2015 federal ocio study report: adopting transformation › sv › pdf-reports ›...

www.pwc.com/publicsector

2015 Federal OCIO Study Report:Adopting Transformation

2 2015 Federal OCIO Study Report: Adopting Transformation


Welcome from PwC and the CIO Institute

We are excited to have PwC and CMU collaborate on this unique study. Federal CIO’s and their departments have had to weather a slew of disruptions over the past several years. These have included policy-based, technical, social, and cultural issues. We believe that managing a multi-generational workforce in a rapidly changing environment requires situational awareness, an understanding of best practices, and the ability to enable agile processes and teams. With the onslaught of potential new disruptions in the near future brought on by increasing levels of data, cloud-based services and open architectures, and increasing pressures to create efficiencies, new resources will need to be made available. We firmly believe one of those pivotal resources will be information flow among a community of practitioners. For this reason, we believe this study and future initiatives like it will bring about a dialogue between agencies and departments on how to handle transformation. The development of a peer-based community focused on Federal IT professionals can act as an exchange of new thought leadership and innovative business processes, and it serves as a vehicle to organize collective action and intelligence.

One of the goals of this study is to continue and broaden collaboration between the Heinz College at CMU and PwC to focus on the needs of Federal CIOs and their departments. We believe that through building and engaging a community of practitioners, we can understand, communicate, and build practices to mitigate the effect of disruptive trends and begin to create greater levels of resiliency. Thank you for taking the time to participate and share your experiences.

Sincerely,

ARI LIGHTMAN

Distinguished Service Professor of Digital Media and Marketing

Director, CISO Executive Education and Certification Program

CIO Institute | H. John Heinz III College | Carnegie Mellon University

JEFF KAPLAN

Principal

PwC


The Federal OCIO Dilemma

The majority of Federal CIO offices (OCIO) are at an inflection point. In the past decade, there has been a gradual shift from large custom solutions to smaller commercial off-the-shelf (COTS) implementations. However, the underpinning architecture of these implementations has not forced a separation of concern between hardware and software layers. During the last half of the past decade, virtualization accelerated this separation. However, the cloud and mobile technologies have become the forcing function for most government agencies to break the hold that large system integrators have had on infrastructure architecture.

On the one hand, OCIOs struggle with a baseline burdened by decades of legacy system implementations − an amalgamation of costly, mostly custom point-solutions developed at a time when there was greater discretionary funding for IT investment and infrastructure options were limited. Presently, the

operational baseline for many agencies consumes over 80% of IT spending, leaving little investment for innovation. On the other hand, today’s infrastructure options offer a more flexible and responsive set of solutions, which, if affordable, can provide agencies an IT ecosystem that closely matches the mobility needs of the workforce and the digital needs of customers and suppliers.

• Cloud computing (public or private) cuts the cord between hardware and software layers, enabling flexibility, responsiveness, and ubiquitous access.

• Mobility technologies free the workforce and customers from the desktop and enable access to systems at any time or place.

• Enterprise software platforms help reduce complexity and time-to-value by shifting from point solutions to common platforms that connect people, processes, information, and documents in real time.

• Business intelligence technology expedites data to decisions by shifting from traditional analysis performed by a few privileged users via static reporting to dynamic near real-time analysis that many can perform.

• Sensors will change the way the physical world is monitored, potentially transforming the way many government missions are executed.

• Security and automation technologies offer real-time analytics and rules-driven notification, which reduce the risk of operating in dynamic environments.

OCIOs must achieve their desired end state in the face of constrained budgets, increasing mission requirements, obsolete policies, and political agendas. OCIOs have to accomplish more with the same or less resources, and mission requirements continue to increase. Demand for a digital government is growing, fueled by resource shortages and knowledge gaps. In addition, new technologies increase this demand, with new technology requirements and infrastructure investment requirements. Cost takeout opportunities exist but often require an investment to achieve total cost savings.

Sequestration and ongoing budget battles on Capitol Hill not only affect Congressional programming but also discretionary spending. Because the majority of IT spending does not operate with a working capital fund, OCIOs are juggling a large fixed-cost, capital-intensive investment portfolio within the context of an unpredictable and ever-changing budget.

