Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
39 39 Overview 39 Alternative IT Delivery Methods 40 Evaluation Criteria 41 IT Governance 43 IT Management 47 Operations and Maintenance Support 51 Project Delivery 56 Reference Overview This appendix addresses the human resource aspects of airport IT. First, it addresses the alternative IT delivery methods available and provides the details of specific associated benefits, risks, cost considerations, scalability, integration, and dependencies. Next, it provides a discussion on the IT governance and management functions, both of which should be provided through airport resources. It describes the role of each along with specific responsibilities and the relevance to small airports. Also, it addresses the operations and maintenance, and project delivery functions, both of which have various IT delivery methods. Within each of these functions, the discussion is grouped into specific roles and responsibilities of human resources found to be implemented at airports of varies sizes. Alternative IT Delivery Methods The following sections describe the IT delivery methods associated with human resources. Airport Staff Resources Airport staff resources include full-time and part-time employees whose job duties are exclu- sively directed by and for the sole benefit of the airport. Contracted Resources Contracted resources include general IT service firms, specific IT product or service vendors, and IT consulting firms: ⢠General IT service firms perform a range of standard IT system installation, operation, and maintenance duties according to a contracted service-level agreement. A P P E N D I X B Human Resources
40 Alternative IT Delivery Methods and Best Practices for Small Airports ⢠Specific IT product or service vendors perform the full range of installation, operation, and maintenance functions for a specific airport system that they are certified to support according to a contracted service-level agreement. ⢠IT consulting firms provide a range of specialty services across disciplines including business analysis, planning, design, program management, and implementation oversight. Depending on the nature of the agreement(s), these resources may be onsite full-time, onsite when needed, or completely remote. Shared Resources Shared resources include collaborative use of employees from another entity whose job duties are not exclusively directed by and for the sole benefit of the airport but rather are directed by a collaborative reporting structure between the airport manager and the other entity. For example, the resource may be an employee of the city IT department or the port authority and designated for assignment to the airport. Evaluation Criteria Benefits & Risks A general set of benefits and risks associated with various IT delivery methods for human resources is provided in Table B1. Please note that not all benefits and risks apply to all IT delivery methods. A specific breakdown will be provided within each delivery option section. Cost Considerations Cost considerations for the IT human resource delivery methods are addressed from the per- spectives of budget type (capital vs. operating), commitment level (long term vs. short term), and cost factors (specific cost items to account for). Specific cost considerations that are generally applicable to a resource type (delivery method) may or may not be applicable to a specific resource (individual) based on the terms of engagement. Benefit/Risk Description Benefits Some alternative IT delivery methods can benefit an airport in regard to: Reduced time requirement ⦠achieving objectives in less time Specific expertise ⦠having the required expertise to deliver the expected results Legally bound to performance ⦠having legal obligations to provide the expected results Definable level of service ⦠enabling a specific service quality expectation Reduced capital costs ⦠saving in capital costs Reduced support costs ⦠saving in support cost Risks Some alternative IT delivery methods can challenge an airport in regard to: May not have specific expertise ⦠possibly not having required expertise to perform the specific functions needed May not be able to get staff positions allocated ⦠successfully allocating required staff positions Expensive ⦠facing high costs Potential for divergent interests ⦠possibly not having the level of focus required for the specific responsibilities due to competing interests Procurement requirements ⦠developing specific procurements requirements May not have control over time/availability ⦠possibly lacking control over resource time and availability Table B1. Delivery methodsâhuman resourcesâgeneral benefits and risk.
Human Resources 41 Scalability As stakeholder needs, airport goals, and IT goals change, and the IT organization progresses to new levels of maturity, human resources must be able to change with it. A human resourceâs ability to adapt to these changing conditions is achieved through the concept of scalability. Scalability, in simple terms, is the ability to handle an increasing or more complex level of work within the same area of scope, without a loss of quality. Cost impacts may or may not be tied to scalable resources based on the specific terms of engagement. This factor is an important consideration in assessing differing options to ensure that the planned future capacity is accounted for. Each IT human resource delivery option will be evaluated according to the following: not scalable (no significant additional or more complex workload will be accomplished); dynamically scalable on demand (can perform additional and/or more complex workload when needed); existing resource investment (can perform additional and/or more complex workload with investment); and additional resource (new resource required for additional and/or more complex workload). Integration Integration of human resources into the airportâs overall operation is an important factor to consider. The integration level of the IT human resource delivery methods will be evaluated according to the following: tight (close coordination on a daily basis), moderate (direct coor- dination on a regular basis), loose (infrequent coordination only when required), and none (independent from airport operations). Dependencies The unique structure of each airport will influence the dependencies that each IT human resource delivery option will have. The dependencies of the IT human resource delivery methods will be evaluated according to the following categories: airport processes, other human resources, systems, and hardware/infrastructure. Overview Summary