Information Technology Reference
In-Depth Information
literally currency (e.g., dollars, euros, pounds) and the IA message should be in
financial terms. At the strategic level, the financials should show the effect of IA on
the balance sheet, income statement, financial ratios, return on investment (ROI),
internal rate of return (IRR), and hurdle rates. A CEO's primary motivation is to
make a profit; moreover, the goal is to
optimize
profit for investors. If investing the
$1 million in T-bills is going to have a higher return than investing in the deploy-
ment of the latest security wonder widgets, T-bills it is.
As an IA architect, you are the liaison between business, technology, and IA.
Your job includes awareness of stakeholder motivations, business drivers, technical
drivers, and inherent and implied risks. Moreover, your job is to explain the risks
and how to address those risks in terms that resonate with the audience.
4.3.1.4 Tactical Interests
Line managers are likely to see the value of IA quantification in terms of opera-
tions, procedures, workflow, effect on infrastructure (e.g., increase mean time
between failures [MTBF]), and financials in terms of cash flow, revenue stream
generation, or revenue stream preservation. These tactical concerns ultimately
roll up into the balance sheet and income statement. However, line managers
relate more to annual budgets and productivity levels than to line items on the
balance sheet and income statement.
From a tactical perspective, consider what you should do (business drivers) in
terms of compliance requirements and good business practice. Use the articulation
of what you should do as a comparison for what you've done. Discover the actual
and compare against the objectives. A comparison of actual to target provides a
percentage completion. This can be in terms of existence, characteristics, and qual-
ity of each business driver. For example, given an investment in 100 firewalls for
the organization, there is business value in knowing how many are deployed (how
many exist), how many are working at any given time (do they work at all), how
many pass a standard penetration test to verify minimal security configuration (do
they work well).
4.3.1.5
IA Quantification Terms
The terms used to express IA value will vary among organizations. The IA architect
should express IA quantification (e.g., risk quantification, operational parameters)
in the appropriate stakeholder terms, or the appropriate stakeholder currency. The
same IA results may be expressed differently to a commercial company's CEO (e.g.,
balance sheet dollars) than an operations manager (e.g., SLA parameters). If the
audience is military, the appropriate stakeholder currency is lives. Political currency
is votes. Law enforcement currency is public safety. Nonprofit currency is optimiz-
ing the number of people who benefit from the free or low-cost service they offer.