OCIOs need to sustain momentum, but it is difficult to establish a culture of continuous improvement in the face of political agendas and government employee turnover. Retiring baby boomers and rotating political appointees create a brain drain in agencies. Finding and retaining talent and retooling people’s skills to keep pace with new technologies are challenges. In addition, most government departments lack a career track for IT professionals, which means that there is no clear experience or education standards for most IT management positions beyond what a CIO might dictate. There is little consistency in job descriptions and responsibilities across agencies and often no human capital plan to drive improvement of the IT workforce. Many IT managers adopt a “move out to move up” strategy because they cannot obtain promotions within their IT organizations. Consequently, IT management positions turn over every two to three years.

Overcoming Adversity

So, how do OCIOs cope? OCIO executives achieve success through

persistence, advocacy, and relationships.

OCIOs have a wide range of responsibilities, and to excel in any one

area requires the achievement of a number of accomplishments.

Agencies with successful OCIOs identify a small number of strategic,

core investment focus areas and execute a roadmap of specific

incremental improvements. Success in core investment areas requires

hands-on management. In most agencies, senior leaders are directly

involved in core investments. Senior leadership keeps projects on

target, mitigates risk, adjusts to unforeseen issues, incorporates

lessons learned, and makes persistent progress via incremental

investments. Finally, senior leaders use their relationships across the

agency to help make core investments succeed.

OCIOs have learned that for non-core investment areas, they need

to seek parity for these commodity services through portfolio

optimization, outsourcing, or other cost-optimization measures.

OCIOs are looking to outsource non-core and commodity

investments, either to other government shared service providers or

to commercial companies. Commodity services are essential to an

agency’s operations but are complex and costly to operate. In many

cases, commodity services are outsourced to large-scale commodity

service providers, who can aggregate and take advantage of scale

economies by providing services to multiple customers. Options

include SaaS providers or custom system integration contracts.

Needs vary but the strategy is the same: simplify and contain span of

scope.


Figure 1: Survey Respondents PM Maturity Model

Our study brought to light the following attributes of successful OCIOs:

• OCIO senior executives are strong, influential, connected, collaborative, technical, and hands-on. IT senior executives need to manage across the agency and drive change − both technical and behavioral. IT challenges include building and selling the business case, guiding the agency to make the right decisions, and getting mission and support executives onboard. Technical decisions need to be made in the context of mission support. However, sometimes IT professionals lack the perspective to make the right decisions in the context of mission support and fiscal austerity. Therefore, executives need to manage IT teams closely.

• OCIO middle-managers have strong, relevant technical and functional skills in project management, acquisition, policy, systems lifecycle, and general leadership. Middle managers are capable of executing strategies set by senior executives. They have the technical and functional strengths to navigate technological, contractual, and organizational challenges. In addition, managers have strong relationships with acquisition and contracting professionals and draw on these resources to help drive the OCIO agenda. Managers have a technical understanding of key issues, risks, and trends by staying connected to the outside world (peers, suppliers, leading industry practices). Also, they help their team members develop and evolve technical skills to keep pace with technological advances. Lastly, managers use IT policy as a strategic asset to shape and execute the IT strategic intent.

• IT organizations with strong portfolio, project, and service management processes. OCIOs have strong process discipline in key areas. They utilize portfolio management processes to align investments with agency priorities, evolve those investments as priorities shift, and drive spending on both new and legacy solutions. Historically, agencies have managed spending using project management disciplines built on PMBOK, but increasingly, they are shifting to Agile principles and methods − a trend fueled by funding constraints and greater emphasis on incremental vice waterfall implementations. Finally, agencies manage operations using well defined, robust service management processes built on the ITIL framework, which is driven by a culture of continuous improvement.

• OCIOs follow the principle of continuous innovation – slow and steady technology adoption. Agencies are slower to adopt technology compared to the private sector. Their fiscal responsibilities and constraints warrant more risk adverse methods, and they leverage research and

apply lessons learned from cash-rich organizations. Agencies take an incremental approach to building their technology strategy, using demonstrations and pilots as a means to learn how to insert technology into the government’s policy and security framework. Once they reduce risk, agencies move into widespread adoption. They may appear to be technology laggards; however, many successful OCIOs follow a proven, measured approach to technology insertion that is best suited to organizations with limited investment funding and complex operating models.

