7.4. Information and Communications Technology …...Council Agenda 26/08/19 City of Boroondara 219...

Council Agenda 26/08/19

City of Boroondara 219

7.4 Information and Communications Technology Strategy

Abstract

This report presents to Council the Final Draft of the City of Boroondara’s “Information and Communications Technology (ICT) Strategy 2019-2024” and seeks Council approval to adopt the Strategy.

The attached (refer Attachment 1) ICT Strategy covers a five year period from 2019-2024 and will be used to guide the planning, acquisition, deployment, management, provision, support and eventual decommissioning of information technology products and services. Interim reviews will be conducted across this period and the Strategy updated where applicable to ensure it remains current and aligned to Council requirements.

To support the development of the Strategy, Council engaged external expertise with extensive experience developing similar strategies for other organisations, both public and private. This expertise, when combined with Council’s, has produced a Strategy tailored to the City of Boroondara’s needs, influenced by Council Plans and Strategies, customer, community and staff expectations as well as external factors including industry trends, standards and regulations.

At the core of the Strategy is a comprehensive list of principles and guidelines to enable effective decision making with respect to ICT products and services. It also includes 12 enabling ICT capabilities to be further developed, acquired and/or provided through external arrangements and outlines how these capabilities will be established to deliver the services anticipated over the next five years.

A summary of key risks to the Strategy being successfully implemented and mitigation plans is also included.

Officers' recommendation

That Council resolve to adopt the Information and Communications Technology (ICT) Strategy 2019-2024.



Responsible director: Bruce Dobson, Director Customer Experience and Business Transformation

___________________________________________________________________

1. Purpose

This report seeks Council approval of the “Information and Communications Technology (ICT) Strategy 2019-2024”.

2. Policy implications and relevance to community plan and council plan

The Final Draft of the ICT Strategy provided as part of this Report aligns with the priority themes within the Boroondara Community Plan. Once implemented it will provide the ICT capabilities that support Council to achieve a number of the objectives within that Plan. More specifically, this report aligns closest to the theme of “Civic Leadership and Governance” and the following Strategies within it.

Strategy 7.2: Ensure transparent decision making through open governance processes.

Strategy 7.4: Provide enhanced online services to our community, placing the customer at the centre of everything we do, with a focus on making Council more efficient and effective.

Strategy 7.5: Ensure sound financial management while allocating resources to deliver strategic infrastructure and services that meet community needs.

Strategy 7.7: Provide risk management, property services and procurement systems in order to ensure efficient delivery of Council services to the community.

Strategy 7.8: Develop and implement a program of actions that will progressively move the organisation towards a customer-centric, high performing, engaged and collaborative culture that supports the successful delivery of customer experience and the Boroondara Community Plan.

3. Background

Council has undertaken an extensive body of work in FY 2018-19 that has already informed the technology strategy to support a variety of needs across Council. The most significant of these are the Enterprise Architecture initiative and the Customer First Business Case. These provide clear direction on technology capabilities required into the future and are relevant inputs to the overall ICT Strategy that is required for Council which considers a wide range of requirements.

An annual commitment in FY2018-19 exists to develop a new ICT Strategy. Completing this commitment was intentionally scheduled for late in the financial year to allow the works outlined above to be completed.

The Final Draft version of the ICT Strategy has been developed and is attached for Council approval (refer Attachment 1).



To support the development of the Strategy, Council engaged external expertise with extensive experience developing similar strategies for other organisations, both public and private. This expertise, when combined with Council’s, has produced a Strategy tailored for the City of Boroondara’s needs.

4. Outline of key issues/options

The ICT Strategy covers all aspects of Information and Communications Technology (ICT) for the City of Boroondara for the period 2019-2024. It has a strong emphasis on the ICT capabilities that need to be further developed, acquired and/or provided through external arrangements to support the evolving and future needs of Council. These capabilities have been defined through an assessment of the ICT-dependent Business Objectives and the ICT Objectives that they then inform as outlined in Table 1 below.

Most relationships between the Business Objectives and the ICT Objectives exist on a “many-to-many” basis, and similarly for the relationships between the ICT Objectives and the ICT Capabilities required to support the delivery of the ICT Objectives. Primarily, it is the combination of all ICT Capabilities that will work together to provide a complete set of capabilities to support the needs of Council in the future. Section 6.4 of the Strategy provides further details.

Table 1

Business Objectives* ICT Objectives** ICT Capabilities*** Enable and expand

Customer self-service opportunities

Establish a consolidated view of customer

Enhance Intra-Council collaboration

Realise customer goals thorough enhanced workforce experience

Proactive and personalised Council communications

Consolidate asset, geo-spatial and works insights

Simple and accessible business insights

Ability to respond to faster changing demands

Well Governed Cost Effective and

Value for Money Easy for Users Available and Secure Easy to Operate and

Support Business Aligned Innovative and

Adaptable Well Governed

Architecture, Business Analysis & Solution Design

People & Talent Management

Stakeholder & Customer Relationship Management

Information & Data Management

Program & Project Management

ICT Portfolio Management

ICT Operations End-User Services Information Security

Management Risk & Compliance

Management Supplier & Contract

Management ICT Performance

Management * Described in detail in Section 3 of the Strategy** Described in detail in Section 6.5 of the Strategy*** Described in detail in Section 6.3 of the Strategy



The 12 ICT Capabilities defined have been selected on the basis they are essential to support the needs of Council over the next five years. The ICT Capabilities were derived from an assessment of a range of different mainstream IT industry frameworks and standards.

The Strategy focuses on the activities that will be progressively undertaken to provide Council with the required uplift in ICT capability. As a strategic document, it is not intended to provide a detailed and prescriptive list of initiatives that an action plan for example would provide. Once established, these more mature capabilities will provide Council greater opportunities to leverage the value that well designed, implemented and managed ICT products and services can provide.

Details of the target state ICT Capabilities and list of corresponding activities can be found in Section 6.6 of the Draft Strategy attached.

The Strategy is also informed by and complements a number of existing Council Strategies and Plans to ensure there is suitable alignment. These include: Boroondara Community Plan 2017-2027 Council Plan 2017-2021 Customer Experience Improvement Strategy (CEIS) Customer First Program Enterprise Architecture

It is also influenced by other internal and external factors that include, amongst other things, mature and emerging technologies, ICT vendor product/service roadmaps, increasing customer interactions and consumer driven trends.

The role of the IT Department is also described (as opposed to ICT products, services and capabilities) to highlight how central it is to the ongoing development of the ICT Capabilities and defining how they will be provided.

5. Consultation/communication

The following stakeholders have provided input and/or been consulted with as part of the process of developing the ICT Strategy: Executive Leadership Team

IT Leadership Team

Chief Customer Officer

Lead Customer Support & Corporate Information

Principal Digital Strategist

Manager Library Services

Coordinator Innovation, Youth, Events & Marketing- Library Services



6. Financial and resource implications

It is anticipated many of the activities outlined within the ICT Strategy will be managed through existing or foreshadowed budgets. As further analysis and timing of activities is completed, any additional funding needs to achieve Council’s ICT capabilities would be sought through the annual planning and budget process.

Some service delivery changes may necessitate a change from a capital funding model (where technology is purchased) to an operating funding model (where services are paid for).

7. Governance issues

The implications of this report have been assessed in accordance with the requirements of the Victorian Charter of Human Rights and Responsibilities.

The officers responsible for this report have no direct or indirect interests requiring disclosure.

8. Social and environmental issues

There are no direct social or environmental issues in the outcomes of the actions outlined in this paper.

