Approach to Outsourcing

8/8/2019 Approach to Outsourcing

1/30

3030303030

Offshore Outsourcing

Topics and Approach


2/30

CONFIDENTIAL 2/30BAMBOO

Table of Contents

Offshore Development: Once Risky, Now Required .......................................................................3Offshore Outsourcing to China .........................................................................................................5Outsourced Development Roadmap.................................................................................................8Determining What to Outsource ......................................................................................................14Best Practices in Offshore Outsourcing Management..................................................................15The Bamboo Quality System and the Capability Maturity Model (CMM) .....................................17Security and Confidentiality Procedures at Bamboo ....................................................................24About Bamboo ..................................................................................................................................29


3/30


Offshore Development: Once Risky, Now Required

As all companies face increased competition due to globalization andunforgiving market forces, the use of offshore development partners isbecoming a compelling way to maintain market share and boost profits.

Moving development offshore once a risky proposition is now a wellunderstood, highly defined process. Using Bamboos offshore roadmap,Partners can have substantial offshore teams working in a matter of months,and can realize commensurate savings in that time.

Saving money is a major benefit of this strategy, but not the only one: ourclients also benefit from being able to focus more on their core competencies,access to higher level technical skills, higher quality production, and increasedflexibility.

It has become readily apparent to all firms with substantial IT budgets that inorder to remain competitive, outsourcing is required.

Numerous studies have shown the benefits of outsourcing. For example,British Airways has found that it saves US$ 23 million for every 1000 jobs itpushes offshore. Other firms such as GE, Citibank, AXA, and AmericanExpress have pioneered and educated the industry on best practices and thepotential risks of the offshore model.

More than half of Fortune 500 companies push some portion of their ITwork offshore

Offshore outsourcing of IT has grown 50% annually for the last 5 years

Last year, North American companies spent US$114 billion on in-housesoftware development

75% of the cost of developing software is labor

Companies spend more than 10% of their IT budgets recruiting andtraining staff

On average, a 100 person set-up offshore translates into US$7-15million annual impact on the bottom line

FACT BOX

Moving

developmentoffshore is now awell-understood,highly definedprocess.


4/30


The Business Case for Offshore Development

Using offshore resources addresses many issues that directly affect seniormanagers decision-making processes. These are: cost, resources, quality,and time-to-market. Historically, offshore development has been sought only

on a cost savings basis. However, as the industry has matured, several othersignificant value propositions have become apparent in the offshore model.Here are the top reasons to outsource:

1. It saves money. There have been a plethora of publications by topconsulting firms, and the estimated savings of doing work offshore fallbetween 25-50% of the cost of onshore work. The chart below gives anindication of the magnitude of the cost savings possible with outsourcing.

2. It provides access to skilled workers. Going to markets like China or Indiaprovides a virtually limitless resource of highly skilled engineers andproject managers.

3. It improves quality. In a recent survey, (Best Practices of Leaders inOffshoring), PwC reports that 68% of respondents report an increase inquality. Most customers judge quality of potential outsourcers by theirCMM rating. Bamboo has been successfully appraised at CMMI MaturityLevel 5 in December 2003.

4. It reduces cycle time. By partnering with offshore outsourcers,development work can happen around the clock, shortening developmentcycles and improving competitiveness. Having a steady pool of expertsavailable also shortens project ramp up time.

5. It allows companies to focus on their core business. This focus isnecessary to maintain a competitive advantage.

6. It increases shareholder value. The cumulative effect of the five above-mentioned points ultimately drives share prices higher.

Were the cost savings alone the only benefit to outsourcing, it would still be anecessary imperative. The added associated benefits make it clear thatoffshoring is a required strategy to stay competitive.

The benefits ofoffshore

developmentextend beyondcost savings.


5/30


Offshore Outsourcing to China

Why China?

India, with 75% of total offshore development revenue, still dominates theoffshore outsourcing market. Yet companies are increasingly looking to otherregions as strategic alternatives. Over the next few years, the availability ofskilled resources will become an issue for companies adopting offshorestrategies. Analysts anticipate that the demand for Indian IT resources willoutpace supply. According to Forrester Research, Indias labor pool isexpected to grow to 6,000,000 in by 2010, but demand is predicted to reachmore than 10 million.

Given the long-term nature of offshore outsourcing relationships, geographicdiversification of outsourcing locales has also become a key element ofoutsourcing risk mitigation. As the outsourcing market matures, companiesunderstand that in addition to cost considerations, labor pool characteristics

and expertise, geopolitical risk, infrastructure, location, and governmentsupport are key factors to the selection of a locale and vendor. By spreadingoffshore activities across a few different regions, companies can respond tochanges in political landscapes, staffing, regulatory environments, and evennatural disasters, with greater flexibility. Diversifying vendor ties also enablesoutsourcers to quickly tap different talent pools for highly specialized work,localization efforts, or emergency resource-intensive projects.

