NotesOn: An IT Executive’s Survey And Checklist – Part I

Introduction (V1.4):

This is Part I of IV of my IT Executive checklist, or survey list.   It is focused on the first Overview of the company and its IT organization, its Infrastructure and its Software Environments and tools.  Over the years I’ve worked in quite a few different IT groups, large and small.  From experience I’ve learned that there are “things” I need to know almost as soon as I walk into an IT Group.  This is a living “work in progress” document that is the result of my “need to know”.  It will be upgraded and refined from time to time as conditions and “states of IT” change.

Survey Checklist Usage:

This checklist is not a “one time” tool.  It is certainly of great value when you are stepping into an new IT arena, but it can and should be also used iteratively.  Take a fresh copy out from “time to time” and walk and talk your way through your IT group.  When done compare the new results to prior versions.  Note changes and non-changes.  Note, also, what is missing that should be there, and vice-versa.

Except for the “Overview” sections, I have included a “value” column before each item for your use.  I have not assigned or attempted to assign weights to these items as this is not a “concentrate on this first” list and any weights would be arbitrary.   All items on this list are important.

The value column is merely a way to “grade” what is and isn’t working or is and isn’t present.  Use any value range you wish, but I would suggest keeping it simple, at most a scale of 0, 1, 2, 3 with 0 being non-existent or “un-acceptable” and 3 being present or “acceptable” but it could be as basic as 0 and 1.  One reason for keeping it simple is that when you are stepping into a new role you don’t, yet, have sufficient information, or experience, for proper, accurate, evaluations.  That will come with time but as you can’t wait until you “know everything” before making a decision this survey and a simple grading scale will help to get you close.

While each CIO/CTO should use this list for his/her group, every executive and manager on the team should as well, as they too need to understand each area, each area’s scope and each area’s strengths and weaknesses.  This is not a “top secret” document it is a survey and diagnostic document meant for use.

This checklist is broken down into several sections.  It starts out at a high level and then drills down into more detail.  Some of the data in these levels may appear to be redundant, but is not.  It’s the difference between the 50,000 and the 500 foot levels.

Finally, remember to look, ask, listen and verify.  And don’t forget to talk to your Techies.

Overview Section:

Company Overview – High Level:

This section provides a high-level overview as a reference point to the rest of the checklist.

IT Organization Structure Overview:

Your IT organization may not have personnel in all areas but the functions should be covered.

Infrastructure:

We’re starting, at a detailed level, with IT infrastructure because it is the foundation for everything else in your IT group.  One cannot assume it is present or present to a sufficient degree that you can “get, or keep, things cranking”.  It may be, or some of it may be, but don’t assume.  Look.  Ask.  Listen.  Verify.

General Survey Questions:

Infrastructure – Specialized Equipment:

Infrastructure – Telecommunications:

Infrastructure – Data Center(s):

Infrastructure – In-house Testing Labs:

In addition to the “standard” Development, QA and Production environments it is often necessary to have a separate “Testing Lab” that emulates the “real world” in which IT products operate.  This is especially true if the Data Center(s) has been out-sourced.

Infrastructure – Development Environments:

The IT Development teams need a separate, isolated, development environment for each server type, operating system, and, potentially, version.  Changes are never, ever, done directly to Production.  Ever.  Production data is never allowed on Dev servers.  Ever.

Infrastructure – QA Environments:

QA environments must exist.  Do not ever use Production as a “test” environment.  Unlike Dev, which can be scaled down, QA servers, etc., must duplicate the Production environment.  In QA, “close enough” isn’t.  Ideally QA should have separate servers; you can share QA and Prod servers but this has increased risks.  QA can have Prod data on it but scrubbing of PCI/PII data, etc., must be done to protect against security leaks.

Infrastructure – Prod Environment:

Nothing, save for emergency fixes, should be done in Prod directly.  All changes should be developed in Dev and tested and certified in QA.  Access to Prod servers should be limited and monitored.

Infrastructure – Disaster Recovery:

Disaster Recovery is, or should be, part and parcel of every infrastructure project and every new system build and install.  If you build it into the plan first it will be more cost effective than retrofitting (or the complete loss of systems and data).  Some of this data has been touched on above but is localized here for continuity.  Note:  per earlier SEC findings and recommendations DR Data Centers and/or backup tape storage should be at least 200 miles away from the primary production data center.  Though this has been changed to a “risk zone” separation standard the original advice is still a fair absolute minimum distance guideline to which to adhere.

Infrastructure – Business Continuity Management:

Disaster recovery is a part of and a partnership with Business Continuity planning/strategy.  DR takes care of IT systems.  BC addresses the people, buildings, communications, processes, procedures,  etc.  At a high level:

Software Environments / Tools:

It is important to know what the “softer side” of IT is comprised of, is it a hodge-podge of types, versions, legacy, and cutting / bleeding edges?  Is there a uniform purchase and acquisition strategy in place?  The following lists are not complete (there are too many packages around for that) but it gives an indication of the typical range to look for.  No order is implied on the lists, they are in the sequence I thought of them.

Operating Systems:

Database Servers / Engines:

Client-Server:

Web – Languages (Primary):

Web – Web Servers:

Web – App Servers:

Part II will cover IT Methodologies, Application Suites and Environments, Reporting Tools, Data Transformation Tools, Batch Schedulers, Backups, Data Encryption, Controls / Security.

Part III will address Applications Environment, IT Personnel and Client Relationships.

Part IV will conclude the series by reviewing Risks / Risk Management, Budgets, Company Policies and Goals/Objectives.

Hope this helps.

DP Harshman

PDF Link