Manager and report officer:

Haydon Sampson, Chief Information Officer

Information & Communications Technology Strategy

2019 - 2024 Responsible Directorate: Customer Experience and Business Transformation Authorised By: Council Date of Adoption: TBA Review Date: August 2024 Document Type: Administrative Classification: Public


City of Boroondara Attachment 7.4.1 224

Classification: Public | Information & Communications Technology Strategy 2

Table of contents

Guide to this document .............................................................................................. 3

Influences on the Strategy ................................................................................... 5

The Role of the IT Department ............................................................................ 5

Review and Reporting ......................................................................................... 6

1. Introduction .......................................................................................................... 7

1.1 About this Strategy ...................................................................................... 7

1.2 How to use this document ........................................................................... 7

1.3 Terminology ................................................................................................. 8

2. Strategic context .................................................................................................. 9

2.1 Council Plans and Strategies .................................................................... 10

3. Business and ICT Objectives ............................................................................. 13

4. Mature and Emerging Technologies .................................................................. 14

5. Evolving Customer Expectations ....................................................................... 21

6. Future ICT ......................................................................................................... 24

6.1 ICT Objectives ........................................................................................... 24

6.2 Role of the IT Department ......................................................................... 24

6.3 ICT capabilities .......................................................................................... 27

6.4 Relationships between Business Objectives, ICT Objectives and ICT Capabilities ........................................................................................................ 31

6.5 ICT Objectives and Principles ................................................................... 34

6.6 Target State ICT Capability ......................................................................... 37

7. Capability Delivery Options ................................................................................ 46

7.1 Identifying the Capability Delivery Model ..................................................... 48

8. Risk assessment ................................................................................................ 49

9. Review and Reporting ....................................................................................... 52

10. Glossary and References .................................................................................. 53




Guide to this document

This document:

Describes what the ICT Strategy covers and who its intended audience is

Describes the strategic context and how it fits into the broader planning framework for the City of Boroondara

Summarises Council plans that inform and complement the ICT Strategy

Summarises the Business Objectives that are derived from other Strategies and Plans and identifies the resulting ICT objectives that will deliver these

Describes both mature “market ready” and emerging technologies that may be of benefit to Council

Describes what customers are likely to require from ICT during the life of the Strategy and the resulting impact on ICT service requirements

States the vision and the role of the IT Department, illustrating how these relate to Council Departments and stakeholders

Sets out twelve ICT Capabilities which are central to being able to deliver the services anticipated over the next five years

Identifies design and service selection principles which will be applied to ensure that requirements are met

Details, against each ICT capability, the principle strategic activities required

Outlines the alternative ways in which each capability might be delivered, and summarises the criteria that will be used to make a selection

Identifies key risks to the Strategy being successfully implemented and mitigation plans

Explains how the Strategy will be reviewed




Executive Summary This Strategy covers all aspects of Information and Communications Technology (ICT) for the City of Boroondara for the period 2019-2024. It has a strong emphasis on the ICT capabilities that need to be further developed, acquired and/or provided through external arrangements to support the evolving and future needs of Council. These capabilities have been defined through an assessment of the ICT- dependent Business Objectives and the ICT Objectives that they then inform as illustrated in Figure 1 below:

Figure 1

This Strategy does not contain a detailed schedule of initiatives, but instead focuses on a number of activities to be progressively undertaken that will lead to the required capability levels during the life of the Strategy. Once established, these more mature capabilities will provide Council greater opportunities to better leverage the value that well designed, implemented and managed ICT products and services can enable.

Council will also assess how best to provide these capabilities which includes internally provided (the current default position), or via external capabilities such as a managed services arrangement or through cloud service providers.

Business Objectives

B-1: Enable and expandCustomer self-serviceopportunitiesB-2: Establish a consolidatedview of customerB-3: Enhance Intra-CouncilcollaborationB-4: Realise customer goalsthorough enhanced workforceexperienceB-5: Proactive and personalisedCouncil communicationsB-6: Consolidate asset, geo-spatial and works insightsB-7: Simple and accessiblebusiness insightsB-8: Ability to respond to fasterchanging demands

ICT Objectives

IO-1: Well GovernedIO-2: Cost Effective and Valuefor MoneyIO-3: Easy for UsersIO-4: Available and SecureIO-5: Easy to Operate andSupportIO-6: Business AlignedIO-7: Innovative and Adaptable

ICT Capabilities

IC-1: Architecture, BusinessAnalysis & Solution DesignIC-2: People & TalentManagementIC-3: Stakeholder & CustomerRelationship ManagementIC-4: Information & DataManagementIC-5: Program & ProjectManagementIC-6: ICT Portfolio ManagementIC-7: ICT OperationsIC-8: End-User ServicesIC-9:. Information SecurityManagementIC-10: Risk & ComplianceManagementIC-11: Supplier & ContractManagementIC-12: ICT PerformanceManagement




Influences on the Strategy

Through the five year life of the Strategy, it is anticipated opportunities will arise for Council to exploit a number of mature “market ready” technologies as well as those that are still emerging but will become mainstream over this time. Although it is not proposed any particular technology outlined in the Strategy will necessarily be adopted by Council, it is essential Council maintains an ongoing awareness of these to ensure foundational ICT decisions are made that allow them to be integrated into the ICT environment if required.

Trends in technology and what is imposed by other service providers are major contributors to what our customers and community expect Council to deliver. Choice of channel and accessibility to services 24/7 from a variety of different devices directly affect decisions Council will make about ICT products and services. The ICT Strategy must be able to accommodate these needs which will continue to change and evolve and as well as those driven by technology vendors and service providers.

The Role of the IT Department

Council’s IT Department will be central to the success of the ICT Strategy and will partner closely with the Council’s Directorates, Departments and Stakeholders to ensure there is close alignment between their needs and ICT products and services in place. To reinforce this required role, a Vision statement for the IT Department has been developed; this being:

“To be a customer centric and future-focused, reliable provider of contemporary ICT services for the City of Boroondara.”

Decisions on which ICT products and services will be implemented and how they will be delivered and managed, will be made through strong ICT governance practices. ICT governance, cost and value for money principles will underpin all decisions and must also consider other factors such as Ease of Use, Operational Complexity and Support, Business and Architectural Alignment, Availability, Scalability and Security.




Review and Reporting

The IT Department will undertake periodic reviews of the Strategy with progress updates against each activity. The details of the timing and sequence of each activity will be determined through Council’s annual planning process, with progress reported on through the existing Annual reporting framework.

A major review of the Strategy will occur in mid-2024 culminating in a new ICT Strategy being developed.




1. Introduction

1.1 About this Strategy

This is the City of Boroondara’s Strategy for Information and Communications Technology (ICT) spanning the period 2019 - 2024. This covers all aspects of information technology (IT), telecommunications technology (CT) and operational technology (OT).

The ICT Strategy will guide the planning, acquisition, deployment, management, provision, support and eventual decommissioning of information technology products and services. Whilst it is a five year strategy, it will be subject to interim reviews across this period and updated where applicable to ensure it remains current and aligned to Council requirements. It is not intended to be prescriptive, but provides principles and guidelines that enable effective decision making and flexibility to take advantage of emerging technologies and industry capabilities in the future.

This strategy leverages and complements extensive prior work undertaken in 2018, which has allowed many of the building blocks of this Strategy to be defined. It has a strong emphasis on enabling Council staff, through the use of technology, to provide more efficient and effective services for our community and customers in a secure and cost effective way. This encompasses all areas within Council, irrespective of whether staff are customer facing or undertake indirect or back-office activities.

1.2 How to use this document

The ICT Strategy is more than a strategy for the IT Department as it sets out the intentions of Council for ICT over a five year period. It therefore affects all parts of Council and will be used as a guide for decision makers both within the IT Department and more widely across Council.

The strategy will be used:

by IT staff when developing annual and multi-year ICT activity and investment plans.

by non-IT staff to help inform ICT related decisions and level of involvement required from the IT Department.

by other stakeholders, such as suppliers, who require an understanding of Council’s ICT strategic direction.

The strategy is not intended to be a locked, prescriptive plan. As this Strategy and the broader Council plans are implemented, the value of the Strategy is to set out a




common framework for decisions rather than a fixed plan that is immune to changing circumstances.

1.3 Terminology

This document is written for non-technical readers. Technical terms are unavoidable, but these are explained unless they are generally understood. In particular:

Customers (who might also be described as citizens) are individuals and organisations who have any valid reason to access information or services provided by the City of Boroondara.