Process frameworks, in particular the Capability Maturity Model (CMM)developed by Carnegie Mellons Software Engineering Institute, help establishgrounds for evaluation of the sophistication and maturity of software firmsengineering procedures. With the ability to objectively assess the quality ofsoftware firms, and an understanding of best practices in both relationship

structuring and management, outsourcers are better equipped to begindiversifying their outsourcing relationships.

In addition to China, the Philippines, Ireland, Mexico, Brazil, Russia and otherEastern European countries are emerging as offshore development centers.Stumbling blocks in these markets, however, include the reduced ability toprovide onsite support, higher wage rates, transitional business environments,and uncertain political landscapes.

China, with its large pool of technology talent, growth economy, stronggovernment support of technology growth, and favorable business climate,now serves as an important counterweight to other outsourcing geographies.Corporations must now consider China as part of their overall global

outsourcing strategy.

China has thepotential to

become one of thetop offshoremarkets in fiveyears time-PWC Consulting


6/30


Education and Technical Talent

In a report published in the Spring of 2002, the Gartner Group recognizedChina as an emerging strength as an outsourcing center. The reportemphasized Chinas strong technical skills, vast technical resources, and

cost advantages over competing outsourcing destinations.

With a talent pool of over 200,000 thousand IT professionals, and with 50,000more entering the workforce each year, China is quickly becoming a worldleader in software development. These professionals are the product of aChinese technical education system that Business Week recently commendedas having top-notch universities, such as Beijings Tsinghua University andShanghais Jiao Tong University, that are on par with the best technicalschools in the world. With the Wests growing influence in China, graduatesalso increasingly have English language skills.

The Gartner Group and Business Week are not the only organizations thatrecognize Chinas technical talent. Leading software companies like Microsoftare also giving China a strong vote of confidence. In fact, Microsoft haslocated by far the largest of its prestigious Microsoft Research Laboratories(MRL) in Beijing. These research facilities are charged with exploring nextgeneration technology and conducting basic research, and are a criticalcomponent of Microsofts competitive edge. Only four MRL labs existworldwide and the Beijing center is one of only two outside the USA (theother is located in Cambridge, England). Other technology giants are alsofollowing suit. Cisco, for example, has located both its Last Mile Lab (LML)and IP Telephony Lab in Beijing. And companies like Intel and Oracle alsohave a major presence in the country.

Business Climate

China is the third largest trading partner with the USA (ahead of every countryin Europe), and holds Most Favored Nation trading status with America. Assuch, China is a key market and a key supplier to the USA across a plethoraof industries.

With its recent ascension to the World Trade Organization, China hascommitted itself to introducing Western-style business practices andtransparency. These changes are being felt as China continues its exceptionalgrowth trajectory currently about 7% growth a year. This continued growthis driving companies to China: foreign interests invested approximately US$85billion in China last year.

In the IT industry, China is now recognized as a must win market for allmajor technology companies. China is fueling this desire by spending $6.8billion on IT and telecommunications for the 2008 Olympics. This hugeactivity, coupled with the exploding growth of home-grown technology firms(such as the giant Legend Computer and Lenovo), has encouraged China tospeed its adoption of Western intellectual property standards. The Chinesegovernment, for example, has recently signed a master licensing agreementfor all software used by government offices.

50,000 skilledtechnology

professionals areentering theChinese workforceeach year.


7/30


Government Support

The Chinese government is also keen to help cooperative companiesnavigate the regulatory environment, and to provide incentives for foreigninvestment. In order to encourage technology development, the Chinese

government has established Special Economic Zones in Beijing/Tianjin,Chengdu, Guangzhou, and Dalian/Shenyang. Both domestic and foreign ITcompanies in these zones benefit from tax incentives, rent subsidization, andgovernment supported telecommunications infrastructures.


8/30


Outsourced Development Roadmap

Introduction

Offshore Development Centers are virtual extensions of the Partnersdevelopment groups and are equipped with ready to serve resources. Thissection provides details of Bamboos the process for setting up an ODC for aPartner.

The Offshore Development Center (ODC) is comprised of a Bamboo facilityand staff dedicated to a Partners project requirements. The ODC consists ofa team of trained domain specialists and programmers operating out ofBamboo facilities in China, interacting closely with the Partners projectgroups. The ODC team can link up (if required) to Partners offices andmachines via dedicated links and thereby works in the same environment asthe Partners team.