“even strong performers fail to be effective when operating in a weak process”

47% of CEOs are concerned about the

speed of technological change as a potential

threat to their organization*

*PwC’s 17th Annual Global CEO Survey, ‘Fit for the future: Capitalising on global trends’, 2014. www.pwc.com/gx/en/ceo-survey/2014/assets/pwc-17th-annual-global-ceo-survey-jan-2014.pdf


Figure 2: The Top Offenders of Insider Crimes*

Technology Agenda

The main technological focus for most agencies participating in this survey includes resiliency, security, and mobility.

Resiliency is an architectural principle that promotes the ability to adapt and return to a new equilibrium in the face of constant impact. Agencies are seeking resiliency by adopting more flexible and adaptable technology solutions. Cloud computing is one manifestation of a service that supports resiliency. Others include enterprise data management standards, open systems, containers, etc.

Fifty percent of agencies reported having above-average security capabilities, and another 40% average security capabilities. Most are implementing continuous monitoring and evaluation of systems and personnel. Investments in technology for performing continuous proactive security analytics are becoming more important than certification and compliance technologies. Data security (access,

control, containment) also has come to the forefront in light of the ever-increasing number of data thefts and the advent of analytics and business intelligence solutions, which put more data into more hands.

Mobile technologies will be a mainstream concern for the next few years. Most agencies are early in their adoption of mobility platforms and policies, focusing heavily on laying the foundation for mobile devices. Agencies that require a secure platform are locking down and permitting only agency-provided devices. Agencies with lesser security concerns are looking at more flexible device strategies. Device selection varies across agencies, and most have learned that the device is not as important as the underlying foundation because the device has a life of only a few years, but the foundation investment needs to endure and evolve.

Few agencies have moved forward to deploy mobile application platforms because they struggle with the infrastructure. Some mobile applications are emerging but mostly in mission-specific areas where need outweighs risk, or as experiments for low-risk use cases.

Most agencies reported mobility maturity as average to below average. Less than 20% reported it as above average. There are opportunities to leverage lessons learned across agencies and from large commercial corporations.

Figure 3: Mobility Maturity

Fifty percent of agencies reported that mobile technologies will have the greatest technological impact in the coming years

*PwC’s Global State of Information Security Survey, ‘Managing cyber risks in an interconnected world.’ www/pwc.com/gx/em/consulting-services/information-security-survey/index.html


An emerging trend is standardization on common enterprise software platforms for small- to moderate-sized application development. The goal is to reduce time-to-value and lifecycle costs by:

• Accelerating the front-end of the lifecycle: By removing cycle-time associated with tasks such as software evaluation, selection, acquisition, and environment stand-up, agencies can rapidly move from needs analysis to implementation. Leading results include a 75% decrease in time-to-value.

• Reducing complexity of the installed base: By reducing the proliferation of tools, agencies are better able to negotiate with vendors; reduce overhead associated with owning, administering, maintaining, and supporting multiple tools; and reducing demands on human capital associated with managing, executing, and operating in a complex environment. Leading results include as much as a 90% decrease in five-year application costs.

Figure 4: Digital IQ 2014 10 Technology Trends for Business


Transformational Opportunities

Half of OCIOs reported that they use strategic planning or road mapping to drive progress, but they use these processes more for communicating plans than for developing plans. Strategies and plans are developed inside the OCIO and pushed out to stakeholders. By comparison, leading practices in other organizations include a collaborative approach, wherein key customers and stakeholders participate in the ideation and planning process, thereby building buy-in along the way. While these collaborative approaches appear to take some time and require a good amount of resources to complete a cycle, they build greater organizational acceptance at the back end and often drive quick decision-making, expedite execution, and promote social accountability.

Senior Leadership: Struggling OCIOs cited weaknesses in IT leadership and sponsorship as the major impediment to IT success. Most agencies contribute their IT successes to direct engagement by strong senior leaders and senior-level relationships (at OCIO and agency levels). They also reported that leadership personalities and agendas have the greatest potential for impacting IT performance.

Stakeholder Engagement: OCIOs stated that the greatest challenge in driving progress was organizational change management − driving decision-making, alignment, and stakeholder buy-in (IT staff, agency executives, and overseers).