Staff include all employees and contractors of City of Boroondara who are involved directly or indirectly in providing information or delivering services to customers.

Users have direct interaction with Council ICT either directly using hardware or indirectly using software, whether on site or off Council premises.




2. Strategic context

Information and Communication Technology exists to support the needs of Council. This Strategy is therefore based on the requirements of Council and is informed by the business and technology drivers that shape these requirements.

The ICT Strategy considers general external and internal factors whilst also being guided by specific and overarching Council strategies and plans as illustrated in Figure 2.

Figure 2




2.1 Council Plans and Strategies

Boroondara Community Plan 2017-2027

The Boroondara Community Plan 2017-27 (BCP) sets out the 10-year vision for the City of Boroondara’s future based on the values, aspirations and priorities the Boroondara community told us were important to them. As Council’s key strategic document, it also guides decision making, and will directly inform the Council Plan, budget processes, and Council strategies, plans, policies and actions.

Council Plan 2017-21

The Council Plan identifies key themes which have a direct impact on the community and provides detailed strategies to deliver on each theme. The objectives of the themes are to deliver these outcomes:

i. Community services and facilities are high quality, inclusive and meet a variety of needs now and into the future;

ii. Inviting and well-utilised community parks and green spaces;

iii. Our natural environment is healthy and sustainable for future generations;

iv. Protect the heritage and respect the character of the City to maintain amenity and liveability whilst recognising the need for appropriate, well-designed development for future generations;

v. Travel options that are connected, safe, accessible, environmentally sustainable and well-designed;

vi. A vibrant local economy and shops that are accessible, attractive and a centre of community life;

vii. Ensure that ethical, financial and socially responsible decision making reflects community needs and is based on principles of accountability, transparency, responsiveness and consultation.




Customer Experience Improvement Strategy (CEIS)

This strategy seeks to improve the customer experience by providing:

A seamless, single view of the customer; Streamlined, low friction pathways to access services; Consolidated contact and touch points; Channels which are consistent and convenient; Channel efficiency balanced with a good experience; Efficiency through ability to target channel use; Insight-driven service delivery which is proactive and responsive; Agility in adapting service delivery to ensure it echoes the needs of the

community; Intuitive self-service pathways to services; Choice and convenience which empower customers; Resources that are able to be optimally deployed; A Council culture of natural innovation and collaboration; Internal operations and workflows that support our customer experience

improvement delivery.

Customer First Program

This program will help Council deliver better customer service, be more efficient and engage better with customers. The Program has two timeframes: Phase 1 to 2022 and Phase 2 to 2024. These phases match the timelines for this ICT Strategy.

The deliverables for Phase 1 include: a consistent and secure payment experience, regardless of the channel, device,

or location; increased self-service capability, reducing the need to request Council services; faster processing of requests, transactions and refunds; the ability to easily subscribe to, give feedback on and see progress on programs

and consultations; the ability to interact with some Council services anywhere, anytime, using any

device.

The deliverables for Phase 2 include: improved visibility and quality of property and rates information and visibility of

customer history through a Customer Portal, which will allow users to view requests, transactions, and their progress;

the ability to tailor information received from Council; the ability to find, compare, and book a range of Council services and facilities

online.




Enterprise Architecture

Council undertook an extensive exercise in 2018 to identify and establish a roadmap to achieve an optimal technology landscape. This initiative ensured there was traceability between Council’s business goals and objectives and where technology products and services are required to be an enabler. The initiative undertook the following assessment:

Where is Council today? (Current State); Where does Council need to be? (Target State); How and what is required for Council to implement required future capabilities?

(Transition Roadmap); How does council maintain and mature its enterprise architecture? (Architecture

Governance).

A range of recommendations and initiatives were identified to uplift and align Council’s technology landscape and capabilities with the future needs of Council which have been used to significantly inform this Strategy.




3. Business and ICT Objectives

The Business Objectives outlined below align and complement the objectives defined within Council’s Customer First Program and the Enterprise Architecture Target State. The Business Objectives then together inform the ICT Objectives (along with supporting principles) as outlined in Figure 3 below and Section 6.5, with details of the direct and indirect relationships outlined in Table 5, Section 6.4.

Figure 3

Business Objectives

ICT Objectives

B-1: Enable and expand Customer self-serviceopportunities:

Discoverable and accessible processes and servicesSingle view of Council services and self-serve optionsReal-time exposure of Council services

B-2: Establish a consolidated view of customer:Consolidated and connected views of customer and serviceComprehensive view of customer within Council

B-3: Enhance Intra-Council collaboration:Remove process and cultural barriers within Council to deliverbetter serviceTighter management of process and an end-to-end view acrossCouncilGreater collaboration across Council in providing service

B-4: Realise customer goals thorough enhancedworkforce experience:

Simple processes and compliance with connected processingAutomated activities for speed, accuracy and efficiency, freeingup staff for genuine value adding workPaperless and mobility frameworks which allow enhancedcustomer service modelsStrategic ICT resource management which will broaden andenrich ICT and other staff roles in order to raise general skilllevels and personal commitment

B-5: Proactive and personalised Councilcommunications:

Better communications to all stakeholders to improve servicequality, and encourage better decisionsCommon capability to support integrated communications

B-6: Consolidate asset, geo-spatial and works insights:Holistic and integrated view of Council assetsBetter asset planning functionality supported by geo-spatialdata

B-7: Simple and accessible business insights:Connected information from common data sets allowingflexible analysis of all aspects of Council business

B-8: Ability to respond to faster changing demands:Appropriate skills and competencies, as well as more agilemethods, to support innovation and emerging customerexpectationsStrong governance to ensure sound management ofresources and deliveryTraining Needs Analysis followed by requisite training toenable council staff to be able to deliver this Strategy

IO-1: Well GovernedDesign for continuous incremental improvementEmbed capability focused governance

IO-2: Cost Effective and Value for MoneyICT initiatives will be fit for purpose and affordable, but alsoneed to deliver business benefit and value

IO-3: Easy for UsersAutomate transactions and processesDesign for self-serveDesign for 24/7, mobility and device flexibilityEnsure customer centricity in all servicesDesign for Accessibility

IO-4: Available and SecureManage risk and security by designUse mature standards based solutions

IO-5: Easy to Operate and SupportDesign for, and preference “cloud” servicesFavour “off the shelf”Align process to system limitsReduce, consolidate and simplify technologyUnify information and data

IO-6: Business AlignedPrioritise investment and effort in line withBoroondara corporate strategies

IO-7: Innovative and AdaptableCater for massive scale changeBuilt-in geo-referencingDesign for IoT and connectivityDesign for flexibility

Informs




4. Mature and Emerging Technologies

An environmental scan of different market research and advisory services has identified a wide range of technologies which the Strategy may need to support the assessment of and potential implementation. These have been categorised as either:

Mature: Which are “Market Ready” technologies ready for use in their entirety or partially;

Emerging technologies: Which are technologies not yet ready for mainstream adoption but are likely to mature to this point during the life of the Strategy.

As part of realising the Business Objectives, this Strategy needs to take these technologies into account, although it is not proposed that any particular technology listed in Table 1 or Table 2 below will necessarily be adopted by Council over the Strategy period. However, it is essential Council maintains an ongoing awareness of these and takes the opportunity to leverage one or more of these technologies if a suitable need presents itself in the future.

Mature Technologies:

Table 1

Mature Technologies Description Potential Council Benefit

Intelligent devices (including “Internet of Things” (IoT))

The embedding of sensors in a wider range of devices, both to monitor and control ‘things’ will change the nature of some services and create demands for new ones.

Sensors and intelligence will be integral to equipment acquired by Boroondara. An example is in vehicle automation where sensor data can be used to proactively trigger servicing or signal potential equipment failures

Multi-cloud

The move to the public cloud will likely require more than one cloud provider for software as a service (SaaS), Infrastructure-as-a-Service (laaS) or Platform-as-a-Service (PaaS) offerings. One provider may be better-suited for one application, while a second

The move to multi cloud/service based architecture will require a new set of staff skills, integration patterns and delivery models. Potential service areas include:

Office productivity SIEM/Security services Identity services Telephony services





provider may be better-suited for a different one.