Typical characteristics of an ODC integrated team include:

An offshore team and a small onsite team High speed communication links to connect offshore and onsite teams Dedicated facility at Bamboos premises for the ODC Predetermined staffing plans for the ODC based on mutual agreement

and on projects Multiple projects executed under an ODC

The key processes for setting up an ODC are:

Team buildup Onsite knowledge acquisition

Offshore infrastructure setup Offshore training Offshore development Offshore maintenance

Key elements for successful setup and operation of the ODC are:

Physical location Office infrastructure Hardware and software infrastructure Communication links Security and confidentiality

The advantages of the ODC are:

Cost advantage due to lower cost of the Chinese operations Ramp up/down in a planned manner Retention of knowledge base, learning curve Efficient sharing of resources Easy availability of trained manpower

Offshore

DevelopmentCenters are virtualextensions of thePartnersdevelopmentgroups.


9/30


Phase I: Strategy

The first step in moving to an offshore model is to ensure that the corporatestrategy of the company is aligned with the goal of moving work offshore.Offshoring is a serious commitment and requires organizational support. In itsadvanced form, where maximum benefits are realized, offshoring canfundamentally change the way a company operates and how managementthinks. Realizing these benefits requires strategy alignment with the goals ofmoving software production offshore.

Long-term goalsThe decision to move development work offshore is not a light one. It requirescommitment, effort, and a long-term view. Moving to an offshore developmentmodel should be an explicit corporate goal. The success of the projectdepends on management thinking for the long term.

Management supportManagement support is critical in moving work offshore. The process ofimplementing the offshore model requires a realignment of human resourcesand fundamentally altering how people work. As people resist change,without management support the offshoring initiative will succumb to inertia.Bamboo professionals are available to meet with senior management to

explain the benefits and risks of the offshore model.

Implementation scheduleExperience has shown that an aggressive (but feasible) schedule is optimal.With the proper momentum, the offshoring initiative can gain traction andshow measurable results in the matter of months. Six months is ample time toget a medium-scale offshoring operation up and running smoothly. Bambooconsultants will help plan out a suitable schedule depending on the scope andnature of work to be sent offshore.

Offshoring is aseriouscommitment andrequiresorganizationalsupport.


10/30


Phase 2: Definition

Identification of test projectCertain activities lend themselves to the offshore approach more than others(see Determining What to Outsource in this document). Bamboo, in

conjunction with the Partner, helps determine high leverage outsourcingopportunities. Selection of the right kind of project is crucial to success. Thecombined Bamboo/Partner team should plan to publicize the successes of thetest project within the Partner firm in order to gain momentum and support forthe offshore initiative.

Detailed offshore planAfter the test project is identified, a comprehensive plan is created that setsout in detail the various aspects of the offshore outsourcing effort. The planincludes all the various phases that are mentioned here.

Communication protocolSince offshoring is a distributed effort, communication is the key to success.In conjunction with Bamboo, management defines the communicationprotocols the escalation procedures to make the project a success. To assureefficient and expedient communication between Bamboos offshore team andPartners facility, Bamboo utilizes the following formalized communicationsapproaches:

English language usageAll business conducted between Bamboo and the Partner, both on-site andoffshore, shall be conducted in English. English is used for internalcommunication throughout Bamboo Networks.

Onsite Project ManagerThis senior resource serves as the local, on-the-ground point of contactbetween the Partner team and the Bamboo offshore team. He/she needs tobe available every working day.

Daily meetingsDuring the ramp-up period, the Project Manager and Technical Architectlead daily meetings with the Partner team. Later, Bamboo schedules face-to-face meetings as often as needed with the Partner team.

Bi-weekly project status meetingsThese rigorously scheduled and adhered-to meetings involve both theoffshore and onshore teams at a mutually agreed-on time (say 8AM NewYork / 8PM China) to review progress and issues relating to the project.The senior execution team, as well as other relevant staffers depending onneed, attend these meetings.

Weekly project plan updateEach week, Bamboo reviews the overall MS Project document for theproject and sends an updated version to the Bamboo and Partner teams.

Monthly steering committeeEach month, a steering committee comprised of top project managementfrom both from Bamboo and Partner meets to review progress, manageexpectations and solve any outstanding problems. This committee iscomprised of:

Project managers Lead architects Senior business executives responsible for the project


11/30


Communications/Collaboration TechnologyBamboo utilizes a variety of technologies to facilitate communications,including:

Video conferencing

Email/fax/phone WebEX IBM QuickPlace VPN

Security PlanBamboos security protocols are detailed in a separate section of thisdocument.

