Yo Delmar's GRC and Beyond Blog

IT GRC Lifecycles – supporting each of Governance, Risk and Compliance – how about ITIL?

One of the big issues I hear from many customers and colleagues facing us in GRC is that there just so many different approaches and methodologies in play  to address our challenges – that implementing an end-end GRC program is hampered.  In the IT GRC world alone, we have, to mention a few:

·         IT Governance Institute’s COBiT and governance guidance

·         ITIL framework for IT Service Management

·         ISO 27000 series for security, which touches many aspect of IT

·         NIST approaches for Risk Management, including 800-30

·         OCEG’s Red Book, covering many aspects of Enterprise GRC, including IT GRC.

 

CIOs need approaches that dovetail with transforming IT as a Service

What all these lack is a common high-level approach that resonates with what a CIO is increasingly building as IT becomes more of a service.

We absolutely need to start aligning our approaches, even at the highest level, if we are to advance the cause of integrating and gaining synergies with end-end programs for GRC.

 One of my past colleagues, Scott Crawford,  Research Director at Enterprise Management Associates, completed a study a few years ago that showed that organizations that adopt ITIL have more mature GRC programs. I want to say ‘of course!’ but as it turns out, this isn’t that obvious to those GRC practitioners that have little insight into ITIL.

Here’s a thought – why not abstract approaches to a higher level that can accommodate the internationally accepted standards and methods – using the main stages of ITIL? At EMC Consulting, in fact, that is what we are doing, and it works well. IT GRC involves all the aspects of IT – from business continuity and data protection, through information governance and life cycle management, asset management, change and configuration management and of course, security management.

Integrating ITIL stages with GRC

Here’s a diagram showing how to pull together the main phases of ITIL: Strategy, Design, Implement and Operate – and move around the life-cycle whether you are looking through the governance-only lens, the risk management/security-only lens, the compliance-only lens or any combination.

This sort of approach typically resonates more with the cloud and datacenter folks, the pure IT folks.  But as we transition to the cloud – (and a good read on this, pulling concepts together is Chuck Hollis’s recent post on the 10 Big Ideas Shaping IT Infrastructure Today) -  isn’t that what we need to do as GRC practitioners? It’s the GRC-enable cloud, whether private or public, a key end-state?

 
 

 

The Web is 20 years old, what now in the next 20?

The most recent edition of ON Magazine contains fabulous articles and interviews industry luminaries reflecting on the 20th anniversary of the Web and on its potential over the next 20 years. Interviewees were posed three questions by EMC:

 ○ How has the Web changed your life?
 ○ How has the Web changed business and society?
 ○ What will the Web look like in 20 years?

The breadth and depth of responses has inspired fellow bloggers inside EMC and out to contemplate the same questions from their own unique perspectives.  Colleague  Kathryn Winkler, Vice President and Chief Sustainability Officer at EMC, has tagged me to contribute my story and encourage you to comment as well.

How has the Web changed my life?

I might otherwise have become a motorcycle mechanic. In the spring of 1971 I had wanted to take the Saturday course at the city high school on motorcycle engine repair, but when the registrar discovered I was a girl, I was blocked. Of course, that wouldn’t happen today. J My parents went to war with the city to get me admitted, and in the meantime as I shopped around for something else, my eye was caught by a computer course being held  in the basement of Dalhousie University‘s Library, so I signed up.  And within the first hour, I fell in love with the technology even though I was a terrible programmer. (Turns out I’m a pretty mediocre mechanic too).  But I was helped by other high schoolers that were far more adept and felt sorry for me as I thrashed through my assembler subroutines.  But it didn’t matter, I was enthralled. I went on to complete a Math degree with a minor in Computer Science, and later an MBA focusing on the Strategic use of Technology, and did get to practice mechanics on a dozen or so motorcycles over the years.  But the glee of being around technology has never left me, even as it becomes pervasive.  I remember the exact moment the penny dropped for me; I was stunned, realizing it would change everything.  It was 1992 and my consulting colleague Ken Rossen  showed me gopher  while we were at Dow Jones completing an Enterprise Wide Architecture engagement, helping them strategize on how to make an electronic version of the Wall Street Journal that people might one day read on tablets on the trains. It was a vision then, but a reality now, 20 years later.  This month, as I watch Apple’s ipad being launched, I feel a part of it and a sense of satisfaction as what we dreamed about, on that, and many other strategy engagements, unfolds. 

How has the Web changed business and society?

The paradox however, is that the web has leveled, empowered and liberated us, but also commoditized and distanced us from ourselves. Leveling the field of information lets us all see around corners, up and down, over, in and out, and helps makes the unfathomable more understandable. Seeing the latest Hubble shots helps us imagine our place in the multi-verse; watching 3d visualizations of hyperbolic paraboloids and fractals  brings mathematics to life; connecting serendipitously through twitter or stumble upon makes it possible for us to question in hitherto unthinkable ways, and imagine ourselves into new ways of being. So many good things have happened through the web, crowdsourcing us together in a global community. But, at the same time, we all have experienced how a few clicks away can be so artificially close.  Sometimes I long for the days growing up in Nova Scotia when people would just drop by for a cuppa, and catch up on the news over a long, leisurely conversation. Now, we pseudo-connect through Skype.  The complexity is enormous and fragile, precarious. In so many ways, we’ve passed the point of no return.  But let’s be clear: We don’t have a choice about this; business totally and absolutely depends on the interconnectivity of the web.