Infrastructure as a service

Artificial Intelligence (AI) & Machine Learning

Applied AI and advanced machine learning give rise to a range of intelligent implementations. These exploit physical devices (such as robots, autonomous vehicles and consumer electronics), as well as apps and services (such as Virtual Personal Assistants and smart advisors eg chat bots).

These implementations will be delivered as a new class of intelligent apps and things, and provide embedded intelligence for a wide range of existing software and service solutions. The data science needed to create these systems is complex and requires AI and machine learning mainly through packaged intelligent apps and things, or through packaged "models as a service" that can be built build into custom applications.

AI and Machine Learning will provide the basis for key customer facing self-service features.

A self-service virtual customer assistant platform, made up of chat bots, artificial intelligence (AI), voice recognition and predictive analytics would allow customers to access Council services when staff are not available.

AI will require a new range of staff skills in order to implement and or support these services.

Collaboration Suites

A collaboration suite is software that adds broad social networking capabilities to work processes. A collaboration tool creates a workflow of information to specific teams and their members. This allows

Implementing an enterprise collaboration tool set will change the way projects/teams/individuals work.

E.g. siloed/individual to more openly available/accessible across the business.





individuals to share ideas and their talents with other members so that the task/query can be finished both efficiently and effectively.

Radio Frequency Identification (RFID)

&

Near-field Communication (NFC)

RFID tags are a type of tracking system that uses smart barcodes in order to identify items. RFID is short for “radio frequency identification,” and as such, RFID tags utilize radio frequency technology. These radio waves transmit data from the tag to a reader, which then transmits the information to an RFID computer program. RFID tags are frequently used for merchandise, but they can also be used to track vehicles, pets, and even people (for example patients with Alzheimer’s disease).

RFID technology is already being used in Boroondara libraries for asset management. It is likely that this technology can be expanded for use with other Council assets.

Process automation

Process automation refers to the use of digital technology to perform a process or processes in order to accomplish a workflow or function.

Closely related to AI, where possible processes can be automated and self-serve.

Similar to AI, this will require a new range of staff skills in order to implement and or support these services.

Image recognition

Image recognition is the ability of a system or software to identify objects, people, places, and actions in images. It uses machine vision technologies with artificial intelligence and trained

The Council could use image recognition to interpret and analyse data coming primarily from visual sources for a number of uses such as identifying objects/assets as part of a service request, face detection for security purposes,





algorithms to recognise images.

and populating credit/debit card details in on line forms.

This will require a new range of staff skills and applications in order to implement and or support these services.

Application Programming Interfaces (API’s)

Open data is publishing data in a form that anyone can access, modify and reuse in a form that is machine-readable and is as complete and granular as possible. This is achieved using API’s (application program interfaces), generally in an API gateway or portal. Numerous open data initiatives exist at all levels of government.

Moving to a data access model based on API’s will require an uplift in data quality and governance processes as well as integration patterns, information security and ICT staff skills.

Smart spaces

Smart spaces connect and coordinate technologies to create intelligent environments.

Within the life of the Strategy it is highly likely that Boroondara will upgrade its premises to integrate access, heating and cooling, service provision to take advantage of efficiency and control aspects of smart spaces. While these technologies are not radically new, they will place additional demands through new applications and 24/7 reliability.

3D Scanning

3D scanning is the process of analysing a real-world object or environment to collect data on its shape and appearance

Provides the ability to scan and analyse land and buildings in high detail which could provide meaningful applications in the Building and Planning areas of Council or for Council’s own building related projects.




Emerging Technologies:

The following table summarises a range of emerging technologies that may potentially benefit Council over the period of the Strategy, with some likely to become fully “market ready” in the next 1-2 years.

Table 2

Emerging Technology Description Potential Council Benefit

Blockchain

Blockchain provides irrevocable transaction records. While the technology is still controversial, early adopters are developing real world solutions.

User areas such as Library and Property & Rates may explore blockchain technologies. ICT capabilities may need to support software tools and architectures that are blockchain ready.

Robotics, Artificial Intelligence (AI) and Autonomous Things

These technologies significantly build on the current ability of non-human actors to make decisions and act autonomously. For example, it is likely that drone technology will become mainstream within the Strategy period but that autonomous vehicles are further away.

Standards are emerging, typically in each separate field, and broader regulation is still unclear.

Autonomous things are likely to be relevant to limited areas of Boroondara operations, principally through off-the-shelf hardware. Business areas are expected to seek to trial and test such equipment and will need an ICT framework that these technologies can connect to.

Augmented analytics

Machine learning and significantly more sophisticated analytical tools will offer deeper insights into increasingly connected data. Concurrently, expectations from users will rise as the potential is understood.

It is likely that there will also be increased pressure from the

Business areas are likely to seek to acquire and deploy more powerful analytical tools. These in turn will place new demands on data sets and therefore challenge the robustness of the data architecture and integration.

Customers will place pressure on Council to provide real time access to data and their





public to access raw council data to undertake their own analytics.

analytics will place pressure on accuracy and completeness of data sets that are currently internal only.

5G and associated technologies

The imminent deployment of widespread 5G technologies will massively increase the capacity to connect with lower latency and in higher data volumes. The 5G infrastructure increasingly integrates the network model and this will affect the relationship between telecommunication service providers and customers. Meanwhile, customer expectations for high bandwidth/fast services such as video will increase as a result of their consumer experiences with 5G.

Internal users and external customers will expect access to higher quality ICT services, in much greater volumes and across a wider range of applications.

5G will enable devices that are currently out of wired or wifi range to be affordably connected, increasing the volume and type of devices ICT capabilities must support. 5G may also reduce (or even eliminate) the need for physical cabling at Council sites.

User areas may seek to acquire, within the timeframe of this Strategy, complex software tools with features such as 3D video interactivity, 3D virtualisation and real time applications that are currently restricted by slow speeds and interrupted connectivity.

Immersive technologies

Immersive technologies allow additional contextual information to be provided to users. Augmented reality is an example of this.

These technologies will enable Council staff to draw from internal and external data to support activities such as building maintenance and, asset management. The Enterprise Architecture will need to accommodate this, and ICT





capabilities will be needed with new skill sets to support such applications.

Open and ‘big’ data

Access to and exploitation of potentially massive, connected data sets, including exposure of raw data to online (including anonymous) public access

Big data will create previously unimagined requirements for data access amongst staff. It will need to be underpinned by robust data architectures and confidence in data quality. Demand for public data access will require guidance for user areas whose data is exposed.

Commercial Grade Drones

Remotely controlled small airborne vehicles

Future delivery models may incorporate drones as part of the service offering. These will need to be integrated into asset, location, identity and other core systems.




5. Evolving Customer Expectations

The table below identifies some of the key technological trends that will drive changes in how customers expect to interact with Council and potential impacts of these on ICT services within Council.