Phase 3: Roles

Key personnel identification

Bamboo is responsible for the ODC management. As the first step, Bambooidentifies the ODC manager who is to be responsible for all technical andmanagerial activities of the ODC, including people management. The Partneridentifies an Outsourcing Program Manager as a single point of contact for thebusiness relationship. The ODC manager then interacts with the ProgramManager to arrive at the resource and project needs. T he ODC Manager andthe Program Manager are key individuals for the success of the ODC.

Project teamDuring the initial phase, Bamboo identifies personnel with requisite skills toform the core ODC team. This includes team members with experience inspecific technologies and business practices as required by the Partner. Inmost cases, the team is a mix of Bamboo offshore staff and a mix of Bambooand Partner staff onshore. Partners are encouraged to participate in projectteam selection.

Team structureAfter a decade of learning from global offshore experiences, the ExtendedTeam model has been proven to be the most successful. It works with about20% of the team onshore, and the remaining 80% offshore as a seamlessextension to the team. Percentages vary depending on the nature of theproject. The onshore team maintains control, manages Partner requirements,and handles most of the exception work, while the offshore team handles thestandardized work. The two teams work as one. The onshore team liaisesclosely with the customer, and based on the customers feedback, controls theoffshore team.

Functionally, the offshore team reports to the onshore staff. The offshoreteam is selected or trained to have the relevant skills formerly needed by thecustomers onshore staff. A rigorous train the trainer methodology is usedso that the offshore staff becomes self-sufficient. Corporate culture (andassociated values) is transferred to the offshore team. The onshore teamfocuses on requirements gathering and changes, and implementation, not onmicromanaging the offshore center.


12/30


Phase 4: Implementation

Setup of ODC

Design of ODC Interior

The ODC interior is designed to provide each employee with aWorkstation/PC, telephone access, adequate storage space and otherfacilities required for ergonomic working conditions. The other facilitiesinclude conference room space, a server room, and other working spacesas necessary.

Hardware and Software SetupEvery engineer in Bamboo is equipped with a desktop workstation andbasic software. Any special hardware/ software required for the operationof the ODC is arranged for or paid for by the Partner.

Once the ODC office infrastructure is set up, the Partners hardware andsoftware environment is installed. Bamboo takes complete responsibility forthe installation and management of the hardware and software resources.

Communications linkTo ensure maximum benefits from the ODC, Bamboo recommends theestablishment of high-speed links to the Partners location. The bandwidthof the link is decided upon based on the volume of the work. Thebandwidth can be increased in an incremental fashion. Alternately, theconnectivity can be through the Internet or ISDN dial-up for lower networktraffic requirements.

SecuritySecurity and confidentiality for the ODC is setup according to internalBamboo standards and validated with the Partner. Details of Bamboosecurity standards are provided in a later section of this document.

Knowledge TransferA group of key Bamboo consultants is posted at the Partners offices for anecessary period. These consultants are responsible for gathering knowledgeon the application and document all the details of technology and businessprocesses. The knowledge transfer is done using the following methods:

Study the details of the existing system architecture Study the methodology and tools specific to the Partner Study the existing documentation Train ODC staff

TrainingThe core team travels back to the ODC for training the offshore team. Thetraining consists of:

System architecture Business process Details of the various applications Standards, processes, methodologies Lessons learned onsite Partner culture

This training enables the offshore team to function with sufficient knowledge ofthe Partners systems, procedures, business goals, and corporate culture.


13/30


Execution of test projectThe Bamboo ODC team executes the identified project based on theapproved Statement of Work (SOW). Bamboo develops the SoftwareRequirements Specification document and discusses it with the Partner. Theexecution of the project is performed using the Bamboo Quality System(BQS). Details of the BQS are covered later in this document.

At the end of the scheduled time, Bamboo delivers the completed work withwell-documented source code and documentation.

Phase 5: Management

Metrics collectionAs part of the ongoing management of the offshore development effort,metrics are collected so that the Partners management is able to quantifytheir cost, quality, and productivity gains. Typical measurements includeoverall number of errors delivered, schedule variance, and cycle timechanges.

FeedbackThere must be a formal feedback loop for the Partner and Bamboo to discusshow they perceive the process to be working. The mechanism for thisfeedback is set up in the communication protocol, discussed above.Producing software is a people intensive, complex process that requiresconstant monitoring and optimization to ensure success. The feedback loopis a critical component of developing the Bamboo/Partner relationship.