Customer Alignment: OCIOs cited opportunities for improvement in the areas of customer demand and satisfaction management, responding to mission events and needs, and maintaining relationships with mission executives. Organizational and strategic planning mechanisms exist, but there is not enough direct participation in business and mission strategy and needs analysis (more reactive than proactive). The majority of agencies develop service-level objectives, yet only half reported that they engage their clients in defining these service levels. Several agencies expressed that they had challenges in customer and stakeholder management. Some employ customer relationship managers (CRM), who are charged with customer alignment; however, this has been marginally successful due to weak relationships and challenging customers. Customer relationship managers lack either the relationship-building skills or technology savvy to add value. Some agencies expressed structural issues with the CRM role: It is a senior individual contributor position with limited/no organizational authority and is it is often staffed by repurposed project managers because the position is not attractive; and it lacks a clear career path.

Human Capital Management: Organizational planning and workforce management remain a challenge. Many agencies lack a formal IT career path with ample development

Sixty-two percent of agencies cited organizational change management as a barrier

to cost optimization.


and advancement opportunities, and planned succession plans. As a result, some of these agencies suffer from high employee turnover, with many employees spending only two years in any one position. There is considerable churn of employees into and out

of the IT organization, and to and from industry and other agencies. When employees are not able to advance in their own agencies, they obtain promotions and development positions in other agencies. Organizational churn takes a toll on productivity, and the lack of structured planning mechanisms in many organizations makes the workforce highly dependent on supervisors and managers. Churn amongst those ranks often stops or derails projects as leaders come and go. Individual contributors and team leaders do not feel empowered to proceed when there is a leadership vacuum. This is exacerbated by political and hierarchical cultures, where jumping up in the chain of command is countercultural.

To overcome the aforementioned issues, some OCIOs are looking to flatten their organizations and build a more collaborative culture, bringing multiple levels together and providing levels and functions a greater voice. Peer-led initiatives and collaborative methods help facilitate this cultural change. However, often, a fundamental shift in organizational values and demonstrated leadership actions is required to bring people to the table. Agencies stated that they most valued training in the areas of project

management and security, followed by leadership and policy. Training in the area of IT performance management was least valued. Training value was notably low in the areas that impact the IT team’s ability to manage and advocate for change, specifically the management of knowledge, technology, resource, and process.

Figure 5: Training Value

Agencies reported that OCIO relationships with the Chief Human Capital Officer were among the weakest with agency executives.

Sixty-three percent of US CEOs named ‘a skilled and adaptable workforce’ as one of their top three

priorities for the government of the country in which they are based.*

*PwC’s 18th Annual Global CEO Survey, “A marketplace without boundaries? Responding to disruption’, 2015. www.pwc.com/gx/en/ceo-survey/2015/assets/pwc-18th-annual-global-ceo-survey-jan-2015.pdf


Figure 6: Tools/Systems Used to Measure Performance

Performance Management: OCIOs cited data center, support, and operations as having the most robust set of performance measures and metrics. Most agencies have operational-level reporting, although it is not apparent how easily these agencies can drill down into the data to identify systemic issues. Project management measures are not very structured or mature and focus mostly on cost and schedule metrics − with limited ability to measure requirements fulfillment, development and integration efficiency, supplier efficiency, and overall customer satisfaction with an outcome. In spite of the strong emphasis agencies place on project management training, much of project performance management is evaluated subjectively based on PowerPoint reporting. OCIOs reported that Contracting Office involvement in projects was the lowest compared to the involvement of other functions. This implies that there is an opportunity for Contracting Offices to have a greater impact on project performance. Performance management of internal OCIO support (finance, human capital, policy, administration, etc.) is the most subjective and least measured, which is ironic since it is often the most scrutinized and least funded of IT functions. Overall, there is no emerging method for measuring OCIO efficiency and effectiveness.

DevOps Transformation: As OCIOs transform their methods and technologies, many of them cited that the traditional IT operating model may be an impediment to progress. Several technological and operating model transformations require significant changes to the DevOps processes, responsibilities, roles, policies, and technologies. The cloud and mobile technologies in particular call for significant modifications to the traditional IT operating model. Many traditional oversight and insight practices do not support incremental and iterative methods. Traditional boundaries and roles break down when collaborative methods, such as Scrum, are applied. Siloed data does not enable business intelligence.