Table 3

Theme Customer expectations

Impact on demand for ICT services

Governance and value

A Customer: wants secure, stable and

affordable Council services wants modern Council

services that exploit the power of contemporary technology

wants Council to spend public money wisely

Third party (typically pooled) provision of storage and processing services replacing Council software and other non-hardware services

Development of existing staff and recruitment of an increasingly qualified and specialist ICT workforce to meet growing complexity in ICT skill needs

Enhancing governance models to deal with an increasing complexity and formalization of project, program and development disciplines, especially by exploiting existing and emerging standards

Channel

A Customer wants to: transact online or interact

without visiting Council premises

choose whether to deal with a person for routine matters

be able to choose how to interact with Council and to change channel for my convenience during an interaction

Access to more Council information and services via online connections

Deduction (rather than processing) from inputs and/or data (Artificial Intelligence)

Capacity to undertake a transaction via multiple channels, including switching seamlessly between channels during the transaction






Accessibility

A Customer wants to: access the service wherever

they are and at any time have an answer now and not

have to wait

Access from hand held devices AND access from any location provided a connection exists

Real time rather than delayed transactions, information provision and decisions

Location

A Customer wants: the system to know where ‘it’ is

or “where I am” without wanting to put a location into a system

Geo-referencing of assets, resources, people, events - including location and proximity detection

Interface A Customer wants to: choose when to talk and when

to type

Integration of human voice for input into Council systems

Simplicity

A Customer: doesn’t want to deal with

multiple systems or interfaces wants transactions to be

simpler

User (especially end user) access to multiple systems or databases from a single interface

Improvement to customer facing or internal business processes, critically including non-system delivered steps, but supported by all dimensions of technology

Functionality

A Customer: wants to be able to collaborate

with others including staff members when working or transacting with Council or using Council services

wants Council to exploit the connected functionality available in all sorts of technologies to make interaction

Capacity for users (including customers) to work together concurrently rather than iteratively/ sequentially

Connection to and integration with devices that are capable of reporting status, responding to instructions and intelligently interacting directly with users. (Internet of Things)






with Council easier Development of existing staff and recruitment of an increasingly qualified and specialist ICT workforce to meet growing complexity in ICT skill needs

Enhancing governance models to deal with an increasing complexity and formalization of project, program and development disciplines, especially by exploiting existing and emerging standards

It is important to note that the fast-moving pace of change means that this summary is likely to alter during the life of the Strategy as new technologies emerge and as other service providers condition the expectations of our customer.




6. Future ICT

6.1 ICT Objectives

The customer, staff and stakeholder expectations placed on our ICT products and services means ICT Objectives need to be defined to support the delivery of this Strategy. These are listed below and are supported by ICT Principles that help guide ICT related decisions. Please refer to Section 6.5 for further details:

IO-1: Well Governed IO-2: Cost Effective and Value for Money IO-3: Easy for Users IO-4: Available and Secure IO-5: Easy to Operate and Support IO-6: Business Aligned IO-7: Innovative and Adaptable

6.2 Role of the IT Department

Council’s IT Department will be central to the success of the ICT Strategy and will partner closely with the Council’s Directorates, Departments and Stakeholders to ensure there is close alignment between their needs and ICT products and services in place. To reinforce this required role, a Vision statement for the IT Department has been developed; this being:

“To be a customer centric and future-focused, reliable provider of contemporary ICT services for the City of Boroondara.”

Decisions on which ICT products and services will be implemented and how they will be delivered and managed, will be made through strong ICT governance practices. Cost and value for money principles will underpin all decisions and must also consider other factors such as Ease of Use, Operational Complexity and Support, Business and Architectural Alignment, Availability, Scalability and Security.

In the target state, the IT Department will work in partnership across Council, while leading the direction, procurement and governance of ICT as outlined in Figure 4 below. The IT Department will be the primary custodian of Council wide ICT related Strategies, Standards, Policies and Principles that underpin acquiring, managing and supporting appropriate information technology for Council.




These roles can be summarised under eight broad headings below, with some examples provided:

i. ICT Strategy - this Strategy and future ICT Strategies

ii. Technology Product and Service Selection; which includes: Requirements Development Market Insights and Research ICT Architecture, Technology and ICT Standards Alignment ICT Service Delivery Capability Selection ICT Sourcing Strategies Financial Analysis

iii. Technology Solution Governance and Guidance: which includes: Solution Design & Implementation Architecture & Solution Governance

iv. ICT Standards; which includes: Enterprise Architecture Project Management Information Management Information Security Disaster Recovery Hardware & Software (vendors, versions, configurations etc.) Applicable industry standards

v. ICT Principles - as defined in Section 6.5

vi. ICT Policies; which includes: Information Security Acceptable Use of Council Technologies

vii. ICT Processes; which includes: Incident, Problem, Change & Configuration Management Service Request Management Information Security Management Disaster Recovery Management & Execution

viii. Contract and Relationship Management of ICT Suppliers and Service Providers; which includes:

Account Management Service Assurance & Performance Reviews Contract Reviews, Renewals & Extensions ICT Procurement Leadership and Support




Figure 4

ITDepartment

Roles

ICT Strategy

TechnologySolutionGovernance& Guidance

TechnologyProduct &ServiceSelection

ICT Standards

ICT Principles

ICT Policies

ICT Processes

Contract andRelationshipManagement of ICTSuppliers & ServiceProviders

In partnership across Council, ITwill provide technology support

and guidance

While leading ICT direction,procurement and governance

of ICTervrr ice

TeSoGo&

IC




6.3 ICT capabilities

Effective delivery of these roles and the objectives they support requires the IT Department to develop and sustain a set of core ICT capabilities. This strategy identifies twelve capability groups which cover the full IT Department role and support both the business and ICT objectives.

The description of these capability groups is shown in Table 4 below.

Table 4

ICT Capability Capability Description

IC-1: Architecture, Business Analysis & Solution Design

Creates a conceptual framework for the whole ICT scope of work: Establishes standards and guidelines upon which

decisions related to ICT investments and solutions can be confidently made.

Ensures investments align with Enterprise Architectural Principles and that Solutions align to business requirements.

Provides Technology investment advice. Provides Architectural governance and guidance to

programs and projects. Applies strong knowledge of Council’s services and

processes to understand requirements and provide business insights that inform solutions to be implemented.

IC-2: People & Talent Management

Ensures there is ongoing alignment of the required skills and capacity to achieve the required ICT outcomes.

Includes resource planning (to align supply with demand), organisational change management, IT Department staff training and identification of professional development opportunities that are aligned to the strategic direction of ICT.

IC-3: Stakeholder & Customer Relationship Management

Ensures Stakeholders, Customers and Consumers of ICT Services are kept informed across Strategic, Project and Operational matters that affect them.

IC-4: Information & Data Management

Ensures information and data used across Council has integrity and is easily accessed to support efficient and effective decision making.





IC-5: Program & Project Management

Effective management and execution of programs and projects to ensure objectives (including defined benefits) are achieved within budget and agreed timeframes.

Ensures Programs and Projects are implemented and reported on through common frameworks and methodologies.

IC-6: ICT Portfolio Management

A Capability that maintains alignment of the portfolio of ICT services and projects with Council Strategies, Plans and Operational requirements to ensure Council is investing in ICT in the right areas.

Includes ICT Strategic Planning

IC-7: ICT Operations

Ensures applications, infrastructure and other information services are available, secure and meet the performance expectations of those that depend on them.

This includes the management and support of application hosting services, network & telecommunications and security services provided via internal or external service providers through one or more of the following service delivery options: On-premise /locally installed services Cloud based (IaaS, PaaS, SaaS) Externally hosted Managed Services

Provides expertise with respect to critical and major incident management and Disaster Recovery testing and execution.





IC-8: End-User Services

Ensures the effective delivery and ongoing improvement of ‘end user’ related ICT technologies and services including: IT Service Desk Incident Management Service Request Management User Account Provisioning and Identity Management

(IAM/IDAM) System Administration of common Council ICT services

such as email, network access, remote access, active directory (network authentication), corporate telephony administration

End-user Device selection, management and support; including PC’s, Laptops, Tablets, Smartphones, Mobile Phones, Printers, Multi-Function Devices (MFD’s), Audio Visual and Meeting Room Technologies

End-user Software selection, management and support ICT Asset Tracking (hardware and software) Field/Site Support Services

IC-9: Information Security Management

Management of information security risks through the following control mechanisms: Policies, Standards, Procedures, Processes and

Guidelines Technology Products and Services Education and Training 3rd party capabilities

Also Includes: Security Strategy Security Incident Management & Response Security testing Security Architecture Guidance

IC-10: Risk & Compliance Management

Effective management of ICT Strategic and Operational Risks including: Service Availability and Recoverability Compliance with legislation and regulations Compliance with Council Policies





IC-11: Supplier & Contract Management

Management of Suppliers and Contracts to ensure Council maximises the value through products and services provided by external entities.

