Alternative IT Delivery Methods and Best Practices for Small Airports (2015)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

28 28 Overview 28 IT Strategic Planning 33 Strategic Alignment Example 37 IT Master Planning 38 Reference Overview In order to effectively align the technology program with the airport manager’s mission, vision, values, and objectives, the user must take a strategic approach to understand the current business objectives, the basis for changes in the environment and the specific needs of the stake- holders. This appendix presents a methodology for systematically defining an overall IT strategy and laying out a long-term plan for project implementation. IT Strategic Planning The first step in establishing alignment between IT and the airport manager’s business objectives is the creation of an IT Strategic Plan. The IT Strategic Plan defines the direction needed to develop the IT program over a long period of time in accordance with the long-term direction for the airport. The IT Strategic Plan details the enabling processes that must be implemented to achieve the IT goals. The IT Strategic Plan may address key enablers, such as organizational structures, high-priority policies, or near-term projects at a high level, but does not provide long-term project planning. The IT Strategic Plan should be addressed from the perspective of a planning life cycle where it is reevaluated and updated annually to ensure ongoing alignment with the airport manager’s priorities. IT strategic planning is an exercise that can be accomplished with internal airport resources or with the assistance of consultants; however, to be effective, it must be done with significant input from the key airport stakeholders. Multiple standards exist within the IT industry that provide a framework for the governance and management of IT, including ITIL, TOGAF, PMBOK, PRINCE2, COSO, ISO, and COBIT. Each of these has a specific focus area in providing guidance, but all are general in nature and not necessarily directly applicable to the airport industry. The information in these standards can provide guidance, and strict adherence to any of these is not necessary to achieve the intended outcome. The user should assess this against his/her own environment and guiding principles to maximize the benefit. Appendix F provides a resource list covering these standards as well as some other useful resources. A P P E N D I X A Strategic Technology Alignment

Strategic Technology Alignment 29 The following methodology for determining the baseline IT strategy requirements is based on ISACA’s COBIT 5 Framework for the Governance and Management of Enterprise IT (ISACA 2012) because its focus is most directly in line with the intent of this Guidance. ISACA is an independent, nonprofit, global association, engaged in the development, adoption and use of globally accepted, industry-leading knowledge and practices for information systems. COBIT 5 is an IT industry best practice that focuses on aligning technology programs with an organization’s business objectives in order to minimize IT-related risks and maximize the benefits of technology. This methodology uses a cascading approach, as shown in Figure A1, to identify the enabling IT processes required to ultimately meet the stakeholders’ needs. This methodology is rather complex in nature, and is presented here as a basis for understanding. A set of templates are provided in Appendix E, Strategic Planning and Business Case Development Guide, that will walk the user through a simple step-by- step approach to defining an IT Strategic Plan that is appropriate for the specific user’s airport. Stakeholder Needs The overall purpose of the airport IT organization is to create value for its stakeholders. This is done by creating benefits with an efficient use of resources while optimizing risk. In order to do this effectively, the stakeholder needs (SNs) must be defined. Once understood, a set of specific airport goals can be correlated to provide a focused set of priorities. A general set of IT stake- holder needs include the following (ISACA 2012, pp. 55–56 © 2012 ISACA. All rights reserved. Used with permission.): SN01 Value from the use of IT SN02 User satisfaction with the quality of IT service SN03 Managed performance of IT SN04 Implementation of new technology for new strategic opportunity SN05 An appropriately built and structured IT department SN06 Managed dependency on external providers SN07 Managed IT outsourcing agreements SN08 Assurance over external providers SN09 Management of control requirements for information SN10 Management of all IT-related risk SN11 An efficient and resilient IT operation SN12 Control over the cost of IT SN13 Effective and efficient use of IT resources SN14 Effective and efficient use of sourcing options SN15 Adequate number of IT staff SN16 Developed and maintained IT staff skills SN17 Managed IT staff performance SN18 Assurance over IT SN19 Securely processed information SN20 Improved business agility through a flexible IT environment SN21 Delivered promises from IT projects SN22 IT support for the execution of business strategy SN23 Managed IT criticality in sustaining the enterprise SN24 Understanding of business processes dependent on IT and their requirements Stakeholder Needs Airport Goals IT Goals Enabling Processes Figure A1. COBIT 5 strategic planning methodology.

