E-Commerce Security: Advice from Experts (IT Solutions series)

The Underlying Assumptions of an Enterprise's IT Strategy and Architecture

In approaching this assignment, I sought participation and input from across the NEF/IS organization. My objective was to engage as many of the firm's IT thought leaders as I could find and to employ them as my board of advisors in crafting a model for the definition and depiction of NEF's IT architecture. ^[3] My first task in working with this large and diverse group of contributors was to draw from them a set of framing principles for the overall architecture authoring process. The specific nature of these assumptions may vary, of course, according to the industry and technology contexts of the enterprise. Nevertheless, the general character of these assumptions will have much in common from organization to organization. First and foremost, they must be clear, relevant to the enterprise, and actionable. Second, they must reflect the values and strategic direction of the enterprise's IT organization. ^[4] Third, they must speak to all stakeholders of the process, including the enterprise's business leaders, its IT team, and IT's external technology partner providers.

In general, the architecture process's underlying assumptions should address three areas of concern:

• Articulation of the relevant business/industry context and perhaps of high-level business strategies

• End user-focused principles

• Technology-focused principles

The following illustration from the application of this approach at NEF/IS offers a set of process assumptions that worked for that particular context but may be tailored to better fit the needs of the reader's organization. Collectively, these assumptions serve as a guide for the players in the planning process and as the framework within which IT architectural choices may be described, categorized, filtered, and ultimately selected. See Exhibit 1.

Exhibit 1: IT Architecture Process Assumptions

BUSINESS PRIORITY ASSUMPTIONS:

• IT architecture decisions will take into account the business practices and standards of the enterprise and those of its industry competitors.

• IT investments will align with the enterprise's business strategies.

• IT will facilitate the conduct of business and the retention of valued (internal) employees and (external) business partners.

• Easy access to financial information required in running a public company is a paramount concern.

• Data quality and integrity are essential to the success of the enterprise.

• Customer and business partner self-servicing are key business strategies.

USER-FOCUSED PRINCIPLES:

• IT's primary focus is customer-driven product and service delivery, with an emphasis on customer value and time to market.

• Responsibility for the implementation of IT, as well as the security and integrity of data, is shared among the users of enterprise IT and the corporate technology team.

• Electronic information in all formats is a vital asset of the enterprise and must be valued, protected, and leveraged.

• A primary focus of IT product and service delivery is to enable and empower users via self-directed, anywhere, anytime access to electronic information assets and services.

• No redundant data entry or storage should be allowed, except as dictated by technological or business requirements.

TECHNOLOGY-FOCUSED PRINCIPLES:

• The IT organization should purchase and integrate, rather than build from scratch, IT products for generic functions.

• IT should build applications for strategic advantage when dictated by unique business requirements or opportunities.

• IT should favor individual best-of-breed products over integrated product suites.

• IT should avoid customization of generic products except through supported interfaces (APIs).

• IT should support a common, homogeneous technology platform while recognizing the need for renewal and replacement.

• IT should sunset older, marginalized technologies as soon as possible.

• IT should migrate to an open, standards-based architecture, using Web-based, thin-client, server-centric applications that enable ease of application distribution, maintenance, and support.

• IT should ensure secure and confidential transaction processing and information sharing.

In this example, the first set of assumptions speaks to the necessity of mapping IT choices to the requirements of the business. Although this may seem obvious, the statements that follow elaborate on the particulars, such as the need for information technologies that foster collaboration among all players along the enterprise's value chain of delivery. The example next includes language concerning the management of financial data and reporting (of particular importance to a business like NEF), the protection of the enterprise's data assets, and so forth.

The second grouping of assumptions speaks to the end user's experience. Here, the focus is on those values that enable the independent action of the enterprise's employees in serving their customers. This section also emphasizes the need for systems integration, so that data entered once applies to all systems that require it. Together, these statements map an end-user IT experience and may be employed as a set of validation rules when interacting with your business partners to select among IT options. The final set of assumptions addresses technical considerations in the selection of technologies, including the preference to buy rather than build systems and to choose best-in-class solutions over system suites. Even these few sentences draw clear boundaries around acceptable IT choices.

The example includes powerful statements that might shape any organization's selection of information technologies. Clearly, not all of the particulars in Exhibit 1 will apply to the reader's work environment, and perhaps these statements ignore issues that may be of utmost concern. On the other hand, the NEF assumption list contains the key components of a framework for building a tailored set of assumptions for your enterprise. In the first instance, they focus upon those business issues of paramount importance to the business. Although the industry benchmarking of IT deployments may be a temporary fixation on the part of your bosses in management, meeting the core needs of the business should always be the primary driver of IT investment and hence of the corporation's IT architecture. The opening statements in Exhibit 1 make this case clearly.

Second, the assumptions speak to what end users can expect from enterprise IT and what is expected of them in return. Building a culture around the effective use of IT is essential to the success of any technology deployment. If you ignore the values and norms of your enterprise users, you may find yourself investing in technologies that are underutilized by your organization's work force. For example, your enterprise may standardize on a Microsoft Windows platform for the desktop, but it must also recognize that some business units, like publishing and graphic design, may be better served by an alternative product. Lastly, in addressing key technology strategies, such as buy versus build and a focus on open standards, your assumptions will help to frame the playing field. Within NEF/IS, these value statements framed the process, but they required more detailed elaboration as they were applied to particular categories of IT products and services. As the reader will observe, my process addressed these needs in due course.

By involving your organization's PMO personnel, CREs, IT team technical experts, and IT management in these deliberations, you can explore and ultimately identify those IT architecture assumptions that are right for your business. When conducting this work for NEF, I involved a representative cross section of IT thought leaders and, in a few instances, so-called power users. I kept management out of the more detailed process deliberations to allow my colleagues on the IT architecture advisory board free rein. When we reached agreement, representatives from the team brought our proposals before IT executive management for their review and approval. This process did take time, but it was an essential investment. With a firm consensus around these statements, the IT architectural planning team had an effective filter to employ when considering choices and weeding out options. The foundation was now laid for the process of articulating an IT architecture for NEF.

^[3]This process transferred to New York City once MetLife assumed control of NEF's IT direction.

^[4]Some CIOs choose to work with their management teams and business partners to frame architecture process assumptions, while others choose to delegate this task to the architecture team itself. In either case, the enterprise's leadership ultimately must endorse the principles upon which the architecture is built to legitimize the process. PMO personnel might serve to collect and codify this information for executive and architectural planning process review.