Change managementAs more work begins to be transferred to the ODC, it requires a change in thePartners onshore team structure. Senior management on the Partner side, inconjunction with the Bamboo team must work together to transition thePartner to the offshore model.

Process improvementBamboo has proven and tested processes for offshore software production.The Partner also has its own processes for production. The combined teamneeds to tailor their joint processes in order to work together meaningfully.The test project necessarily uncovers areas of improvement, and the Partnerand Bamboo joint teams need to stay committed to process improvement toensure success.

Conclusion

This is the start of multiple project activities with the Partner. The ODCManager will then have multiple project managers who handle the differentprojects. Once the team starts working from China, projects teams will requireadditional training both for existing staff and new inductees as the projectschange. The Bamboo team and the senior business analysts/managers fromthe Partner handle this.


14/30


Determining What to Outsource

When selecting work for offshore outsourcing, firms should first determinewhat cannotbe resourced offshore. Development that is part of a firms corecompetency or requires unique skillsets and knowledge is often betterretained in-house.

Firms should seek to gradually outsource projects when working with a newvendor. Beginning with less critical pilot projects enables Partners to buildconfidence in a vendor. After these have been successfuly implemented,outsourcers can then scale the outsourcing effort to include originalapplication development and mission-critical projects. Work suitable for initialprojects includes:

Presentation screen rewriting Database cleansing Application maintenance Application enhancements/upgrades Application conversions Database migration

Once trust is fully established, firms can then begin offshoring:

Original application development Core-logic rearchitecture of existing systems

Initiate a pilotproject to

gainconfidence inyour vendor.


15/30


Best Practices in Offshore Outsourcing Management

Foundation Setting

The goals of an outsourcing initiative will shape subsequent actionsthese must be well defined. Outsourcing objectives include costreduction, accelerating a products time to market, and gaining accessesto certain skills and expertise.

Senior executives should be committed to the outsourcing initiative.

Project Selection

Begin with non-mission critical pilot projects on which vendor performanceand fit will be initially observed and measured.

Scope projects carefully. Measurement of performance and success isimpeded by unclear scope and requirements.

Vendor Selection Assess vendor capabilities for long-term sustainability in relation to the

outsourcers goals. Vendors should have: Established, mature development processes Adequate infrastructure to support your initiatives Solid recruitment and training programs to support growth and rapid

staffing for project work if needed An international and domestic presence Flexibility in process tailoring, performance measurement, and

contract negotiation Perform on-site due-diligence to assess vendors in the above areas. Determine how different the vendors cultural and management style is

from your own, and how this will be mitigated. Build confidence in a vendor by working together on several smaller, low

risk projects.

Relationship Structuring

Create a basis for long-term growth by strategically aligning interestsbetween your firm and the vendor. This helps cement commitment byboth parties and ensures continual improvement.

Set measurable results-based goals and benchmarks for cost, quality, andperformance to help establish common understanding and expectations.Mutually agree upon a scorecard for measurement of progress andsuccess.

Define the management structure of the relationship well in advance.Management of the outsourcing relationship should be both operationaland strategic.

Budget resources for management and communication with the offshorevendor. Select individuals who have strong management skills, (includingcommunication, trust building, negotiation, strategic planning, projectmanagement, problem solving, process definition, and team leadership),and clearly understand your organizations outsourcing goals andstrategy.

Build multi-level links between the organizationsfrom senior strategicleadership to operational management.

Keep an onshore technical support presence to interface with the offshoreteam.


16/30


Relationship Management

Identify the goal and mutually agree on how the work will be done.Proscribing execution methodology can fail if it involves too much processchange on either side.

Understand what procedures the vendor will follow during development,and ensure these are compatible with those of your staff. Flexibly tailor

processes between the teams as required. The relationship and vendor performance should continuously improve;

perform project reviews using the scorecard to identify ongoingopportunities for improvement.

Use of incentives and penalties can be extremely powerful. These shouldbe applied fairly and consistently. In order to be effective, clearly definedstandards and a strong project review and analysis process must be put inplace.

Cultural Management: Nationality and Corporate

Normalize language and cultural issues through careful team selection,

communication protocol, and clear establishment of understanding. Provide internal training to the outsourcing management team on

communication procedures and business objectives. Ensure that the vendor clearly understands your business objectives and

environment.

Change Management

Establish procedures for change management and problem escalation. Implement transparent communication and progress monitoring systems

to help address issues quickly. Follow-up to ensure vendors take corrective actions if and when

necessary. Proactively manage staff-displacement issues through open

communication and training plans.

Risk Mitigation

Diversify offshore outsourcing locations to help spread risk related to geo-political uncertainties.