IC-12: ICT Performance Management

The establishment of performance criteria relating to: Financial Performance ICT Operations and Service Level Reporting Programs and Projects Information Security ICT Risks Compliance with Policies Achievement of Strategic Goals & Objectives Annual Plan commitments Council Plan Commitments ICT Asset Performance

Provide a mechanism to support continuous improvement in the delivery of ICT services to Council.




6.4 Relationships between Business Objectives, ICT Objectives and ICT Capabilities

Figure 5 below outlines the alignment between the overall City of Boroondara vision, with the eight Business Objectives, seven ICT Objectives and the 12 ICT Capabilities required to be further uplifted in support of these.

Figure 5

.

B-1: Enable and expand Customer self-service

opportunities

IC-11: Supplier & Contract

Management

“A vibrant and inclusive city, meeting the needs

and aspirations of its community”

B-8: Ability to respond to faster

changing demands

ICT Capabilities

Business Objectives

IC-9: Information Security

Management

B-2: Establish a consolidated

view of customer

B-3: Enhance Intra-Council collaboration

B-4: Realise customer goals thorough enhanced

workforce experience

B-5: Proactive and personalised Council

communications

B-6: Consolidate asset,

geo-spatial and works insights

B-7: Simple and accessible

business insights

IC-5: Program & Project

Management

IC-4: Information & Data

Management

IC-10: Risk & Compliance

Management


IC-8: End-user Services


ICT-12: IT Performance Management

IC-6: IT Portfolio Management



IO-2: Cost Effective and Value for Money

IO-3: Easy for Users

IO-5: Easy to Operate and Support

IO-7: Business Aligned

IO-4: Available and Secure

IO-6: Innovative and

Adaptable

IO-1: Well Governed

ICT Objectives

Council Vision




Most relationships between the Business Objectives and the ICT Objectives exist on a “many-to-many” basis (refer to Table 5 below), and similarly for the relationships between the ICT Objectives and the ICT Capabilities required to support the delivery of the ICT Objectives (refer to Table 6 below). Primarily, it is the combination of all ICT Capabilities that will work together to provide a complete set of capabilities to support the needs of Council in the future.

Table Key: = Direct Relationship (Primary Consideration for decision making) = Indirect Relationship (Secondary Consideration for decision making)

Table 5

Business Objectives

ICT Objectives (to support delivery of Business

Objectives)

B-1: Enable and

expand Customer

self-service opportunities

B-2: Establish a

consolidated view of

customer

B-3: Enhance

Intra-Council collaboration

B-4: Realise

customer goals thorough enhanced workforce experience

B-5: Proactive and personalised

Council communications

B-6: Consolidate asset, geo-spatial and

works insights

B-7: Simple and accessible business insights

B-8: Ability to

respond to faster

changing demands

IO-1: Well Governed






IO-7: Innovative and Adaptable




Table Key: = Direct Relationship (Primary Consideration for decision making) = Indirect Relationship (Secondary Consideration for decision making)

Table 6

ICT Objectives

ICT Capabilities (to support delivery of ICT

Objectives) IO-1: Well Governed

IO-2: Cost Effective and

Value for Money


IO-4: Available

and Secure

IO-5: Easy to Operate

and Support


IO-7: Innovative

and Adaptable
















6.5 ICT Objectives and Principles

The ICT Strategy is guided by the seven ICT Objectives (introduced in Section 6.1) and supported by a set of principles (as outlined in Table 7 below) to guide decisions on what ICT products and services should be implemented and how they will be delivered and managed.

Table 7

Objective Principle Description

IO-1: Well Governed

Design for continuous incremental improvement

Design all aspects of ICT to facilitate and enable incremental improvement and change.

Embed capability focused governance

Establish consistent and repeatable governance processes based on established standards and frameworks aligned to business needs.


Total Cost of Ownership (TCO) must be considered when evaluating ICT initiatives and investments.

ICT initiatives will be fit for purpose and affordable, but also need to deliver business benefit and value. A total cost of ownership (TCO) approach will be used when assessing investments against other priorities, as well as balancing the costs of development, support, security, risk mitigation, disaster recovery and retirement against the needs of Council’s requirements for flexibility, scalability, ease of use and reduction of complexity.

The value and cost of investments need to be measurable

ICT initiatives and investments must represent value for money and return a business benefit


Automate transactions and processes

Design to automate and integrate internal and external processes to allow customers and staff to transact with systems without requiring intermediaries. (“Get out of the way of the customer”)

Design for self-serve Prefer process design that is based on customer self-serve, or internal user self-serve where that is not possible.

Design for 24/7, mobility and device flexibility

Design solutions assuming that customers and staff will be mobile, will require access from different form-factor devices and at all hours.





Ensure customer centricity in all services

Applications are intuitive and provide a positive user experience across the customer facing services, while allowing the customer to access information securely and seamlessly via their preferred channel.

Design for Accessibility ICT designed and implemented to support a wide range of accessibility needs.


Manage risk and security by design

Ensure all design is risk managed and built around a sound security model that is compliant with the overall security architecture and legislation.

Use mature standards based solutions

Prefer solutions which exploit mature, standards based technologies for mission critical, core services, while exploring leading edge and innovative technologies for non-critical functions.


Design for, and preference “cloud” services

Design and implement solutions that use external services in preference to local hosting and processing.

Favour “off the shelf” Select commercially available solutions rather than bespoke solutions, where these exist.

Align process to system limits

Avoid modifying and customising off the shelf solutions to reduce the risk of obsolescence and version divergence.

Reduce, consolidate and simplify technology

Reduce number of different vendor technologies and preference “eco-systems” and platforms that are industry agnostic (where feasible to do so) and have large user base and industry skills that are widely available.

Unify information and data Work towards a unified data and information architecture which simplifies system design and operation.

IO-6: Business Aligned Align to business strategy Prioritise investment and effort in line with

Boroondara strategies and plans.

IO-7: Innovative and Adaptable

Cater for massive scale change

Prefer solutions that do not have scale limits and where upscaling by orders of magnitude will not add significantly to costs.





Built-in geo-referencing Build location capability into all data sets and applications which might benefit from this.

Design for IoT and connectivity

Ensure that sensor and device automation are considered in all design decisions.

Design for flexibility

Prefer solutions that are less constrained by hardware, software, platforms, or process but which are based on standards (particularly sector independent and international).




6.6 Target State ICT Capability

To support the achievement of the ICT Objectives, each of the 12 ICT Capabilities (described in Table 4) will require a level of investment to build on current capabilities and uplift them to a level that will be progressively needed in the future to support Council’s needs. Table 8 below outlines the ICT Capability Target State objectives that are required and the high level initiatives to achieve it.

Table 8

ICT Capability ICT Capability Target State Objectives


Description: A robust and flexible architecture and solution design capability to guide and govern the targeted service based, highly available and complex ICT landscape at Boroondara.

A Business Analysis capability that closely partners with stakeholders to analyse business needs and problems to allow insightful and innovative solutions to be identified and implemented.

Achieved by:

Establishing Enterprise Architecture Governance Establishing Enterprise Architecture Practice Establishing Business Analysis Practice Developing Service Based Architecture Aligning with the following frameworks and standards*: o The Open Group Architecture Framework (TOGAF) o SABSA o Australian Government Enterprise Architecture

Principles o Business Analysis Body of Knowledge (BABOK) o AS EN 301 549 - Accessibility requirements suitable for

public procurement of ICT products and services (* Please refer to Glossary for definitions)






Description: More advanced ICT and business skills will be required in the future as focus shifts away from commodity ICT services being provided internally to a focus on skills that provide solutions and enable outcomes.

Achieved by:

Identifying skills required for Target State operating model Establishing professional and technical development

program Developing skills of existing ICT and business area staff Acquiring (buy in or recruit) additional skills and capabilities Aligning with the following frameworks and standards*: o SFIA (Skills Framework for the Information Age) (* Please refer to Glossary for definitions)


Description: The greater integration of systems and use of data will require the IT Department to engage more frequently with stakeholders and internal customers to ensure strong two-way communications occur to jointly develop plans and how best to achieve the required outcomes.

