SM40: Measuring Maturity and Preparedness

Size: px

Start display at page:

Download "SM40: Measuring Maturity and Preparedness"

Martina Horton
6 years ago
Views:

1 SM0: Measuring Maturity and Preparedness Richard Cocchiara IBM Distinguished Engineer and Chief Technology Officer for IBM Business Continuity & Resiliency Services Long Meadow Road Sterling Forest, NY (8)

2 IBM s approach to assessing a company s resiliency preparedness is done using three components Resilience Maturity Assessment Framework (RMAF) Used by business resilience teams for assessing customer resiliency Developed jointly by IBM Research and IBM Business Continuity & Resiliency Services teams Object oriented framework for analyzing a company s resiliency capabilities Resiliency Assessment Methodology (RAM) Used by BCRS consultants for providing a step-by-step approach for assessing overall client business resilience Used by IBM service delivery teams and IBM Research for assessing Global Service Delivery Centers Resilience Maturity Index (RMI) Composite metric of specific components to help identify potential areas of concern

3 Over time, IBM has developed a Resilience Maturity Assessment Framework (RMAF) to comprehensively analyze a company s resilience A holistic approach to evaluate all aspects of business resilience Object oriented framework for risk assessment and supporting method for use in initial phase of business resilience engagements The layers are broken down into IT and Business objects; objects are refined by attributes 200+ objects and over 2000 attributes Linked across layers to provide different resilience views like continuity, compliance, security etc. Evaluated for their current and target levels of business resiliency maturity STRATEGY PEOPLE PROCESS APPLICATIONS & DATA TECHNOLOGY FACILITIES

4 The IBM Resilience Maturity Assessment Framework (RMAF) uses a level maturity rating model to assess client resilience Basic Managed Predictive Adaptive Resilient These attributes or features are ad-hoc in nature and constitute the most basic levels of capability. Little planning for redundancy, failover capability or security are evident and rely heavily on staff expertise. Example: Layer Object Group IT IT These attributes or features have the fundamental automation tools necessary to manage a disruption or opportunity when it occurs. Object Change Change Management Management These attributes or features are centered on establishing thresholds and advanced warning systems that allow the company to take preemptive actions to prevent disruption. Attribute Group Activities Activities Attribute Monitor & Monitor & Report Report These attributes or features focus on the organizations ability to sense and respond to unforeseen circumstances by using contingency plans and adaptive technologies or processes found in a Dynamic Infrastructure to maintain operations. These capabilities focus on the business model itself and leverage the innovation, optimization and capacity management characteristics of a Dynamic Infrastructure. 1 = Basic 2 =Managed 3=Predictive =Adaptive =Resilient Some or all of this activity is slow, manual and/or problematic. Major changes usually have the outcomes documented, Change process is monitored and is effective for major changes. Change process is monitored and is effective for all changes. Change results are always documented, follow consistent codes to indicate the results, and are continually used to improve the process.

The framework is used as part of an overall

Methodology (RAM) to help manage risk, improve

Plan Business Imperatives Information Risk

FACILITIES Design Deploy Implement Corporate

5 The framework is used as part of an overall continuous improvement Resilience Assessment Methodology (RAM) to help manage risk, improve governance and enable compliance. Plan Business Imperatives Information Risk Management Regulatory Compliance Inputs: Business objectives, goals, priorities, policies & current capabilities Assess Analyze Evaluate Set Objectives STRATEGY PEOPLE PROCESS APPLICATIONS & DATA TECHNOLOGY FACILITIES Design Deploy Implement Corporate Governance Outputs: Reduced Risk, Improved governance and enabled compliance Monitor Manage Control

6 When IBM attempted to apply the framework and method to our Global Service Delivery Centers, there were several goals Goal: Validate and extend the RMAF based on our own experience Identify new objects/attributes and modifications (can be generic for use elsewhere) Define resiliency maturity levels for relevant attributes Goal: Derive a specialized view of RMAF for infrastructure service delivery Identify objects/attributes relevant for service delivery operations of IBM Develop a composite metric Resiliency Maturity Index for infrastructure service delivery Benefits Robust framework for assessing the resiliency of Global Service Delivery Centers A tool to understand how varying the resiliency of specific objects in the model affects the overall resiliency of the Global Service Delivery Centers IBM differentiator metric for comparison with competitors Common framework for BCRS customers and internal use

Specialized view of RMAF for IBM Global Services Delivery Center resiliency assessment Service availability view for remote delivery of IT infrastructure services Features concerned with maintaining

7 Specialized view of RMAF for IBM Global Services Delivery Center resiliency assessment Service availability view for remote delivery of IT infrastructure services Features concerned with maintaining uninterrupted services to remote customer (internal or external) as per agreement Feature Feature relevance relevance indicated indicated by by 1s 1s and and 0s 0s in in the the Service Service Availability Availability column column A separate consultant version is generated for the chosen view The features are marked with a maturity level from 1 to The maturity values are aggregated into a resiliency maturity index

8 Model for computing Resiliency Maturity Index (RMI) Overall GDC Resiliency People (Organization) People (Organization) IT IT Business Business Applications & & Data Data Technology Facilities Facilities People IT & Bus. People Applications & Data People - Technology Dependence Relation Network Operational Business Remote Connectivity Computing Systems Degree of substitution = 30% Organizational Organizational resilience resilience is is an an orthogonal orthogonal entity entity that that cuts cuts across across all all layers. layers. People - Facilities Main facility, backup facility Home Office Utilities Voice network Degree of substitution = 80% Substitution Relation

9 Sample: Application of the approach Facilities Layer Applications and Data Layer Object Raw Net Reason Object Raw Net Reason Main facility, backup facility Home office 3.1 Utilities.. Network Voice network 3 3 Total Score Technology Layer Dependence on People-Facilities 80% substitution of home office by main facility 20% substitution of voice by Remote connectivity Remote Infra Mgmt Collaboration Tools Skills DB Total Score Dependency on n/w, computing mgmt security systems, People-App & Data 30% substitution of by voice 0% substitution of Collaboration by voice Object Raw Net Reason Layer Network Computing sys. Mgmt sys. Security sys. Total Score Dependence on main facility, utilities and network, People- Technology Object Operational Business Total Score Raw 3. Net Reason Dependency on Applications and Data layer objects, People- Overall GDSC Score = 80% IT-process score + 20% Business-process score = 3.9

10 Hindi Hebrew Tesekkurler Turkish Traditional Chinese Thank You English Russian Gracias Spanish Grazie Italian Arabic Japanese Obrigado Brazilian Portuguese Thai Merci French Danke German Tamil Simplified Chinese Korean

Staying Ahead of the Curve: The Latest Stressors, Methodologies, Trends and Directions in Business Resilience

Staying Ahead of the Curve: The Latest Stressors, Methodologies, Trends and Directions in Business Resilience Richard Cocchiara, IBM Distinguished Engineer Chief Technology Officer for IBM BCRS RMCOCCH@us.ibm.com