Develop contingency plans for site-specific disruptions. Ensure the ODC has adequate security procedures and physical security

mechanisms in place to protect sensitive information and intellectualproperty.

Begin with a pilot project that has clear expectations, requirements, and

deliverables. Increase scope of outsourcing only after performance andbenefits are observed. Vendors should have an onsite presence during the early stages of a

project to ensure requirements are thoroughly gathered and analyzedbefore offshore development begins.

Control costs, schedules, and quality both of service and product throughstrong project management both at the outsourcer and the vendor.

Rotate onshore and offshore staffing to facilitate knowledge transfer.


17/30


The Bamboo Quality System and the Capability MaturityModel (CMM)

Bamboo has adopted the CMM as our method of software production. The

CMM is an international framework for software engineering processes. TheCMM recognizes five maturity levels, which form a scale for measuringmaturity and which provide the framework for organizing the movement fromlevel to level. The movement towards level five is an evolutionary path fromad-hoc chaotic processes to mature disciplined ones.

Our Partners need to know that our current/past successes are repeatable.No Partner would be happy to hear that their ODC delivers products on an ad-hoc, chaotic basis characterized by the need for individual heroics. AllPartners would rather be comfortable in the knowledge that their offshoredevelopment is being done by an organization with mature softwareprocesses.

The table below describes the generic characterization of mature andimmature organizations in order to make the differences between theirsoftware processes more clear:

Immature SoftwareOrganizations

Mature Software Organizations

Procedures not rigorously followedor enforced

Procedures are accuratelycommunicated

Improvisation used instead ofstandard methodology

Firms procedures are conformed to

Reactive not proactive Firms standard methodology isupdated regularly

Fire fighting is the norm The quality system is improved in acontrolled manner

Schedule and cost overruns Quality and customer satisfactionmonitored

Functionality and qualitycompromised

Quality controlled quantitatively

Unpredictable quality Realistic schedules and budgets

No time to improve Adequate infrastructure support

Our interpretation of the CMM is embodied in the Bamboo Quality System

(BQS), which is a series of policies, procedures, guidelines, methodologies,forms, templates, standards, and checklists that has been designed toproduce the highest quality of work predictably for our clients. Thehierarchical nature of BQS is portrayed in the diagram below:

The quality of a

software systemis governed bythe quality of theprocess used todevelop andevolve it.-Watts S. Humphrey


18/30


What does the BQS mean to our clients?

1. Professionals trained in process and quality are working on all Bambooprojects.

2. Bamboos successes are due to a firm-wide quality system, not tounpredictable individual heroics.

3. Bamboos work is properly documented.4. Bamboo adheres to a well-known standard for software production.

BQS policies are short high-level statements describing the composition of thequality system. Descriptions of each policy are included below.

Policy Purpose

Requirements Management Establish a common understandingbetween the customer and supplier

Software Project Planning Establish reasonable plans forperforming the software engineeringand for managing the software

project

Software Project Tracking andOversight

Establish adequate control overactual progress so as to enablemanagement action if performancedeviates significantly from plan

Software Quality Assurance Provide management with visibilityinto the process being used by theproject and of the products beingbuilt


19/30


Software ConfigurationManagement

Establish and maintain the integrityof the products of the softwareproject throughout the projectssoftware life cycle

Organization Process Focus Establish organizationalresponsibility for software processactivities that improve theorganizations overall softwareprocess capability

Organization Process Definition Develop and maintain a usable setof software process assets thatimprove process performanceacross projects and provide a stablefoundation for cumulative, long-termbenefits to the organization

Training Program Develop the skills and knowledge of

individuals so they can perform theirroles effectively and efficiently

Integrated Software Management Integrate the software engineeringand management activities into acoherent, defined software process

Software Product Engineering Consistently perform a well-definedengineering process that integratesall the software engineering activitiesto produce correct, consistentsoftware products effectively and

efficiently

Inter-group Co-ordination Establish a means for the softwareengineering group to participateactively with the other engineeringgroups so the project is better ableto satisfy the customers needseffectively and efficiently

Peer Reviews Remove defects form the softwarework products early and efficiently

Quantitative Process Management Control the process performance of

the software project quantitatively

Software Quality Management Develop a quantitativeunderstanding of the quality of theprojects software products andachieve specific quality goals


20/30


Bamboos Engineering Processes

The following section describes Bamboos general engineering processes.Software development at Bamboo is divided into distinct phases.

Requirements Development Project Planning and Estimation Design Coding and Unit Testing Integration and System Testing Acceptance Testing

The following shows Bamboos general project flow according to a waterfallmodel.


