ITS Extended Leadership Agenda July 12, 2012

1. ITS Extended Leadership Agenda July 12, 2012 News and Notes -Russell Sharp Disaster Recovery Update – Bob Condon WISE – Rick Smith

2. News and NotesRussell Sharp

3. ITS Extended Leadership- Future Topics Send suggestions to Adriene Radcliffe (adriene.radcliffe@yale.edu) August 23 Agenda How the Change Advisory Board Works – Paul DiBello and Lou Tiseo Technology Operating Committee (TOC) – Faith Brown ITS Website – Jane Livingston Wide Banding – Human Resources September 20 Agenda What is Digital Humanities? Project examples: Photogrammar Project, Philanthropy in Action – Ken Panko Technology support for Active Learning: The 17HLH TEAL Classroom October 18 Agenda Identity Management Update – Rod Gustavson Enterprise Service Bus Progress – Russ Battista Future Agendas • ERP Update – Marc Ulan • Introduction to the Service Board – Adriene Radcliffe • Information Security Update - Rich Mikelinich • Salesforce and Contactual technology platform - John Jibilian • Document Management landscape – Brian Wolson • Service Catalog - Ricardo Chavira • Email Modernization Update - Bob Condon • Vendor Management Update - Ed Frey • Yale School of Nursing Partnership with AITS:  DNP initiative • Solutions Design: Vision and Mission – John Jibilian • Knowledge Management – Dorothy Ortale

4. Disaster Recovery UpdateBob Condon

5. DR – Technical Recoverability Assessment • Objective: To evaluate Yale’s technical ability to recover in the event of a disaster • Utilized IBM’s Resiliency Services • Reviewed 47 key Infrastructure Services and Administrative/Academic Applications • In place of formal recovery time and recovery point objectives we drafted straw man RTOs and RPOs for responding to three types of disasters: • A disaster affects B25 West Campus requiring recovery in Central Campus DC’s. • A disaster affects all Central Campus DC’s requiring recovery in West Campus DC’s. • A “total event” affects both Central and West Campus areas requiring recovery at an external recovery site.

6. Develop Plan and Procedures Plan & Procedure Validation IBM’s BCRS Lifecycle Methodology Plan Build Run Understand business requirements and risks Develop solutions to increase resiliency objectives Execute, maintain and grow your programs Maintain Recovery Plans Manage to resilience objectives Develop Resilience Strategy Develop Resilience Strategy Implement Resilience Strategy Business Impact Analysis Business Impact Analysis Assess Risks • Risk and Resilience Assessments • IT Risk and Environmental Risk� • Availability Assessments • �Business Impact Assessment • �Resilience Program • �Recoverability Assessment • DR, CMP, BCP Plan/Procedure • High Availability Assessment /Planning • High Availability Strategy and Design • Resilient IT Strategy and Architecture Design • Resilience Governance, Policy, and Program Design • Plan Development • Crises Management, Disaster Recovery • Business Continuity, Operational Resiliency • Technical and Application Recovery Procedures� Governance

7. Yale Target RTO/RPO (Sample from assessment)

8. Conclusions – Yale Demonstrated Strengths • Positioned to leverage existing Central and West Campus data centers for Internal DR solutions. • In most cases there is an informal architectural placement consideration for servers, storage, network and application components in alternate data centers. • Yale has tested individual application restores. • Yale has rebuilt servers due to server failures. • Personnel interviewed showed high levels of experience, knowledge in their areas, and passion for achieving excellence. • Yale resources understand the need for DR and are moving in a positive direction. • Yale ITS has an extensive methodology for data protection on campus. • ITS understands the basic concepts and capabilities of business resilience and are generally agreed to by most interviewed. • Initial efforts are underway to integrate disaster recovery into the overall Yale ITS framework.

