Anatomy of Gullibility,” written by one of the Madoff investors who lost 30% of their retirement savings in the fund.

Point #1—Poor decision-making is not limited to investing. “Financial scams are just one of the many forms of human gullibility—along with war (the Trojan Horse), politics (WMD in Iraq), relationships (sexual seduction), pathological science [people are tricked into false results]…and medical fads.”

Point #2—Foolish decisions are made despite information to the contrary (i.e. warning signs). “A foolish (or stupid) act is one in which someone goes ahead with a socially or physically risky behavior in spit of danger signs or unresolved questions.

Point #3—There are at least four contributors to making bad decisions.

• SITUATION—There has to be a event that requires a choice (i.e. a decision point). “Every gullible act occurs when an individual is presented with a social challenge that he has to solve.” In the enterprise, there are situations (economic, political, social, legal, personal…) that necessitate decision-making every day.
• COGNITION—Decision-making requires cognition, whether sound or unsound. “Gullibility can be considered a form of stupidity, so it is safe to assume deficiencies in knowledge and/or clear thinking are implicated.” In the organization and personally, we need lots of good useful and usable information to make sound decisions. In the organization, enterprise architecture is a critical framework, process, and repository for the strategic information to aid cognitive decision-making processes.
• PERSONALITY—People and their decisions are influenced positively or negatively by others (this includes the social affect…are you following the “in-crowd”.) “The key to survival in a world filled with fakers…or unintended misleaders…is to know when to be trusting and when not to be.” In an organization and in our personal lives, we need to surround ourselves with those who can be trusted to be provide sound advice and guidance and genuinely look after our interests.
• EMOTION—As humans, we are not purely rational beings, we are swayed by feelings (including fear, greed, compassion, love, hate, joy, anger…). “Emotion enters into virtually every gullible act.” While, we can never remove emotion, nor is it even desirable to do this, from the decision-making process, we do need to identify the emotional aspects and put them into perspective. For example, the enterprise may feel threatened and competitive in the marketplace and feel a need to make a big technological investment; however, those feelings should be tempered by an objective business case including cost-benefit analysis, analysis of alternatives, risk determination, and so forth.

Hopefully, by better understanding the components of decision-making and what makes us as humans gullible and prone to mistakes, we can better structure our decision-making processes to enable more objective, better vetted, far-sighted and sound decisions in the future.

Why We Make Bad Decisions and Enterprise Architecture