Achieved by:

Capturing ICT Service Requirements Developing a robust framework for interaction between the

IT Department and business areas of Council






Description: Access to accurate information will increasingly need to be real-time or close to it.

Delivery of end-to-end services, some highly automated will be required necessitating high quality.

Increasing focus on data for business insights and analytics.

Achieved by:

Embedding data governance and quality practices across Council

Implementing technology, tools and services to manage and provision data

Implementing technology, tools and services to enable analytics

Aligning with the following frameworks and standards*: o TOGAF o Information Management Framework for the Victorian

Public Service o Data Management Body of Knowledge (DMBOK) (* Please refer to Glossary for definitions)


Description: Support increased volume and complexity of projects with increased efficiency and a common methodology.





Achieved by:

Establishing a common project management framework that can support different delivery models (Agile, Waterfall etc) and benefit realisation reviews.

Establishing external panel arrangements to support upscaling and downscaling of project teams based on variable demands

Aligning with the following frameworks and standards*: o PMBOK o PRINCE2 & PRINCE2 Agile o Agile PMI (*Please refer to Glossary for definitions)


Description: The increasing interdependencies across different technology product and services will require more mature planning of ICT related investments to understand when they can occur.

As more services are provided through external entities (eg Cloud Service Providers), there will be an increased need to forecast well in advance the pipeline of work to enable 3rd parties to prepare and implement.

Achieved by:

Establishing Portfolio Management discipline Aligning ICT planning with Corporate Planning activities Aligning with the following frameworks and standards*: o ITIL o COBIT 5 (*Please refer to Glossary for definitions)






Description: 24/7 service availability for customers and the need to provide real-time (or close to it) access to data and information is increasing. Council and Customers will be highly dependent on technology being available to support Council services and is therefore highly critical capability. Network and telecommunications are becoming more interconnected and require mature capabilities to manage.

Achieved by:

Defining Service Delivery Model Implementing end-to-end ICT Service Operations

Management Enabling multi-cloud service delivery capability Aligning with the following frameworks and standards*: o ITIL o COBIT 5 (*Please refer to Glossary for definitions)


Description: Increasing staff mobility along with growing demands to be more productive by accessing systems and information from anywhere at any time will require Councils end-user technologies to be more proactively managed to limit unplanned failures that impact staff.





Achieved by:

Developing and implementing end-user environment standards

Expanding employee self-service capabilities Defining and formalising service management capabilities Enhancing software and hardware asset management

capability Aligning with the following frameworks and standards*: o ITIL o AS EN 301 549 - Accessibility requirements suitable for

public procurement of ICT products and services (*Please refer to Glossary for definitions)


Description: The frequency and complexity of cyber security threats continues to increase and Council needs to adopt industry best practice and leverage external capabilities to keep systems/services available and information and data secure.





Achieved by:

Implementing Information Security Governance Model Developing and deploying Information Security Control

Suite (Policies, Standards, Procedures, Processes and Guidelines)

Embedding Information Security Awareness across Council Establishing Information Security Managed Services,

including identity services and security behaviour/threat analytics

Aligning with the following frameworks and standards*: o ISO/IEC 27001 o Australian Government Information Security Manual o VAGO - Information and Communications Technology

Controls Guide o NIST Cyber Security framework (*Please refer to Glossary for definitions)


Description: Advanced notice of legislation changes that require system/application changes is required as complexity of changes and time to implement increases. Broader ICT risks in addition to Information Security and Disaster Recovery will require management.





Achieved by:

Establishing ICT risk management framework (aligned to Councils Enterprise Risk Management Framework)

Adopting industry best practice standards for the management of ICT risks associated with: o Business Continuity o Suppliers o Projects o Staff o Information Security

Aligning with the following frameworks and standards*: o ISO 22301 - Business Continuity Standard o VAGO - Information and Communications Technology

Controls Guide o COBIT 5 o AICPA - SOC for Service Organizations (* Please refer to Glossary for definitions)


Description: Forecast increase in the use of 3rd parties requires a more proactive approach to managing those contracts and the performance of the service provider/supplier.

Achieved by:

Establishing an ICT Supplier Relationship Management Framework

Establishing Supplier contract templates applicable for different supply and service criteria

Identifying and establishing strategic supplier partnerships Aligning with the following frameworks and standards*: o Victorian Government Guide to Contract Management o MAV Procurement Contract Management Guidelines (* Please refer to Glossary for definitions)






Description: To ensure continuous improvement of the IT Department and ensure ICT products and services are aligned and provide value to Council, additional metrics and measures are required.

Achieved by:

Establishing ICT Service Catalogue Developing KPI’s, metrics and measures Establishing ICT Balanced Scorecard/Performance

Reporting Dashboard Aligning with the following frameworks and standards*: o COBIT 5 o ISO 38500 - Information technology - Governance of IT

for the organization (* Please refer to Glossary for definitions)




7. Capability Delivery Options

The following table (Table 9) outlines four applicable delivery options available to Council to establish the required capability. These include:

1. Internal: All or part of a capability is delivered/supported using internal Council resources.

2. Externally Assisted The delivery of a capability is supported by a range of externally sourced resources including temporary staffing or consultancy services.

3. Managed Services All or part of a capability and/or service is outsourced to a 3rd party. Council may retain ownership of applications and infrastructure or this may be provided as part of the service. The arrangement may include 3rd party resources being on-site or working remotely

4. Cloud Service Provider (IaaS, PaaS, SaaS): The capability is delivered all or in part by a Cloud Service Provider. This can take the form of a software-as-a-service (SaaS), Infrastructure-as-a-Service (IaaS) or Platform-as-a-Service (PaaS).

It should be noted, to maximise the benefits to Council and stakeholders, those business areas administering systems without IT Department involvement will need to engage with the IT Department to ensure alignment with the common service design and delivery model.

Table Key:

People based capability Technology enabled capability

Table 9

Capability

ICT Capability Delivery Options

Internal Externally Assisted

Managed Services

Cloud Service Provider

(IaaS, PaaS, SaaS)*

IC-1: Architecture, Business Analysis & Solution Design -

IC-2: People & Talent Management - -




Capability

ICT Capability Delivery Options

Internal Externally Assisted

Managed Services

Cloud Service Provider

(IaaS, PaaS, SaaS)*


- - -


IC-5: Program & Project Management -

IC-6: ICT Portfolio Management - -




IC-10: Risk & Compliance Management -

IC-11: Supplier & Contract Management - -

IC-12: ICT Performance Management - - -

* Please refer to Glossary for Definitions of IaaS (Infrastructure-as-a-Service), PaaS (Platform-as-a-Service) and SaaS (Software-as-a-Service)




7.1 Identifying the Capability Delivery Model

The most suitable capability delivery model will be determined through a range of different criteria which will include:

Capital vs Operating Expenditure (Opex) Funding preferences

Cost Market Capability and Maturity Service Criticality Legislation & Regulations Information Security and Data

Privacy Service Level Requirements

Availability & Performance Organisational Risk appetite Internal Staff Capability Key Resource Dependencies and

risks Technology replacement lifecycles Contractual lifecycles and

commitments Business Change Appetite

To determine the most suitable capability delivery option, a standard assessment model will be established in the first year of the Strategy to provide a consistent approach to the selection of the preferred capability delivery option. It will define weightings for the above criteria based on Council priorities to ensure the most suitable capability delivery option is chosen.

Any proposed changes to Council’s current ICT Capability Delivery (which is primarily internally delivered) will be subject to Executive Leadership Team approval to ensure costs, risks, change impacts and other major factors are fully understood.




8. Risk assessment

Table 10 summarises the principal risks to successful implementation of the Strategy. This list concentrates on wide ranging risks that have the potential (if untreated) to disrupt the overall implementation of the Strategy.