What will the Web look like in 20 years?

I don’t think there will be a web in 20 years. Last year conversion to LTE networks began, bringing the next generation of advanced mobile computing to life. Over the years what we know as the web will have morphed beyond the semantic web into a new kind of electronic fabric that will be so embedded in our lives it will essentially be an extension of ourselves.  Ray Kurzweil talks and writes about the singularity, where technologies advance to the point of where we as humans evolve beyond our biological limitations – with profound social and spiritual ramifications.  Ray estimates that by 2045, non-biological intelligence created in that year will be one billion times more powerful than all human intelligence today. So, 20 years from now, 2030, we will be well on our way….

What’s your story? How has the web changed your life, our society and business? What will it look like in 20 years?

Five Forcing Functions Transforming GRC – What’s Your Take?

When we start to see real shifts in the world, whether it is a real change in human perception, say, the universe is expanding/or not, or something a little more close to home like the adoption of new mobile computing technologies, as human beings we naturally seek to understand underlying drivers.  What is forcing this shift? Is it one or two things, or a ‘perfect storm’ of many factors coming together? How is this going to affect/benefit me, my career, and my organization?

Here I am going to outline five ‘forcing functions’ that seem to be the ‘biggies’ underlying the Big Shift in GRC from a static, point in time set of ill-aligned processes to a unified, near-real-time set of processes EMBEDDED in our business, information and infrastructure management systems. I’m very interested in your reaction to this – what other forcing functions are you seeing, and how would you prioritize these?

Forcing Function #1  Information Explosion.  What is taking place in the world of information today and the impact this is having not only on the way we manage information but also on the way we think about scaling GRC, is probably the biggest driver, IMHO.

Study after study (see this great study on the Digital Universe) has said that if we look at this digital world, even with a slowdown, we're going to create 40X more information this year than last year and that as the economy rebounds, that percentage will further increase. 

By 2011, the digital universe will be 10x the size it was in 2006.  70% of information is created by individuals, 95% of what they are creating is unstructured, and 85% of that will end up managed and secured and accessible through big large entities, whether it would be an external cloud, or internal cloud, or the hybrid of that, which EMC is calling the Private Cloud. à Your “digital shadow” is larger than the digital information you actively create about yourself.

All this information needs to be scrutinized and classified for its ‘GRC profile’ and then treated appropriately to ensure compliance with business and regulatory requirements. This process has to be automated; it’s just too big a challenge to attempt manually.

Forcing Function #2  Regulatory Avalanche. It’s hard to get really good numbers on this but all the evidence points to more and more regulation, on more and more aspects of what we do – from business practices, to information management to the delivery of IT products and services. Not only in the US, but globally. Managing the intricacies, dependencies and conflicts is a horrendous challenge for a large, globally entity. àYour organization’s “regulatory shadow” grows larger as the business expands into new markets.

Forcing Function #3 Demand for Near-real time Transparency. This is an interesting and maybe more subtle driver. Most organizations are relying more on more on key-whatever’s to manage their business.  With the evolution of business intelligence, business activity and technology infrastructure monitoring systems, management is getting this transparency, even though in many ways it is still Swiss cheese. The basic point though is: Key Performance Indicators (KPI), which are used to answer the question: “Are we achieving our desired levels of performance?”, Key Risk Indicators (KRI) which are used to answer the question: “How is our risk profile changing and is it within our desired tolerance levels?” and Key Control Indicators (KCI) which are used to answer the question:”Are our organization’s internal controls effective? Are we ‘in control’?” are management’s first stop on the transparency quest. Key Risk Indicators (KRIs) are tightly related to Key Performance Indicators (KPIs).  Instead of thinking of KPI measuring performance, think of a KPI as really just an indicator that the objective is at risk.  They are really the same thing. See previous post on Dreaming Nirvana: Beyond Compliance into Risk Analysis.
à Your organization’s “Performance Scorecard” is converging with your GRC profile.

Forcing Function #4  Adoption of the Hyper-extended, Virtual Enterprise.  This is a huge driver, fueled by the global economy and technologies where suppliers, partners and customers have deep and intimate ‘electronic reach’ into each other’s eco-systems. Not to mention 2.0 social media impacts. This adoption accelerates the scope and complexity of GRC. à Your organization’s potential for digital reach is exponentially expanding.

Forcing Function #5 Cloudburst of Virtualization.  

Cloud infrastructures, which support elastic scalability and leverage virtualized resources, are increasingly provided as a service. (Here’s a good short interview on Cloud as a Service – CaaS). The good news is that cloud users need not have knowledge of, expertise in, or control over the technology infrastructure in the "cloud" that supports them. The bad news is that we need to ensure that cloud providers are focused concretely on GRC in the Cloud. Early indications are that cloud services potentially provide even greater opportunities for better governance, lower risk and better compliance (more about that in future posts). In the meantime, if you want to follow very interesting discussions on Private Clouds, check out EMC’s Chuck Hollis blog here. à By 2011, 50% of companies will be have their production environments virtualized.

So, what do YOU think? How are these forcing functions affecting you, even if you aren’t in a GRC-related role? And if you are, whether it is program management, information governance, risk, security, audit, compliance, performance management, human resources or legal - what else is driving you to stretch the boundaries of your world? How can you better leverage and prepare for the impacts of these shifts?  Remember, the better educated you become, the better can respond as these shifts occur, and the better you can add critical value to your organization.