30 Alternative IT Delivery Methods and Best Practices for Small Airports SN25 Understanding of IT operational and project budget requirements SN26 Understanding of the balance between IT support/maintenance and value creation SN27 Sufficient IT resources and infrastructure available to meet required strategic objectives SN28 Timely IT decisions SN29 Transparency for the total IT effort and investment SN30 IT support for enterprise regulation and service-level compliance SN31 Understanding of IT regulation requirements compliance Airport Goals Once the stakeholder needs have been defined, the relevant airport goals (AGs) which satisfy these needs will be revealed. Each of these airport goals will then correlate to primary and second- ary IT goals. A general set of airport goals include the following (ISACA 2012, pp. 55–56 © 2012 ISACA. All rights reserved. Used with permission.): Financial AG01 Provide value to airport stakeholders through financial investments AG02 Provide competitive products and services for airlines and passengers AG03 Provide managed risk through safeguarding airport assets AG04 Maintain compliance with external laws and regulations AG05 Maintain financial transparency Customer AG06 Maintain a customer-oriented service culture AG07 Maintain business service continuity and availability AG08 Provide agile responses to a changing aviation environment AG09 Make information-based strategic decisions AG10 Optimize airline and passenger service delivery costs Internal AG11 Optimize airport-wide process functionality AG12 Optimize airport-wide process cost AG13 Manage airport-wide change programs AG14 Maximize airport operational and staff productivity AG15 Maintain compliance with internal airport policies Development AG16 Maintain skilled and motivated airport staff AG17 Maintain an innovative airport culture Table A1 depicts the correlation of stakeholder needs to airport goals. Templates for self- evaluation are provided in Appendix E, Strategic Planning and Business Case Development Guide. IT Goals Once the airport goals have been defined, the relevant IT goals (ITG) that support the airport goals emerge and should be assessed. Each of these IT goals will then correlate to primary and secondary enabling processes. A general set of IT goals include the following (ISACA 2012, p. 50 © 2012 ISACA. All rights reserved. Used with permission.): Financial ITG01 Alignment of IT and business strategy ITG02 IT compliance and support for business compliance with external laws and regulations

Strategic Technology Alignment 31 ITG03 Commitment of executive management for making IT-related decisions ITG04 Managed IT-related business risk ITG05 Realized benefits from IT-enabled investments and service portfolio ITG06 Transparency of IT costs, benefits, and risk Customer ITG07 Delivery of IT services in line with business requirements ITG08 Adequate use of applications, information, and technology solutions Internal ITG09 IT agility ITG10 Security of information, processing infrastructure, and applications ITG11 Optimization of IT assets, resources, and capabilities ITG12 Enablement and support of business processes by integrating applications and technology into business processes ITG13 Delivery of projects delivering benefits on time and on budget and meeting require- ments and quality standards ITG14 Availability of reliable and useful information for decision making ITG15 IT compliance with internal policies Development ITG16 Competent and motivated business and IT personnel ITG17 Knowledge, expertise, and initiatives for business innovation Table A2 depicts the correlation of airport goals to IT goals. Templates for self-evaluation are provided in Appendix E: Strategic Planning and Business Case Development Guide. AG01 AG02 AG03 AG04 AG05 AG06 AG07 AG08 AG09 AG10 AG11 AG12 AG13 AG14 AG15 AG16 AG17 SN01 X X X X X X X SN02 X X X X X X X SN03 X X X X X X X SN04 X X X X X X SN05 X X X X X X X SN06 X X X SN07 X X X SN08 X X X SN09 X X X SN10 X X X X SN11 X X SN12 X X X SN13 X X X SN14 X X X SN15 X X X SN16 X X X SN17 X X X SN18 X X SN19 X X X SN20 X X X X SN21 X X X X X X X SN22 X X X X X X X SN23 X X X SN24 X X X X SN25 X X X X SN26 X X X SN27 X X X X SN28 X X X X SN29 X X X X SN30 X X SN31 X X Source: ISACA (2012), pp. 55–56. © 2012 ISACA. All rights reserved. Used with permission. Table A1. Correlation of stakeholder needs to airport goals.