21/30


Requirements DevelopmentA System Analyst, together with an Information Architect and BusinessAnalyst, if needed, analyzes the existing requirements from the proposalphase. If these are incomplete, the SA will work with the PM and client togather complete requirements, which are then documented in the SoftwareRequirements Specification (SRS). The SRS contains descriptions of the

major functional areas of the product, typical usage scenarios, interfacerequirements, error handling, performance requirements, non-functionalrequirements, and end user platforms. The requirements are uniquelynumbered for traceability and tracking throughout the lifecycle. Bamboorequires client approval of the SRS. Once it has been signed off, the SRS isbaselined. After baselining, changes to the SRS follow change controlmechanisms.

Project Planning and EstimationOnce the SRS has been completed, the Estimator creates a work breakdownstructure (WBS). Estimators use the SRS and the WBS to produce andrecord the following estimates:

Size (for example Function Point Analysis and/or Wideband DelphiTechnique)

Effort Schedule Critical computer resources

These estimates are used by Project Managers both for planning and formeasuring deviations during project tracking and oversight.

DesignThe System Analyst (SA) and DBA analyze the SRS and any changerequests to determine the system architecture and hardware and systemconfiguration, which are then documented in the System Design Document.

The SA and DBA then design the logical and physical database schema andthe physical database model. These are described in the DatabaseSpecification. The SA then designs the software and records classes andinteraction diagrams in the Software Design Document. The three documentsare approved by the client and baselined. The development life cycle is alsoselected in this stage.

Coding and Unit TestingThe development environment is set up and development proceeds based onplanned schedules and assignments. Developers use Bamboos internalcoding standards as guidelines during development, and perform unit tests.

Integration and System Testing

After the application is baselined, it is ready for testing. Bamboos test teamperforms tests based on the project test plan and test cases. Any defectsfound in this stage are recorded. The author corrects the defects, and thedefect is tracked to closure.

Acceptance TestingClients perform acceptance testing based on their own criteria andmethodology. Bamboo provides support on an as-needed basis. Any defectsfound in this stage are recorded and tracked to closure.


22/30


Key Development Process Areas

Project ManagementProject Management involves project planning, tracking and oversight. AtBamboo, Project Managers are responsible for:

Creating and managing project plans, which include project schedules,resource allocations, milestones, deliverables, and risk analysis

Regular status tracking and reporting of technical progress, plans,performance and issues against the project plan

Obtaining commitments and consensus from parties involved in thedevelopment process

Tracking critical dependencies between engineering groups Revising the project defined software processes when necessary Conducting project kick off, status, and closure meetings Change management Risk identification, planning, and management Reporting and escalating issues to the project board

For onsite/offshore projects, Bamboo typically assigns a Project Leader andan offshore Project Manager. The Project Leader is onsite with the client andis responsible for negotiating commitments, requirements management,critical risk management, and manages project activities at the high level. Theoffshore Project Manager is responsible for managing and reporting the day-to-day activities of the offshore development team.

Software Configuration ManagementSoftware Configuration Management establishes and maintains the integrity ofthe work product created throughout the project's lifecycle. It involvesidentifying the configuration of the software (i.e., selected software workproducts and their descriptions) at given points in time, systematicallycontrolling changes to the configuration, and maintaining the integrity andtraceability of the configuration throughout the software life cycle.

Each project team is assigned a Software Configuration Coordinator who isresponsible for creating and managing the Software ConfigurationManagement Plan, identifying configuration items, performing configurationstatus accounting and auditing, performing impact analysis on changerequests, and overseeing product releases.

The work products placed under software configuration management includethe software products that are delivered to the customer (e.g., the softwarerequirements document and the code) and the items that are identified with orrequired to create these software products (e.g., the compiler). A repositorydefines the structure for the project and stores the project files that requireversion control.

Change management is a critical aspect of configuration management. At theoutset of each project, a Software Change Control Board is identified. Itsmembers, roles, procedures, and change request approval mechanisms areoutlined in the Software Configuration Management Plan. When a changerequest is received, analysis is performed to determine the scope and impactof the change. Software Configuration Coordinators are responsible forperforming impact analysis and arranging for regression testing on changerequests. Once a change request is approved, the requirement and designdocuments are re-baselined and the change is tracked to closure.


23/30


Software Quality AssuranceWhile most software organizations take a Quality Control, test once-onlyapproach to software development, Bamboo has adopted a Quality Assuranceapproach. An integrated QA approach not only helps reduce the amount oftime spent in rework and testing, but also helps ensure continuous processmonitoring and improvement. Bamboos SQA team was created to:

Independently verify software development activities; Ensure that process and product deficiencies are brought to management

attention and resolved satisfactorily; and Maximize the benefit of SQA activities by reviewing results and adjusting

the SQA plan.