In an effort to consolidate the above information, Tables B2 and B3 map the benefits, risks, and cost considerations as well as scalability, integration opportunities, and dependencies respectively to the various delivery methods. IT Governance According to COBIT 5, Governance ensures that stakeholder needs, conditions, and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritization and decision making; and monitoring performance and compliance against agreed-on direction and objectives. (ISACA 2012, p. 14. © 2012 ISACA. All rights reserved. Used with permission.) In an airport environment, IT governance should be provided by the executive-level stake- holders who are responsible for ensuring that the airport goals are achieved. With these stake- holders providing direction, IT goals and enabling processes will be established and prioritized such that the ultimate stakeholder needs are addressed. IT governance is responsible for the evaluating, directing, and monitoring processes shown in Table B4. Many small airports do not have an established framework for IT governance. The common practices in place today reflect an evolutionary approach to implementing technology in support
42 Alternative IT Delivery Methods and Best Practices for Small Airports Delivery Methods Benefits Risks Cost Considerations Airport Staff Resources Reduced capital costs Reduced support costs May not have specific expertise May not be able to get staff positions allocated Operating Budget Long-Term Commitment Cost Factors: o Salary or Hourly Rate o Benefits o Supplies/Equipment o Office Space o Telecommunications o Management o HR Support Contracted Resources: General IT Services Firm Reduced time requirement Legally bound to performance Definable level of service May not have specific expertise Procurement requirements May not have control over time/availability Operating or Capital Budget Short-Term Commitment Cost Factors: o Fixed Fee or Hourly Rate o Contingency Markup o Supplies/Equipment o Office Space o Telecommunications o Management o Legal Support o Procurement Support Contracted Resources: Specific IT Product or Service Vendor Reduced time requirement Specific expertise Legally bound to performance Definable level of service Expensive Procurement requirements May not have control over time/availability Operating or Capital Budget Short-Term Commitment Cost Factors: o Fixed Fee or Hourly Rate o Travel Expenses o Contingency Markup o Supplies/Equipment o Office Space o Telecommunications o Management o Legal Support o Procurement Support Contract Resources: Consulting Firm Reduced time requirement Specific expertise Legally bound to performance Definable level of service Expensive Procurement requirements May not have control over time/availability Operating or Capital Budget Short-Term Commitment Cost Factors: o Fixed Fee or Hourly Rate o Travel Expenses o Contingency Markup o Supplies/Equipment o Office Space o Telecommunications o Management o Legal Support o Procurement Support Shared Resources Reduced capital costs Reduced support costs May not have specific expertise Potential for divergent interests May not have control over time/availability Operating or Capital Budget Long-Term or Short-Term Commitment Cost Factors: o Salary or Hourly Rate o Benefits o Supplies/Equipment o Office Space o Telecommunications o Management Time Table B2. Delivery methodsâhuman resourcesâbenefits, risks, and cost considerations.
Human Resources 43 of operational needs over time, the result of which is an IT environment composed of independent systems that each have somewhat unique requirements for operation, administration, maintenance, and support. While this is not uncommon in small airports, it is often the cause of much of the inefficiency, ineffectiveness, and instability of the IT function and a significant source of stress and dissatisfaction by stakeholders. IT Management According to COBIT 5, Management plans, builds, runs, and monitors activities in alignment with the direction set by the governance body to achieve the enterprise objectives. (ISACA 2012. © 2012 ISACA. All rights reserved. Used with permission.) Delivery Methods Scalability Integration Dependencies Airport Staff Resources Not Scalable Existing Resource Investment Additional Resource Tight Airport Processes Other Human Resources Systems Hardware/Infrastructure Contracted Resources: General IT Services Firm Not Scalable Dynamically Scalable on Demand Additional Resource Tight Moderate Loose None Airport Processes Other Human Resources Systems Hardware/Infrastructure Contracted Resources: Specific IT Product or Service Vendor Not Scalable Dynamically Scalable on Demand Additional Resource Tight Moderate Loose None Airport Processes Other Human Resources Systems Hardware/Infrastructure Contract Resources: Consulting Firm Not Scalable Dynamically Scalable on Demand Additional Resource Tight Moderate Loose Airport Processes Other Human Resources Systems Hardware/Infrastructure Shared Resources Not Scalable Dynamically Scalable on Demand Existing Resource Investment Additional Resource Tight Moderate Loose None Airport Processes Other Human Resources Systems Hardware/Infrastructure Table B3. Delivery methodsâhuman resourcesâscalability, integration, and dependencies. Process ID Process Process Description EDM01 Ensure Governance Framework Setting and Maintenance Analyze and articulate the requirements for the governance of enterprise IT, and put in place and maintain effective enabling structures, principles, processes, and practices, with clarity of responsibilities and authority to achieve the enterpriseâs mission, goals, and objectives. EDM02 Ensure Benefits Delivery Optimize the value contribution to the business from the business processes, IT services, and IT assets resulting from investments made by IT at acceptable costs. EDM03 Ensure Risk Optimization Ensure that the enterpriseâs risk appetite and tolerance are understood, articulated and communicated, and that risk to enterprise value related to the use of IT is identified and managed. EDM04 Ensure Resource Optimization Ensure that adequate and sufficient IT-related capabilities (people, process, and technology) are available to support enterprise objectives effectively at optimal cost. EDM05 Ensure Stakeholder Transparency Ensure that enterprise IT performance and conformance measurement and reporting are transparent, with stakeholders approving the goals and metrics and the necessary remedial actions. Source: ISACA (2012). © 2012 ISACA. All rights reserved. Used with permission. Table B4. Evaluate, direct, and monitor processes.