A separate enterprise ICT risk analysis will be undertaken as part of the detailed long term planning to cover specific issues such as security and adoption of “cloud” based services. Project risks will be analysed as part of project evaluation and business case preparation. Ongoing risk monitoring and mitigation is undertaken as part of routine activities formed by the IT Department.

Table 10

Risk Description Link to ICT Capabilities

Risk assessment (Untreated)

Risk Mitigation

Unforeseen external change

This ICT Strategy is guided by the current customer strategies adopted by Council. There is a risk that either a significant change in customer expectations, or a policy shift in how Council must or may choose to meet these expectations, would impact the relevance of the Strategy.

All

Likelihood:

Possible

Consequence:

Minor

Mitigated through ongoing monitoring of proposed or potential legislation changes through stakeholder and customer relationship management

Risk Rating: Moderate

Access to required skill sets

The Strategy envisages developing or acquiring people with a variety of skill sets. Some of these skills will need to be at advanced levels and people with these skills may be in short supply if not feasible to develop the skills internally.

Primarily People and Talent Management and Program and Project Management but with flow on consequences to all capabilities

Likelihood:

Likely

Consequence:

Moderate

Mitigated through strong talent management and acquisition practices, succession planning and skill building

Risk Rating: High






Risk Mitigation

Dependency of initiatives on funding

The Strategy may require some funding not yet identified. The success of the Strategy will be jeopardised if funding is not available. There is also a risk that, while capital funding may be available, the ongoing funding to support expanded services may jeopardise new “pay-as-you-go” services.

Primarily Program and Project Management & ICT Operations but with flow on consequences to all capabilities

Likelihood:

Possible

Consequence:

Moderate

Mitigated through strong stakeholder and customer relationship management, particularly involving strong communication and collaboration with stakeholders

Risk Rating: High

Sustaining Change

The Strategy envisages a significant transition from Current to Target state. Sustaining such extensive change over a period of years requires significant commitment within and outside of the IT Department. There is a risk that loss of momentum on any part of the transition will jeopardise the achievement of the full program.

All

Likelihood:

Possible

Consequence:

Moderate Mitigated through strong stakeholder and customer relationship management, particularly involving strong communication pathways to individuals

Risk Rating: High

Legislative change

The Strategy takes account of a changing regulatory environment. However, significant structural changes in Council responsibilities or to

Depends on nature of change. Mandated integration with other LGAs could require a changed Architecture and

Likelihood:

Unlikely

Consequence:

Moderate

Mitigated through external vigilance and flexible architectural design






Risk Mitigation

the Local Government legislative framework would require re-examination of the plan so that it is aligned with different needs.

Solution Design model as well as extensive flow on to Program and Project Management.


Business area engagement

The change program envisaged will not only support business area-initiated change but will affect ICT services consumed across Council. There is a risk that a business area fails to embrace and adopt all changes to ICT services that affect them – not just ones they have initiated

Potentially affects the ability to deliver on all aspects of the Strategy

Likelihood:

Possible

Consequence:

Minor Mitigated through strong stakeholder and customer relationship management


Business area compliance

The Strategy relies on business areas accepting the governance oversight of the CIO and complying with all ICT policies, standards and practices. Independent action by business areas may jeopardise the Strategy

Primarily affects End User Services as well as connections into ICT Operations. Information Security Management is particularly at risk from non-compliance.

Likelihood:

Unlikely

Consequence:

Minor

Mitigated through strong stakeholder engagement reaching management and staff and alignment with Business Planning processes

Risk Rating: Low




9. Review and Reporting

The IT Department will undertake periodic reviews of the Strategy along with progress updates against each activity as outlined in Table 8. The details of the timing and sequence of each activity will be determined through Council’s annual planning process, with progress reported on through the existing Annual Planning and Reporting Framework.

A major review of the Strategy will occur in mid-2024 culminating in a new ICT Strategy being developed




10. Glossary and References Table 11

Term Links and References

Agile PMI

Agile based Project Management Methodology from the Project Management Institute (PMI) https://www.pmi.org/learning/library/agile-project-management-pmbok-waterfall-7042

AICPA - SOC for Service Organizations

The American Institute of CPAs (AICPA) reports which provide customers with information about the service organisation’s controls to help assess and address the risks associated with an outsourced service. https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/users.html

AS EN 301 549

Australian Standard for “Accessibility requirements suitable for public procurement of ICT products and services”. https://infostore.saiglobal.com/en-au/Standards/AS-EN-301-549-2016-100620_SAIG_AS_AS_211428/

Australian Signals Directorate (ASD) “Essential Eight”

https://www.cyber.gov.au/publications/essential-eight-explained

Australian Government Enterprise Architecture Principles

https://www.finance.gov.au/sites/default/files/AGA_EA_Principles_-_V1.1_0.docx

Australian Government Information Security Manual

https://www.cyber.gov.au/ism

Business Analysis Body of Knowledge (BABOK) https://www.iiba.org/standards-and-resources/babok/

COBIT 5 http://www.isaca.org/COBIT/Pages/COBIT-5.aspx





Data Management Body of Knowledge (DMBOK)

https://dama.org/sites/.../DAMA-DMBOK2-Framework-V2-20140317-FINAL.pdf

IaaS (Infrastructure-as-a-Service)

https://searchcloudcomputing.techtarget.com/definition/Infrastructure-as-a-Service-IaaS

Information Management Framework for the Victorian Public Service

https://www.enterprisesolutions.vic.gov.au/information-management/

ISO 22301 - Business Continuity Standard

https://infostore.saiglobal.com/en-au/standards/as-iso-22301-2017-99354_SAIG_AS_AS_208888/

ISO 27001 - Information Security Management Standard

https://www.iso.org/isoiec-27001-information-security.html

ISO 38500 - Information Technology - Governance of IT for the organization

The objective of this Standard is to promote effective, efficient and acceptable use of IT in all organisations.

ITIL (Information Technology Infrastructure Library)

A widely accepted approach to IT Service Management. https://www.axelos.com/best-practice-solutions/itil/what-is-itil

Municipal Association of Victoria (MAV) Procurement Contract Management Guidelines

http://www.mav.asn.au/__data/assets/word_doc/0017/4490/Contract-management-guidelines.docx

NIST Cyber Security Framework

The National Institute of Standards and Technology (NIST) cybersecurity framework. https://www.nist.gov/cyberframework

PaaS (Platform-as-a-Service)

https://searchcloudcomputing.techtarget.com/definition/Platform-as-a-Service-PaaS

Prince2 Waterfall based Project Management Methodology https://www.axelos.com/best-practice-





solutions/prince2/what-is-prince2

Prince2 Agile

Agile based Project Management Methodology https://www.axelos.com/best-practice-solutions/prince2-agile/what-is-prince2-agile

Project Management Body of Knowledge (PMBOK)

https://www.pmi.org/pmbok-guide-standards/foundational/pmbok

SaaS (Software-as-a-Service)

https://searchcloudcomputing.techtarget.com/definition/Software-as-a-Service

SABSA

SABSA Institute’s Enterprise Security Architecture. https://sabsa.org/sabsa-executive-summary/

SFIA (Skills Framework for the Information Age)

SFIA Foundation’s Framework provides a globally accepted common language for the skills and competencies required in the information technology and digital world. https://www.sfia-online.org/en/framework/sfia-7/how-sfia-works

TOGAF (The Open Group Architecture Framework)

The Open Group’s Enterprise Architecture methodology and framework used extensively by organisations across the world. https://www.opengroup.org/togaf

VAGO - Information and Communications Technology Controls Guide

https://www.audit.vic.gov.au/information-and-communications-technology-controls-guide

Victorian Government Guide to Contract Management

http://www.procurement.vic.gov.au/files/88d9eb53-ea8f-4834-a062-a40500bea3cf/Guide-to-contract-management.docx



7.4. Information and Communications Technology …...Council Agenda 26/08/19 City of Boroondara 219...

Documents

Transcript of 7.4. Information and Communications Technology …...Council Agenda 26/08/19 City of Boroondara 219...