9. Conclusions – Yale Key Exposures • No documented recovery plan. • Yale has never tested or exercised a DR recovery. • Documented DR procedures are incomplete. • Subject matter experts, if available during an event, are expected to fill gaps for undocumented processes and procedures. • Single points of failure exist with no formal architectural process to avoid exposures. • In the disaster scenarios reviewed Yale would not recover all applications and infrastructure within required RTOs/RPOs. •  No formal resiliency governance exists which results in numerous gaps affecting recovery. Conclusion: Yale is not recoverable within the target RTOs and RPO

10. Next Steps • Establish a DR Governance program to lead and coordinate Business Continuity and Resiliency Program • Consider consolidating related projects that are underway into a single well-defined disaster recovery program.  Examples of such projects include • eGRC implementation • Data center controls audit • Network redesign (Part of response to Verizon security audit • Proceed with implementation of some of the high value but easily implemented improvements in parallel with the establishment of the DR governance and overall business resiliency planning

11. WISE ProgramRick Smith

12. WISEContinuous Improvement Process (WCIP) Overview 07.12.2012

13. Continuous Improvement Process Questions to be addressed in this presentation… • What is Continuous Improvement Process (CIP)? • How does it align with ITS Strategy? • How will CIP affect me and my organization? • What is PDCA? • What is WISE Quality Assurance? • How long will it take to reach WCIP maturity? • How does WCIP integrate with PDCA • CIO communication and expectations • Q&A

14. Continuous Improvement Process… What is Continuous Improvement Process (CIP)? • CIP is a management process for targeting and improving quality • It is a disCIPlined, client-centric approach to process improvement • To improve quality and client satisfaction • The methodology is based on a 4 step process called PDCA Provides a Standard and Fundamental Approach to ITS Process Improvement

15. Strategy Alignment and Integration UniversityMission, Goals and Objectives What is the ITS Service Strategy? BaselineAssessment Where are we now? MeasurableTargets Where do we want to be? What needs to change and why? (CIP) Service & Process Improvement Measurement & Metrics Did we get there?

16. WCIP Requirements • Executive commitment & participation • Organizational alignment • Focus on the right problems • Engage the right people • Provide simple, easy to use tools • Motivate the organization • Establish rewards • Create a culture of Quality How will WCIP affect me ?

17. WISE CIP Objectives -3 SD +3 SD Unstable Stable Control Baseline Maturity Time • Objectives: Baseline – Stabilize - Improve • Baseline process variation • Stabilize processes • Stabilize measures • Stabilize reporting • Continuous Improvement Process

18. Methodology for Continuous Improvement Process (CIP)

19. What is WISE Quality Assurance? • It begins with the organization’s adoption of a quality mindset, simple and easy to use tools and mentoring. All of these, over time can significantly improve organization quality, client satisfaction and operational efficiency. • Culture of Quality • Simple, easy to use tools • Mentoring • Process standardization

20. Plan Do Check Act (PDCA) Methodology • PLAN • Establish the objectives and processes necessary to deliver results

21. PDCA • DO • Implement the plan, execute the process, collect data

22. PDCA • CHECK • Study the actual results (measured and collected in "DO" above) and compare against the expected results (targets or goals from the "PLAN") to ascertain any differences.

23. PDCA • ACT • Request corrective actions on significant differences between actual and planned results. Analyze the differences to determine their root causes.

24. PDCA – 7 Step Integration Wisdom Data 1. Identify the strategy for improvement 2. Define what you should and will measure 7. Implement improvement 3. Gather the data 6. Present and use the information 5. Analyze the information and data 4. Process the data Knowledge Information

25. WISE Mentoring

26. Step 4 Full Capability WISE CIP Maturity Model Step3 Education Step1 Sr. Leadership Overview Step 2 Middle Management Support Acculturated Engaged Awareness Committed Commitment Capability Excited Interested CIP CIP Education and Deployment Quantifiable Results 1st Qtr FY‘13 4th Qtr FY ‘14 Objective: Quality Assurance Stability and Improvement Critical Success Factor: Community Satisfaction

27. WCIP Integration with PDCA Right Measures client & Operations Focused Improve Service Measured Right CIP Continuous Improvement Process OM’s, KPI’s and CSF’s PDCA Confirm Stability Baseline Processes Validate Process & Reporting Control Benchmark Current Process Performance Standardize Reporting Client & Service Focused

28. What do you think? What questions do you have?

29. THANK YOUCheck email for presentation link and meeting notes and please cascade this information