44 Alternative IT Delivery Methods and Best Practices for Small Airports In an airport environment, IT management is provided by a team who is responsible for ensuring that the IT goals are achieved. Depending on the size of the airport and the maturity level of the IT function, IT management may be performed by a single individual or a group with a defined leader who reports to the executive level. IT management is responsible for the following processes: ⢠Aligning, Planning, and Organizing (APO) processes shown in Table B5 ⢠Building, Acquiring, and Implementing (BAI) processes shown in Table B6 ⢠Delivering, Servicing, and Supporting (DSS) processes shown in Table B7 ⢠Monitoring, Evaluating, and Assessing (MEA) processes shown in Table B8 Process ID Process Process Description APO01 Manage the IT Management Framework Clarify and maintain the governance of enterprise IT mission and vision. Implement and maintain mechanisms and authorities to manage information and the use of IT in the enterprise in support of governance objectives in line with guiding principles and policies. APO02 Manage Strategy Provide a holistic view of the current business and IT environment, the future direction, and the initiatives required to migrate to the desired future environment. Leverage enterprise architecture building blocks and components, including externally provided services and related capabilities to enable nimble, reliable and efficient response to strategic objectives. APO03 Manage Enterprise Architecture Establish a common architecture consisting of business process, information, data, application, and technology architecture layers for effectively and efficiently realizing enterprise and IT strategies by creating key models and practices that describe the baseline and target architectures. Define requirements for taxonomy, standards, guidelines, procedures, templates, and tools, and provide a linkage for these components. Improve alignment, increase agility, improve quality of information, and generate potential cost savings through initiatives such as re-use of building block components. APO04 Manage Innovation Maintain an awareness of information technology and related service trends, identify innovation opportunities, and plan how to benefit from innovation in relation to business needs. Analyze what opportunities for business innovation or improvement can be created by emerging technologies, services or IT-enabled business innovation, as well as through existing established technologies and by business and IT process innovation. Influence strategic planning and enterprise architecture decisions. APO05 Manage Portfolio Execute the strategic direction set for investments in line with the enterprise architecture vision and the desired characteristics of the investment and related services portfolios, and consider the different categories of investments and the resources and funding constraints. Evaluate, prioritize and balance programs and services, managing demand within resource and funding constraints, based on their alignment with strategic objectives, enterprise worth and risk. Move selected programs into the active services portfolio for execution. Monitor the performance of the overall portfolio of services and programs, proposing adjustments as necessary in response to program and service performance or changing enterprise priorities. APO06 Manage Budget and Costs Manage the IT-related financial activities in both the business and IT functions, covering budget, cost, and benefit management, and prioritization of spending through the use of formal budgeting practices and a fair and equitable system of allocating costs to the enterprise. Consult stakeholders to identify and control the total costs and benefits within the context of the IT strategic and tactical plans, and initiate corrective action where needed. APO07 Manage Human Resources Provide a structured approach to ensure optimal structuring, placement, decision rights, and skills of human resources. This includes communicating the defined roles and responsibilities, learning and growth plans, and performance expectations, supported with competent and motivated people. APO08 Manage Relationships Manage the relationship between the business and IT in a formalized and transparent way that ensures a focus on achieving a common and shared goal of successful enterprise outcomes in support of strategic goals and within the constraint of budgets and risk tolerance. Base the relationship on mutual trust, using open and understandable terms and common language and a willingness to take ownership and accountability for key decisions. Table B5. Align, plan, and organize processes.
Process ID Process Process Description APO09 Manage Service Agreements Align IT-enabled services and service levels with enterprise needs and expectations, including identification, specification, design, publishing, agreement, and monitoring of IT services, service levels, and performance indicators. APO10 Manage Suppliers Manage IT-related services provided by all types of suppliers to meet enterprise requirements, including the selection of suppliers, management of relationships, management of contracts, and reviewing and monitoring of supplier performance for effectiveness and compliance. APO11 Manage Quality Define and communicate quality requirements in all processes, procedures and the related enterprise outcomes, including controls, ongoing monitoring, and the use of proven practices and standards in continuous improvement and efficiency efforts. APO12 Manage Risk Continually identify, assess, and reduce IT-related risk within levels of tolerance set by enterprise executive management. APO13 Manage Security Define, operate and monitor a system for information security management. Source: ISACA (2012). © 2012 ISACA. All rights reserved. Used with permission. Table B5. (Continued). Process ID Process Process Description BAI01 Manage Programs and Projects Manage all programs and projects from the investment portfolio in alignment with enterprise strategy and in a coordinated way. Initiate, plan, control, and execute programs and projects, and close with a post-implementation review. BAI02 Manage Requirements Definition Identify solutions and analyze requirements before acquisition or creation to ensure that they are in line with enterprise strategic requirements covering business processes, applications, information/data, infrastructure, and services. Coordinate with affected stakeholders the review of feasible options including relative costs and benefits, risk analysis, and approval of requirements and proposed solutions. BAI03 Manage Solutions Identification and Build Establish and maintain identified solutions in line with enterprise requirements covering design, development, procurement/sourcing, and partnering with suppliers/vendors. Manage configuration, test preparation, testing, requirements management and maintenance of business processes, applications, information/data, infrastructure, and services. BAI04 Manage Availability and Capacity Balance current and future needs for availability, performance, and capacity with cost-effective service provision. Include assessment of current capabilities, forecasting of future needs based on business requirements, analysis of business impacts, and assessment of risk to plan and implement actions to meet the identified requirements. BAI05 Manage Organizational Change Enablement Maximize the likelihood of successfully implementing sustainable enterprise-wide organizational change quickly and with reduced risk, covering the complete life cycle of the change and all affected stakeholders in the business and IT. BAI06 Manage Changes Manage all changes in a controlled manner, including standard changes and emergency maintenance relating to business processes, applications, and infrastructure. This includes change standards and procedures, impacts, prioritization and authorization, emergency changes, tracking, reporting, closure, and documentation. BAI07 Manage Change Acceptance and Transitioning Formally accept and make operational new solutions, including implementation planning, system and data conversion, acceptance testing, communication, release preparation, promotion to production of new or changed business processes and IT services, early production support, and a post-implementation review. BAI08 Manage Knowledge Maintain the availability of relevant, current, validated, and reliable knowledge to support all process activities and to facilitate decision making. Plan for the identification, gathering, organizing, maintaining, use, and retirement of knowledge. BAI09 Manage Assets Manage IT assets through their life cycle to make sure that their use delivers value at optimal cost, they remain operational (fit for purpose), they are accounted for and physically protected, and those assets that are critical to support service capability are reliable and available. Manage software licenses to ensure that the optimal number are acquired, retained, and deployed in relation to required business usage, and the software installed is in compliance with license agreements. BAI10 Manage Configuration Define and maintain descriptions and relationships between key resources and capabilities required to deliver IT-enabled services, including collecting configuration information, establishing baselines, verifying and auditing configuration information, and updating the configuration repository. Source: ISACA (2012). © 2012 ISACA. All rights reserved. Used with permission. Table B6. Build, acquire and implement processes.