32 Alternative IT Delivery Methods and Best Practices for Small Airports Enabling Processes Once the IT-related goals have been defined, the enabling processes that support them emerge and should be assessed. The defined primary and secondary enabling processes provide the founda- tion on which a fully aligned IT strategy can be created. A general set of enabling processes include the following (ISACA 2012, p. 52–53. © 2012 ISACA. All rights reserved. Used with permission): Evaluate, Direct, and Monitor (EDM) EDM01 Ensure governance framework setting and maintenance EDM02 Ensure benefits delivery EDM03 Ensure risk optimization EDM04 Ensure resource optimization EDM05 Ensure stakeholder transparency Align, Plan, and Organize (APO) APO01 Manage the IT management framework APO02 Manage strategy APO03 Manage enterprise architecture APO04 Manage innovation APO05 Manage portfolio APO06 Manage budget and costs APO07 Manage human resources APO08 Manage relationships APO09 Manage service agreements APO10 Manage suppliers APO11 Manage quality APO12 Manage risk APO13 Manage security Build, Acquire, and Implement (BAI) BAI01 Monitor programs and projects BAI02 Manage requirements definition ITG 01 ITG 02 ITG 03 ITG 04 ITG 05 ITG 06 ITG 07 ITG 08 ITG 09 ITG 10 ITG 11 ITG 12 ITG 13 ITG 14 ITG 15 ITG 16 ITG 17 AG01 P P P S P S S P S P S S S AG02 P S P P S P S P S S S P AG03 S S S P S S S S P S S S S P AG04 P S S P S S AG05 P AG06 P S P S S S S S S AG07 S P S S P P AG08 P S S S P P S S S P AG09 P S S S S P S AG10 S P S P S P S S AG11 P S S P P P S P S S AG12 S P P S S P S S AG13 P P S S S S S P S AG14 S P S S S P AG15 P S P P AG16 S S S S S S P S AG17 S S S S S P S S S P Source: ISACA (2012), p. 50. © 2012 ISACA. All rights reserved. Used with permission. Table A2. Correlation of airport goals to primary (P) and secondary (S) IT-related goals.

Strategic Technology Alignment 33 BAI03 Manage solutions identification and build BAI04 Manage availability and capacity BAI05 Manage organizational change enablement BAI06 Manage changes BAI07 Manage change acceptance and transitioning BAI08 Manage knowledge BAI09 Manage assets BAI10 Manage configuration Deliver, Service, and Support (DSS) DSS01 Manage operations DSS02 Manage service requests and incidents DSS03 Manage problems DSS04 Manage continuity DSS05 Manage security services DSS06 Manage business process controls Monitor, Evaluate, and Assess (MEA) MEA01 Monitor, evaluate, and assess performance and conformance MEA02 Monitor, evaluate, and assess the system of internal control MEA03 Monitor, evaluate, and assess compliance with external requirements Tables A3 and A4 depict the correlation of IT-related goals to enabling processes. Templates for self-evaluation are provided in Appendix E: Strategic Planning and Business Case Develop- ment Guide. Strategic Alignment Example Figures A2 through A4 provide an example of the evaluation of one specific stakeholder need for alignment of IT enabling processes. This example assumes a stakeholder need of “Value from the use of IT.” This one stakeholder need gives rise to seven relevant airport goals. Further EDM 01 EDM 02 EDM 03 EDM 04 EDM 05 APO 01 APO 02 APO 03 APO 04 APO 05 APO 06 APO 07 APO 08 APO 09 APO 10 APO 11 APO 12 APO 13 ITG01 P P S S S P P P S P S S P S S ITG02 S S S P S S S P P ITG03 P S S S P S S S S S S S ITG04 S P S S S S S S S S S S P S P P ITG05 S P S S S P P P S S S P ITG06 S P P S P S S P S S S P P ITG07 P P S S P S P S S S S P P P P S S ITG08 S S S S S P S S S S S S S S ITG09 S P P S P P S S S P S S ITG10 S P S S S S S P P ITG11 S S P P S P P S S P S S S S ITG12 S S S S S S P ITG13 S S S S S S S P S P S S S P P ITG14 S S S S S S S S P S S S P ITG15 S P S P S S S S S S S ITG16 S S S P P S P S S S ITG17 S P S S S P P S P S P P S S S Source: ISACA (2012), p. 52–53. © 2012 ISACA. All rights reserved. Used with permission. Table A3. Correlation of IT-related goals to primary (P) and secondary (S) enabling processes EDM and APO.

