Information Technology Reference
In-Depth Information
n
n
n
n
How can IA support the attainment of these success measures?
Does IA enable success? How specifically?
Does a lack of IA jeopardize success? How?
Does IA have separate measures of success (i.e., distinct IA metrics, SLAs)? Is
success defined by IA attributes? Is success defined by business attributes to
which IA contributes?
Do existing/emerging threats jeopardize meeting SLAs? How?
Do emerging technologies enable meeting SLAs? How? What are the techni-
cal risks of emerging technologies? What are the business risks?
n
n
For example, the financial measurement area may look at how security and
privacy enable revenue. FEA compliance may ensure agency funding; therefore,
effective IA may preserve the budget revenue stream. How does IA enable cost sav-
ings or cost avoidance? Funds spent on core services are better than funds spent on
recovering from loss of data due to poor backup process.
The above questions are exemplary and not exhaustive, but they do establish a
mindset. Walking through each PRM attribute using the IA
2
Process and IA
2
Frame-
work is a disciplined approach to identify, enumerate, articulate, and address risks in the
PRM details. Do you really have to go to all this effort? The answer is an emphatic “it
depends.” How big is the project? How much investment is in the project? For a billion
dollar solution, yes, there is tremendous benefit to exhaustive risk management. For a
smaller project, scale the use of IA
2
to identify and address the relevant issues.
10.3.2.2
IA
2
Alignment with BRM
The process of developing a BRM identifies business areas, LOBs, and subfunc-
tions relevant to the organization. The most granular level is the subfunction. Walk
through the appropriate steps in the IA
2
P and consider the relevant aspects of IA
2
F to discern and address the business risks that include:
n
n
Threats to the function of each business area
Vulnerabilities of each business area
10.3.2.3
IA
2
Alignment with SRM
The SRM facilitates the discovery of services to support the business and perfor-
mance objectives. Some services may already exist; others may be identified as nec-
essary, but not in place. IA
2
facilitates identifying and addressing risks to service
development and performance. The ECF (see chapter 12) assists in putting services
in the context of the enterprise.
The enterprise consists of many business functions. Business functions consist
of permutations of subsets of collectives (actors), systems (entities), and processes
(actions). A service is the act of satisfying some demand (service as a verb); it is also