46 Alternative IT Delivery Methods and Best Practices for Small Airports Process ID Process Process Description DSS01 Manage Operations Coordinate and execute the activities and operational procedures required to deliver internal and outsourced IT services, including the execution of pre- defined standard operating procedures and the required monitoring activities. DSS02 Manage Service Requests and Incidents Provide timely and effective response to user requests and resolution of all types of incidents. Restore normal service; record and fulfil user requests; and record, investigate, diagnose, escalate, and resolve incidents. DSS03 Manage Problems Identify and classify problems and their root causes and provide timely resolution to prevent recurring incidents. Provide recommendations for improvements. DSS04 Manage Continuity Establish and maintain a plan to enable the business and IT to respond to incidents and disruptions in order to continue operation of critical business processes and required IT services and maintain availability of information at a level acceptable to the enterprise. DSS05 Manage Security Services Protect enterprise information to maintain the level of information security risk acceptable to the enterprise in accordance with the security policy. Establish and maintain information security roles and access privileges and perform security monitoring. DSS06 Manage Business Process Controls Define and maintain appropriate business process controls to ensure that information related to and processed by in-house or outsourced business processes satisfies all relevant information control requirements. Identify the relevant information control requirements and manage and operate adequate controls to ensure that information and information processing satisfy these requirements. Source: ISACA (2012). © 2012 ISACA. All rights reserved. Used with permission. Table B7. Deliver, service, support processes. Process ID Process Process Description MEA01 Monitor, Evaluate and Assess Performance and Conformance Collect, validate, and evaluate business, IT, and process goals and metrics. Monitor that processes are performing against agreed-on performance and conformance goals and metrics and provide reporting that is systematic and timely. MEA02 Monitor, Evaluate and Assess the System of Internal Control Continuously monitor and evaluate the control environment, including self- assessments and independent assurance reviews. Enable management to identify control deficiencies and inefficiencies and to initiate improvement actions. Plan, organize, and maintain standards for internal control assessment and assurance activities. MEA03 Monitor, Evaluate and Assess Compliance with External Requirements Evaluate that IT processes and IT-supported business processes are compliant with laws, regulations, and contractual requirements. Obtain assurance that the requirements have been identified and complied with, and integrate IT compliance with overall enterprise compliance. Source: ISACA (2012). © 2012 ISACA. All rights reserved. Used with permission. Table B8. Monitor, evaluate, and assess processes. Many small airport managers do not have a robust IT management structure providing the formal level of management described in these processes. Regardless, most are functioning ade- quately, even though they seem to stay in âreactionary modeâ more than they would prefer. This is because the majority of these processes are being performed, out of necessity, in an unmanaged and informal manner. In order to move beyond a reactionary mode into what is described in the Guidance as âIT Maturity Level 3: Proactive,â airport IT management must adopt an intentional approach to formally addressing these processes. Consultant support is commonly used for assistance in the development of new processes as well as the execution of high-level tasks that require subject matter expertise for which the IT management resources either do not have the time or capability to perform. Many airport managers leverage consultant support for strategic and master plan development, business case development, specific assessments and studies, project planning and management, and imple- mentation oversight.
Human Resources 47 Operations and Maintenance Support Operations and maintenance support refers to the workload necessary to provide IT services and keep systems functioning as required. This includes providing operational value to systems and net- works through daily administration, monitoring, updating, backing up, and developing application, as well as resolving problems through hardware repair and replacement, end-user support, and application support. In a small airport environment, there is typically significant overlap of respon- sibilities among resources, with the limiting factor being the overall skill set. Operations and mainte- nance support options are addressed below based on typical skill set groupings, including hardware maintenance, end-user support, software/network administration, and application development. Table B9 provides a quick reference followed by a brief description of each to provide greater detail. Hardware Maintenance Hardware maintenance provides the ongoing maintenance and repair services required to keep technology hardware components functioning as required. It is a standard IT support requirement for all and is typically conducted onsite. The extent to which it is needed and the appropriate IT delivery method are determined by the airportâs size and complexity. Airport Staff Resources Airports of all sizes widely use full-time staff resources to provide hardware maintenance. IT technicians are readily available resources in most locations. While this role may be filled with resources that are hired with all of the relevant skills necessary, hardware maintenance is an area where individuals with limited experience can be trained and developed in-house. Airport Staff Resources Contracted Resources Shared Resources Hardware Maintenance Entry-level opportunity with training Part-time or shared with other duties Full-time General IT service firms Full-time onsite Time and materials Specific IT product or service vendors Annual fixed cost Time and materials Viable for typical IT hardware components End-User Support (Help Desk) Entry-level opportunity with training Part-time or shared with other duties Full-time General IT service firms Full-time onsite Outsourced call center Specific IT product or service vendors Annual fixed cost Time and materials Viable for typical IT software applications and hardware components System/Network Administration Experienced with specialized training Part-time or shared with other duties Full-time General IT service firms Full-time Outsourced call center Specific IT product or service vendors Annual fixed cost Time and materials Viable for typical IT software applications and network components Application Development Experienced with specialized training Part-time or shared with other duties Full-time General IT service firms Full-time Time and materials Project fixed cost Specific IT product or service vendors Annual fixed cost Viable for typical IT software applications Table B9. Overviewâoperations and maintenance support.