Figure 7: Top Investments with Greatest Impact

Less than 30% of OCIOs reported significant

efforts to understand touch-labor costs

of applications and services. Most reported an emphasis on moving applications to a virtual environment, assuming that hardware savings

will eventually be realized. Little is known

about maintenance and enhancement costs

for applications; less than 20% reported a structured process or

capability to routinely monitor and evaluate

these costs.

IT Automation: OCIOs reported that they leverage tools to manage incidents, projects, and operational performance monitoring. Less than half said that they use application monitoring and financial monitoring tools, and apply manual methods instead. A few OCIOs reported the use of service monitoring tools, and none reported using business process monitoring tools. They stated that in the next few years, they plan to make the largest investments in tools for project, service-level, and business process monitoring and analytics. The nature of OCIO and IT management remains a manual process relative to the rest of the agency’s processes. The federal IT function continues to lag behind the private sector when it comes to automating IT workflows, monitoring, and performance analytics. The IT function mostly relies on employees, contractors, and touch-labor.

Cost Reduction: Our interviews revealed that there is not a heavy emphasis on cost take-out (vice future cost avoidance). Less than 20% of OCIOs reported focusing on cost reduction strategies beyond curtailment of investment and discretionary spending and adoption of lower-cost infrastructure options (the cloud and virtualization technologies). In addition, less than 50% of agencies reported that they had the ability to calculate the true total cost of ownership (TCO) for applications and services. Most OCIOs rely on cuff systems to manage TCO for services and projects. As such, TCO management is a relatively immature, cumbersome, and imprecise practice for many OCIOs. Portfolio management in many agencies is more of a CPIC reporting exercise than a fundamental effort to understand systemic cost drivers, consolidate assets, and align discretionary spending.


About the StudyWe conducted the Federal OCIO study as a joint collaboration between the Carnegie Mellon CIO Institute and the PwC Technology Institute. The study included representatives from over 20 federal agencies. The average FY15 IT budget of participating agencies is approximately $600 million. The study mechanism included an online survey and face-to-face interviews with OCIO executives. We collected and aggregated data for this report; However, we will not disclose any agency-specific data without prior written release from that agency. Finally, we did not procure or transmit sensitive information in the course of this study.

About PwC’s Technology Institute

The Technology Institute is PwC’s global research network, which studies the business of technology and the technology of business with the purpose of creating thought leadership that offers both fact-based analysis and experience-based perspectives. Technology Institute insights and viewpoints originate from collaboration among our professionals across the globe and their first-hand experiences working with their clients in the technology industry.

About Carnegie Mellon’s CIO Institute

Carnegie Mellon’s Heinz College offers two of the top ranked IT and IS programs in the world. A blend between Public Policy and Information Systems, Heinz College prides itself in developing men and women of intelligent action. With programs focused on healthcare, entertainment, the arts, data analytics, and information security, we are developing the next generation of data-driven decision makers. Award winning faculty, an inter-disciplinary curriculum, and innovation is built into our mission and global footprint.

The Chief Information Officer Institute (CIOI) is Heinz College’s center of excellence for IT executive education. The CIOI was founded over ten years ago and is focused on providing professional IT education for both public and private organizations through two program offerings.

The CIO Certificate Program consists of eight modules over the course of a year and covers theory, case simulations, and in class exercises to deliver practical and topical content. CIO Certificate Program offers open enrollment and flexible scheduling and brings together a mix of instruction from both faculty and practitioners. The CISO Certificate Program is a six month, distance-based program designed to address the specific demands on today’s cyber leaders.


Contact Details

Jeff [email protected](202) 756-1711

Andrew WasserAssociate Dean, School of Information Systems and ManagementExecutive Director, CIO InstituteCIO Institute | H. John Heinz III College | Carnegie Mellon Universityawasser@ cmu.edu

Ari LightmanDistinguished Service Professor of Digital Media and MarketingDirector, CISO Executive Education and Certification ProgramCIO Institute | H. John Heinz III College | Carnegie Mellon [email protected]

© 2015 PwC. All rights reserved. “PwC” refers to PricewaterhouseCoopers Public Sector LLP (a Delaware limited liability partnership) or, as the context requires, the PricewaterhouseCoopers global network or other member firms of the network, each of which is a separate and independent legal entity. Please see www.pwc.com/structure for further details. PSP-044d_WP OCIO Study Report 2015

www.pwc.com/publicsector

2015 federal ocio study report: adopting transformation › sv › pdf-reports ›...

Documents