Information Technology Reference
In-Depth Information
zations today desire to focus on their core competencies. A manufacturer of small
engines does not necessarily know about IT or IA. The expense of recruiting, hir-
ing, and maintaining an in-house workforce with this expertise may not be worth-
while. Outsourcing to a service provider may be a more cost-effective solution.
For example, the service provider may run IT and IA operations from off site, or
locally on site depending on the organizational specific requirements. A managed
security service (MSS) is an option for handling IA issues. Effective use of an MSS
or any kind of outsourcing service still requires in-house expertise to understand
what the organization needs and to ensure the service provider actually fulfills
those needs. Using an MSS does not eliminate the need for in-house IA expertise,
but it does reduce it.
2.9.5
Implement
Implementation is the initial insertion of the solution into the organizational envi-
ronment, e.g., a pilot application. Whether the solution is acquired or developed,
implementation will determine the solution's fit with the organizational culture,
business environment, existing processes, and technology. This is the first step to
determine if the solution works at all.
2.9.6
Test
The test phase determines first if the solution works at all, then how effectively the
solution works, and how securely the solution works. Testing the solution in phases
is a wise idea, including a test environment with appropriate data that ensures accu-
rate and effective processing that mirrors reality. Use the IA
2
views when develop-
ing the test environment to ensure the right people are involved, the appropriate
policies exist for the secure creation and maintenance of a test environment, and to
ensure the secure use of test data.
Test data should reflect production data as closely as possible. The best test data
is excerpts from production data. As such, there may be sensitive information in the
test data such that the test data warrants the same protection (confidentiality and
privacy) as the production data.
Beyond the test environment is the pilot environment. A pilot environment
enables the discovery and resolution of many procedural and technical issues prior
to investing in enterprise deployment.
2.9.7
Deploy
When implementation and testing are complete, there remains enterprisewide
deployment of the solution. Deployment may be to a single location or to all enter-