48 Alternative IT Delivery Methods and Best Practices for Small Airports Contracted Resources General IT service firms provide hardware maintenance services through a variety of options ranging from full-time onsite resources to time and materials on an as-needed basis. This is a viable option for providing hardware maintenance in some airport environments that do not have need for a full-time technician or have a business case that supports outsourcing. A contracted technicianâs hourly rate will typically be higher than that of a full-time technician, but the overall value can be greater if the workload is performed more efficiently through outsourcing. This service can be bundled into a âmanaged servicesâ agreement with other IT services to provide specific services on an ongoing basis according to an agreed-upon response and resolution period. Specific IT product or service vendors provide hardware maintenance for equipment that requires specific skills and, potentially, certifications. Typically, this would be components of a special system such as security access control or fire alarm monitoring. Depending on the system, there may be code or regulatory requirements that necessitate the use of a particular service provider. Agreements with these vendors are typically on a multi-year, fixed-cost support agreement but may also be provided through time and materials as needed. Consulting firms do not provide hardware maintenance services. Shared Resources Shared resources may be used to provide hardware maintenance in certain environments. Depending on the organizational structure of the airport, opportunities may exist for IT tech- nicians to be shared between different departments of closely tied organizations. Sharing of resources is a viable option when dealing with typical IT hardware, such as computers, printers, and network switches. However, airport special systems require specific skills that other closely tied organizations do not possess. End-User Support End-user support, also known as âhelp desk support,â provides the routine services required to assist end-users with IT-related needs. The role provides two major functions, problem resolution and ad hoc training. It is a standard IT support requirement for all airports and is provided over the phone, through email, and in person. The extent to which it is needed and the appropriate IT delivery method are determined by the airportâs size and complexity. Airport Staff Resources Airports of all sizes widely use full-time staff resources to provide end-user support. This role requires knowledge of a wide range of general IT applications and hardware, but typically serves as the first point of contact to the end-users and will refer difficult issues to a more expe- rienced technician to solve. As such, this is a position that can be shared with other duties if not needed full-time, and is also an area where individuals with limited experience can be trained and developed. Contracted Resources General IT service firms provide end-user services through a variety of options ranging from full-time onsite resources to shared-use call centers around the world. This is a viable option for providing end-user support in some airport environments that do not have need for a full-time end-user support technician or have a business case that supports outsourcing. A contracted technicianâs hourly rate will typically be higher than that of a full-time technician,
Human Resources 49 but the overall value can be greater if the workload is performed more efficiently through outsourcing. This service can be bundled into a âmanaged servicesâ agreement with other IT services to provide specific services on an ongoing basis according to an agreed-upon response and resolution period. Specific IT product or service vendors provide end-user support for software applications or hardware components that require specific skills and, potentially, certifications. Typically, this would be components of a special system such as common/shared-use applications or parking revenue control systems. Agreements with these vendors is typically on a multi-year, fixed-cost support agreement but may also be provided through time and materials as needed. Consulting firms do not provide end-user support services. Shared Resources Shared resources may be used to provide end-user support in certain environments. Depending on the organizational structure of the airport, opportunities may exist for IT technicians to be shared between different departments of closely tied organizations. Sharing of resources is a viable option when dealing with typical IT software applications and hardware components, such as office productivity packages and computers. However, airport special systems typically require specific skills that other closely tied organizations do not possess. System/Network Administration System and network administration provides the ongoing application-level support required to keep IT services up and running. This includes routine tasks within software applications or hardware configurations that require specific training. It is a standard IT support requirement and can be provided remotely in many cases but may require onsite presence when direct access to a specific piece of hardware is required. The extent to which this support is needed and the appropriate IT delivery method are determined by the airportâs size and complexity. Airport Staff Resources Airports of all sizes often use full-time staff resources to provide system and network administration. This role requires expertise in specific IT applications and hardware, typically provided through formal training. System and network administration duties use different skill sets and are not typically performed by the same resource. Often, a system administrator will provide this role for multiple systems within the IT environment; however, large environments will have specialists for different systems. Contracted Resources General IT service firms provide system administration services through a variety of options ranging from full-time onsite resources to shared-use call centers around the world. This is a viable option for providing system or network administration support in some airport environ- ments that do not have need for a full-time system or network administrator or have a business case that supports outsourcing. A contracted administratorâs hourly rate will typically be higher than that of a full-time administrator, but the overall value can be greater if the workload is performed more efficiently through outsourcing. This service can be bundled into a âmanaged servicesâ agreement with other IT services to provide specific services on an ongoing basis according to an agreed-upon response and resolution period. Specific IT product or service vendors provide system administration support for software applications that require specific skills and, potentially, certifications. Typically, this would