34 Alternative IT Delivery Methods and Best Practices for Small Airports BAI 01 BAI 02 BAI 03 BAI 04 BAI 05 BAI 06 BAI 07 BAI 08 BAI 09 BAI 10 DSS 01 DSS 02 DSS 03 DSS 04 DSS 05 DSS 06 MEA 01 MEA 02 MEA 03 ITG01 P P S S S S S S ITG02 S S P S S S P S S P P ITG03 S S S S S ITG04 P S S S P S S S P P P P P P P P P ITG05 P S S S S S S S S S S S S ITG06 S P S S S ITG07 S P P P S P S S S P P P P S P P S S ITG08 S S S S P S P S S S S S S S S S S ITG09 S S S S S P S S S S S S ITG10 S P S S S S S S P S S S S ITG11 S S S P S S S P P P P S S S P ITG12 P S S S P S S S S ITG13 P S S S P S S S ITG14 S S P S S S S P S S P P S S S S ITG15 S S S S S S S S S S P P S ITG16 S S S S S S ITG17 S S S S P S S P S S S S S S S S Source: ISACA (2012), p. 52–53. © 2012 ISACA. All rights reserved. Used with permission. Table A4. Correlation of IT-related goals to primary (P) and secondary (S) enabling processes BAI, DSS, and MEA. Value from the use of IT Provide value to airport stakeholders through financial investments Provide competitive products and services for airlines and passengers Maintain a customer- oriented service culture Maintain business service continuity and availability Primary Managed IT-related business risk Security of information, processing infrastructure and applications Availability of reliable and useful information for decision making Secondary Alignment of IT and business strategy Delivery of IT services in line with business requirements Adequate use of applications, information, and technology solutions Manage airport-wide change programs Maintain skilled and motivated airport staff Maintain an innovative airport culture Stakeholder Need Airport Goals IT Goal Relevance IT Goals Figure A2. Strategic alignment example—from stakeholder need to IT goals.

Strategic Technology Alignment 35 Managed IT-related business risk Evaluate, Direct, and Monitor Ensure risk optimization Align, Plan, and Organize Manage suppliers Manage risk Manage security Build, Acquire, and Implement Monitor programs and projects Manage changes Deliver, Service, and Support DSS01 - DSS06 Manage operations Manage service requests and incidents Manage problems Manage continuity Manage security services Manage business process controls Monitor, Evaluate, and Assess Monitor, evaluate, and assess performance and conformance Monitor, evaluate, and assess the system of internal control Monitor, evaluate, and assess compliance with external requirements Primary IT Goal #1 Enabling Process Category Primary Enabling Processes Figure A3. Strategic alignment example—primary enabling processes for first primary IT goal.

36 Alternative IT Delivery Methods and Best Practices for Small Airports Managed IT-related business risk Evaluate, Direct, and Monitor Ensure governance framework setting and maintenance Ensure resource optimization Align, Plan, and Organize Manage the IT management framework Manage strategy APO 3-9, 11 Manage enterprise architecture Manage innovation Manage portfolio Manage budget and costs Manage human resources Manage relationships Manage service agreements Manage quality Build, Acquire, and Implement Manage requirements definition Manage solutions identification and build Manage availability and capacity Manage change acceptance and transitioning Manage assets Manage configuration Primary IT Goal #1 Enabling Process Category Secondary Enabling Processes Figure A4. Strategic alignment example—secondary enabling processes for first primary IT goal.