50 Alternative IT Delivery Methods and Best Practices for Small Airports be components of a special system such as an airport operational database. Agreements with these vendors are typically on a multi-year, fixed-cost support agreement but may also be provided through time and materials as needed. Consulting firms do not provide system administration services. Shared Resources Shared resources may be used to provide system or network administration in certain environments. Depending on the organizational structure of the airport, opportunities may exist for system administrators to be shared between different departments of closely tied organizations. Sharing of resources is a viable option when dealing with typical IT software applications and network components such as email packages and network switches. However, airport special systems typically require specific skills that other closely tied organizations do not possess. Application Development Application development provides the software-based development required to enable specific IT services, such as web development, database design, or custom application configuration. It is a common IT support requirement for airports and can typically be provided remotely unless direct access to a specific piece of hardware requires onsite presence. The extent to which it is needed and the appropriate IT delivery method are determined by the airportâs size and complexity. Airport Staff Resources Some airports use staff resources to provide application development to some extent. This role requires expertise in specific IT applications, typically provided through formal training. Contracted Resources General IT service firms provide application development services through a variety of options ranging from full-time onsite resources to time and materials on an as-needed basis to fixed cost on a project basis. This is a viable option for providing application development in some airport environments that do not have need for full-time developers or have a business case that supports outsourcing. A contracted developerâs hourly rate will typically be higher than that of a full-time developer, but the overall value can be greater if the workload is performed more effi- ciently through outsourcing. This service can be bundled into a âmanaged servicesâ agreement with other IT services to provide specific services on an ongoing basis according to an agreed- upon response and resolution period. Specific IT product or service vendors provide application development support for software applications that require specific skills and, potentially, certifications. Typically, this would be components of a special system such as a multi-user flight information system. Agreements with these vendors are typically on a multi-year, fixed-cost support agreement but may also be provided through time and materials as needed or fixed cost on a project basis. Consulting firms do not provide application development services. Shared Resources Shared resources may be used to provide application development in certain environments. Depending on the organizational structure of the airport, opportunities may exist for application developers to be shared between different departments of closely tied organizations. Sharing of
Human Resources 51 resources is a viable option when dealing with typical IT software applications, such as websites and databases. However, airport special systems typically require specific skills that other closely tied organizations do not possess. Project Delivery Project delivery, for the purpose of this Guidance, refers to the workload necessary to support the end-to-end project life cycle. This typically includes effort by multiple resources both within and outside of the airport, such as airport staff (management, specific divisional stakeholders, and IT resources), consultants, general IT service firms, specific product or service vendors, and shared resources from partnering entities. In many cases, small projects for which the airport manager has the complete set of necessary skills will be executed internally. Formal execution of the complete project life cycle is typically seen in airports that have reached the Level 2 stage of IT maturity. Airports below Level 2 adhere to many of the principles required to implement the project; however, principles and processes that are required for ensuring the most efficient and effective outcomes are often underutilized due to resource constraints or lack of understanding of the value the principles and processes provide. Project delivery is addressed here in terms of the five standard project management processes: initiating, planning, execution, controlling, and closing. Across each of these, the following nine areas will be discussed: scope, time, cost, quality, communications, human resources, procurement, integration, and risk. Appendix A addresses strategic planning and master planning and references the need to develop a business case and project plan as master plan initiatives move forward. Project Management Processes Initiating Initiating a project is focused on defining a business case scope to address the stakeholder needs. This initiation process documents a description of the issue to be addressed and evaluates options against the status quo. It assesses the issue against the IT Strategic Plan; measures feasibility; determines high-level assumptions, risks, issues, and impacts; evaluates the benefits against the costs; and establishes a funding plan. Typically, this process either validates that the status quo is acceptable or gives rise to a new project. Planning During the planning phase, each of the areas addressed by the business case will be further developed and the specific plan that will guide the execution and controlling of the project will be created. The following areas are addressed during planning: ⢠Scope: Scope planning and scope definition ⢠Time: Activity definition, activity sequencing, activity duration estimating, and schedule development ⢠Cost: Resource planning, cost estimating, and cost budgeting ⢠Quality: Quality planning ⢠Communications: Communications planning ⢠Human Resources: Organizational planning and staff acquisition ⢠Procurement: Procurement planning and solicitation planning ⢠Integration: Project plan development ⢠Risk: Risk management planning, risk identification, qualitative risk analysis, quantitative risk analysis, and risk response planning
52 Alternative IT Delivery Methods and Best Practices for Small Airports The planning phase lays the groundwork for the project to be executed and controlled in an efficient and effective manner. The overall outcome of the project is highly dependent on the completeness and quality of the effort put into planning. Execution During the execution phase, the project moves forward according to the project plan defined in the planning phase. The following areas are addressed during execution: ⢠Integration: Project plan execution ⢠Quality: Quality assurance ⢠Human Resources: Team development ⢠Communications: Information distribution ⢠Procurement: Solicitation, source selection, and contract administration During a typical airport system or infrastructure project, this includes design, development, testing, and implementation by a vendor or contractor. The extent to which design and develop- ment are necessary depends on the customized nature of the project. Controlling The controlling phase is a series of processes that overlap the execution. It ensures that the project is executed according to the project plan and facilitates adjustments where necessary. The following areas are addressed during controlling: ⢠Communications: Performance reporting ⢠Integration: Integrated change control ⢠Scope: Scope verification and scope change control ⢠Time: Schedule control ⢠Cost: Cost control ⢠Quality: Quality control ⢠Risk: Risk monitoring and control The controlling processes are often the areas that are underutilized due to resource constraints or lack of understanding of the value they provide. During the course of the project, the effort associated with closely monitoring the performance and risk issues and the management of change control can be seen as unnecessary and overly burdensome when it âfeelsâ like everything is running smoothly. When a project begins to veer off course and its risks begin to materialize, it is often not obvious because the individuals in control of the problem areas believe they can recover and get back on track. In most cases this is possible and the risks are mitigated. However, when the risks cannot be mitigated and issues arise it may be too late to resolve them without a negative impact to the project. In this case, changes to scope, cost, time, or quality may be necessary. Closing The closing phase deals with the formal acceptance and closure of a project after all proj- ect activities have been completed to the satisfaction of the airport. The following areas are addressed during closing: ⢠Procurement: Contract closeout ⢠Communications: Administrative closure The closing phase is another area in which significant value can be lost. By the time the project activities are complete, resources are quickly released and reassigned to the next project, particularly in the case where a project has gone over budget or beyond its schedule. Unfortunately, what
Human Resources 53 results is a lack of adequate administrative closure. During this process, two key components need to be completed; project archives and lessons learned. Development of project archives is the creation of an organized set of documentation on the project. When this is adequately done, these archives become a valuable resource for future projects to reference. Development of lessons learned is a critical need, especially when the project experienced challenges. The lessons learned enables the evaluation of circumstances that created the challenges and leads to process change that will mitigate these challenges in the future. Project Delivery Methods Project delivery methods can be broken down into four distinct categories that cover most any large airport IT project. These include professional services, design-bid-build, design-build, and prequalified task order. In the airport industry, these services are primarily obtained through either a sole-source engagement or competitive solicitation process using a request for proposals (RFP), request for qualifications (RFQ), or request for bid (RFB). Solicitation Methods Sole-source engagements are typically only used when a specific provider is needed to perform a defined scope of work, for a dollar amount below the airport managerâs procurement threshold, requiring competitive bidding. The specific scope, schedule, and budget are negotiated directly with the provider and may require approval from the executive management or the board/city council depending on the entityâs procurement rules. RFP solicitations are used to competitively select a provider based on a proposed approach and cost for providing the solution, using multiple evaluation criteria to determine the contract award. Evaluation criteria are provided in the RFP in general terms including qualifications, experience, approach, and price. Additional criteria may be included addressing specific require- ments defined in the RFP such as use of local, small, minority, disadvantaged, or veteran-owned businesses. Point allocations are typically defined for each category based on the relative value that each category provides to the airport. The RFP should include the following: ⢠Background information needed to provide perspective for the project ⢠Project scope clearly stating in-scope, out-of-scope, and optional elements ⢠Requirements for meeting in-scope elements (the level of specificity determines the level of potential variance in proposed solutions) ⢠Solicitation schedule of events ⢠Evaluation criteria ⢠Proposal response requirements including contact information, question and answer instructions, proposal development and submission requirements, and other procedural requirements The RFP process may include a required or optional âpre-bidâ meeting to review specific information presented in the RFP and to address questions from the interested proposers. Responses to questions are generally published for all proposers in the form of an addendum to the RFP. Upon reviewing the submitted proposals, the evaluation committee may choose to create a âshortlistâ of the top proposals and have the proposers attend an interview onsite to address specific questions regarding the proposed solution. In some cases, where there may be ambiguity or inconsistency among proposed solutions, the evaluation committee may request a best and final offer (BAFO) giving the proposer or proposers an opportunity to formally clarify specific identified concerns with the proposal. The BAFO is not intended to allow proposers to change the proposed solution or to drive down the proposed costs but rather to provide clarity and consistency for an equivalent evaluation.
54 Alternative IT Delivery Methods and Best Practices for Small Airports RFQ solicitations are used to competitively select a provider based on qualifications, experience, and approach to providing a particular solution, using multiple evaluation criteria to determine the contract award. Unlike the RFP, cost is not a factor in the RFQ process, and evaluation criteria typically include qualifications, experience, and approach. Additional criteria may be included addressing specific requirements defined in the RFP such as use of local, small, minority, disadvantaged, or veteran-owned businesses. Point allocations are typically defined for each category based on the relative value that each category provides to the airport. The RFQ places a greater importance on obtaining the best firm to do the work with the understanding that the scope, schedule, and cost will be subject to negotiation. The RFQ should include the following: ⢠Background information needed to provide perspective for the project ⢠Project scope clearly stating in-scope, out-of-scope, and optional elements ⢠High-level requirements for meeting in-scope elements ⢠Solicitation schedule of events ⢠Evaluation criteria ⢠Response requirements including contact information, question and answer instructions, response development and submission requirements, and other procedural requirements The RFQ process may include a required or optional âpre-bidâ meeting to review specific information presented in the RFQ and to address questions from the interested respondents. Responses to questions are generally published for all respondents in the form of an addendum to the RFQ. Upon reviewing the submitted responses, the evaluation committee may choose to create a âshortlistâ of the respondents deemed to be most qualified and have the respondents attend an interview onsite to address specific questions regarding the proposed solution. The evaluation committee will then score the respondents based on the qualifications, experience, and approach. Additional points may be added to any of the respondents based on meeting additional criteria that support the local contracting goals of the organization. A final selection will be made based on the highest overall score, which may or may not be the most qualified respondent, depending on the impact of the additional criteria. The airport manager will enter into negotiations for the scope, schedule, and cost with the selected firm prior to contracting. If negotiations are unsuccessful, the airport manager may invite the