Strategic Technology Alignment 37 evaluating just one of these goals, “maintain business service continuity and availability” reveals three primary IT goals and three secondary IT goals. Each IT goal is then broken down into enabling processes. Using the first primary IT goal as an example reveals relevant processes within each of the five enabling process categories. Within each of these, there are fifteen primary enabling processes (Figure A3) and eighteen secondary enabling processes (Figure A4). As a result, in order to meet the stakeholder need for value from the use of IT, thirty-three specific enabling processes should be addressed by the IT Strategic Plan. IT Master Planning The IT Master Plan is the tool commonly used for addressing the specific activities required for the long-term development of the IT program according to the direction provided by the IT Strategic Plan. The IT Master Plan should address all of the enablers with sufficient detail for the airport manager to scope and budget new projects for the upcoming three to five years with longer-term projects and initiatives being addressed at a higher level. As with the IT Strategic Plan, the IT Master Plan is part of a planning life cycle and should be updated on a consistent schedule in order to provide greater detail to the longer-term initiatives as they enter the three- to five-year range. For an IT master planning program to be successful, it must have three core components: support and direction from key stakeholders, initiatives based on practical issues being experienced on a regular basis or well-defined long-term benefits, and an implementable plan. Stakeholder buy-in and support are necessary elements to avoid experiencing failure with many of the IT Master Plan initiatives and potentially the program itself. For IT improvements and changes to be adopted and sustained, the impacted stakeholders as well as the overall IT governance stakeholders must be actively involved and on-board with the initiatives being developed from the very beginning. To gain this level of support, the IT Master Plan initiatives need to be linked directly to clearly defined stakeholder needs. This is easily accomplished if an adequate level of effort is invested in developing an IT Strategic Plan and the identified IT goals and enabling processes have been accepted by management as priorities to be resolved. The initiatives being addressed by the IT Master Plan need much more than a link to stakeholder needs for the program to be successful. The IT goals and enabling processes defined in the IT Strate- gic Plan must be expressed in terms of practical issues that stakeholders experience on a regular basis or well-defined long-term benefits in order to justify the investment of resources to accomplish a new initiative. Typical issues identified in COBIT 5 (ISACA 2012. © 2012 ISACA. All rights reserved. Used with permission) include the following: • Business frustration with failed initiatives, rising IT costs, and a perception of low business value • Significant incidents related to IT risk, such as data loss or project failure • Outsourcing service delivery problems, such as consistent failure to meet agreed-on service levels • Failure to meet regulatory or contractual requirements • IT limiting the airport’s innovation capabilities and business agility • Regular audit findings about poor IT performance or reported IT quality of service problems • Hidden and rogue IT spending • Duplication or overlap between initiatives or wasting resources, such as premature project termination • Insufficient IT resources, staff with inadequate skills or staff burnout/dissatisfaction • IT-enabled changes failing to meet business needs and delivered late or over budget

38 Alternative IT Delivery Methods and Best Practices for Small Airports • Airport executives or senior managers who are reluctant to engage with IT, or a lack of committed and satisfied sponsors for IT • Complex IT operating models In addition, changes in the internal or external environment may present issues that necessitate and justify new IT initiatives. Examples include the following: • Changes in airport leadership • Airport-wide projects • Marketing strategies • Changes in regulatory compliance requirements • Airline mergers • Economic downturn • Technology advancements • Consultant assessments or studies • Changes in IT vendor or provider business models In order to turn specific instigating issues into implementable initiatives, a valid business case must be developed for each. This business case should first define the specific issue to be addressed; describe the current conditions in terms of financial, operational, stakeholder, and staff impact; associate it with the relevant enabling processes, IT goals, airport goals, and stakeholder needs; and describe the parameters relative to addressing this issue. Once the issue has been thoroughly analyzed, the status quo should be evaluated against the available options. In doing so, the business case must define for each, the benefits in terms of financial, operational, stakeholder, and staff; the costs and funding plan; the feasibility of success; the risks, issues, and assumptions relative to implementation; and both short-term and long-term stakeholder impacts. This process, if completed with thorough and accurate information, should provide clear justification for maintaining the status quo or investing in a specific initiative. Finally, an integrated project plan should be developed based on further evaluation of each selected initiative to determine: • Relative priority • Resource requirements • Stakeholder coordination and collaboration requirements • Project requirements • Dependencies • Risks mitigation requirements • Opportunities for economies of scale and scope Reference ISACA (2012). COBIT 5 Framework for the Governance and Management of Enterprise IT. Rolling Meadows, IL. http://www.isaca.org/COBIT/Pages/Product-Family.aspx