second highest ranked firm to negotiate or may cancel the solicitation and restart the process. An RFB may also be referred to as a request for pricing, request for quotation, or invitation for bid (IFB). RFB solicitations are used when detailed specifications are provided by the airport for an exact required scope of work and typically used for specific products rather than services. RFBs may require experience and reference detail in order to qualify firms against a base set of criteria; however, the final selection is typically made based on the lowest cost among qualified bidders. The RFB should include the following: ⢠Background information needed to provide perspective for the project ⢠Project scope clearly stating in-scope, out-of-scope, and optional elements ⢠Detailed specifications for meeting in-scope elements ⢠Solicitation schedule of events ⢠Proposal response requirements including contact information, question and answer instruc- tions, bid response and submission requirements, and other procedural requirements Professional Services Professional services contracts are typically used for consulting support as either a fixed cost for a fixed scope or a time and materials basis. Depending on the cost of the engagement, these services may be procured as a sole-source through discretionary funds or bid as an RFP or RFQ. Services typically provided include ownerâs representative/implementation oversight, construction
Human Resources 55 administrator or manager, program or project manager, subject matter expert, planning, business analysis, testing, and quality management. Consultants engaged under a professional services contract are frequently used in conjunction with a design-bid-build, design-build, or contractor pre-selection type contract because they act as an agent of the owner, working in the interest of the airport, to ensure that the project meets its objectives. Design-Bid-Build A design-bid-build contract is a traditional project delivery approach in which a design team is first engaged to develop a design and specifications. A vendor or contractor is then solicited to bid on the project based on the design and specifications for a specific fixed cost. The design team is often retained to act as the airport managerâs agent during the implementation. Design-Build A design-build project delivery approach is one in which a single entity is engaged to provide both the design and build/implementation of a project. The selected entity may be a single firm or a team that includes both a design component and a build/implementation component. As part of this approach, there is no specific airport managerâs agent who is working in the sole interest of the airport. Prequalified Task Order A prequalified task order project delivery approach is one in which one or more entities are selected through a competitive qualifications process to provide services on a task order basis. As tasks are scoped and funded, qualified firms are either directly selected and negotiated with for a specific scope or asked to provide a proposal to be evaluated against other qualified firms. This approach may be used to provide professional services, design services, or build/implementation services. Table B10 provides an overview of the key opportunities and key challenges regarding project delivery methods. Project Resources Airport Staff Resources Many airport managers use staff resources to provide project delivery functions to some extent. This role requires expertise in specific project management or IT systems, which are typically provided through formal training or gained through experience. Contracted Resources General IT service firms provide project delivery functions tied to general IT services. These resources could be engaged through any of the noted delivery methods and can be effective in supplementing airport staff resources with specific technical expertise. This is a viable option for providing project design and implementation expertise in some airport environments that do not have need for full-time technical resources with that specific expertise or have a business case that supports outsourcing. This service can be bundled into a âmanaged servicesâ agreement with other IT services to provide specific services on an as-needed basis for an agreed-upon rate. Specific IT product or service vendors provide project delivery support for IT projects that require specific skills and, potentially, certifications. Typically, this would be a proprietary system that was provided by that unique vendor. These projects would typically be contracted as a design-bid-build or design-build under a fixed-cost-for-fixed-scope model.
56 Alternative IT Delivery Methods and Best Practices for Small Airports Consulting firms provide a significant level of project delivery services. All professional services noted above can be obtained through consulting firms, yet the resources may be engaged through any of the noted delivery methods independently or as part of a design or build team. Consultant resources can be effective in supplementing airport staff resources with specific expertise. This is a viable option for providing project design and implementation expertise in airport environments that do not have need for full-time resources with that specific expertise or have a business case that supports outsourcing. Shared Resources Shared resources can be an effective means of providing general IT or consulting-related project delivery services. Depending on the availability of resources with the needed expertise, this could be an effective means for supplementing airport staff resources. Reference ISACA (2012). COBIT 5 Framework for the Governance and Management of Enterprise IT. Rolling Meadows, IL. http://www.isaca.org/COBIT/Pages/Product-Family.aspx Key Opportunities Key Challenges Professional Services Work in the sole interest of the airport manager Expertise in the specific area needed Controllable costs Scalable and flexible resources allow for quick scope change Added cost to projects Additional procurement cycle Additional contract to manage RFP solicitation format may not result in the most qualified resource due to scoring impacts of low bid and disadvantaged business enterprise (DBE) contracting goals Design-Bid-Build Designer is selected for expertise in the specific area needed Designer is not conflicted with build and acts in best interests of the airport Vendor bids competitively on detailed specifications Designer supports airport during construction Designer is focused on technical design and may not fully understand or evaluate non-technical stakeholder needs Lengthy process due to sequential activities and additional procurement cycle RFP solicitation format may not result in the most qualified design resource due to scoring impacts of low bid and DBE contracting goals Design-Build Fast delivery system Single point of accountability Early cost and schedule commitment No airport managerâs agent Conflict of interest between design and build Non-competitive build costs Hidden reductions in quality to protect profit margin Incomplete design when build cost commitments are made results in probable change orders or quality reduction Lack of owner input and control Prequalified Task Order Saves time and internal resource costs by reducing procurement cycles Enables continuity of resources across projects Lack of competitive bidding for each task results in potential for higher costs for services Table B10. Overviewâproject delivery methods.