Each project team is assigned a SQA representative who participates inproject planning, writes and maintains the SQA plan for the project, performsreviews of the software engineering activities to ensure compliance, andperforms reviews of work products against software standards, procedures,and requirements. SQA representatives help the project teams correct non-compliances and provide teams with support on how to optimally use the

Bamboo Quality System.

Software Quality Control / TestingIn addition to the SQA team, Bamboo has a separate QC testing team that iscomprised of a test manager/leader, test designers, and testers. This teamprovides support to all development teams.

Test Planning: The test lifecycle is concurrent with the development lifecycle.Test plans are written during the project-planning phase, and tests aredesigned after the SRS, use case and design documents are reviewed andfinalized.

Test Design:Test designers generate test cases by according to the test plan

and the SRS, use cases, and design documents supplied by the developmentteam.

Unit Testing: The developers generate their own test cases, if necessitated bythe requirements, and perform unit testing. The results will be used as areference for the next phase of testing. Developers submit the defects foundto the Defect Tracking tool, which is used as the base system for submittingand tracking defects. Defects are tracked from initiation to closure.

Integration/System Testing: The test cases are implemented and executedaccording to the test cases and the results are recorded. Any defects foundare submitted to the Defect Tracking tool. The defect is resolved, and is thenretested and closed. The changes are incorporated into the application and

the system is ready for UAT.

Whether or not scripts are used depends on the scalability and complexity ofthe project. Scripts are developed in a specific language depending upon thelanguage used for development. A testing tool may also develop the scripts(e.g. Robot, Win Runner). The Testers submit the defects found to the DefectTracking Tool and defects are tracked from initiation to closure.

Test Evaluation & Report: The test results and defect data are analyzed, anda test report is generated.

User Acceptance Testing (UAT): After the defects found in Integration/SystemTesting have been successfully retested and incorporated into the application,

the Client performs UAT according to the clients internal acceptance testingmethodology and plans. The Client submits software problem reports, if anyare found, and Bamboo tracks these to closure.

An integratedQA approachhelps ensure

continuousprocessimprovement.


24/30


Security and Confidentiality Procedures at Bamboo

Bamboo understands that data security is a key concern for our Partners.The key security objectives for the development environment are:

1. Protect sensitive information, data, and source code from unauthorizedaccess and theft

2. Prevent sensitive information, data and source code from duplication andremoval from the development environment without authorization

3. Enable an audit trail, allowing investigators to trace activity history onindividual computers and servers

Bamboo has a total security system that addresses physical access,electronic access, data security, and human procedures.

Bamboos development center in Guangzhou currently has full physicalsecurity. No one can enter the office without a security card. Visitors aresigned in and given security passes. We understand security very well andhave had no cases of property theft (physical or intellectual). We also havevery low staff turnover and a highly professional team.

For our client Procter & Gamble (P&G) we already operate a fully secure areathat has satisfied a full security audit from their China-based Senior SecurityManager, an FBI veteran who P&G brought in to fight the problem ofcounterfeit products in China. Much of Bamboos current security proceduresare based on the current security protocol that we have implemented for P&G.This means that we have the practical experience of applying and enforcing asecurity policy, in the case of P&G, to a team of 27 people. We recentlypassed P&Gs latest security audit, and are regarded as their most securevendor in China.

Physical Access Control

The entire project team works out of a secure area. Access to this area iscontrolled by a key-card security system. Each team member and otherauthorized persons receive a key card especially for this purpose. Entryand exit will be logged by the system, and the security manager will checkthe log at least two times a day.

All workgroup servers are locked in a separate room within the restrictedarea. Only authorized persons within the project team have access.Access to this room is logged.

All machines are configured with power-on passwords and software locks,which must be activated when the machine is not in use. Consoles of all

servers must be logged out when not in use. All team members are required to set a screen protect password in the

computer with the activation time not exceeding 5 minutes. The passwordis to be kept confidential.

There will be no fax machine or photocopiers in the secure area. All hardcopy documents are filed and kept in locked cabinets with

restricted key access. Key documents will be logged in and out so there isa physical record of who has possession of the documents at any time.

A shredder is provided in the secure area to dispose of any unneededdocuments.

The following diagram represents our proposed development networktopology. Optional additions are included for greater flexibility and aredenoted by dotted lines.

Bamboo has atotal security

system thataddressesphysical access,electronic access,data security, andhumanprocedures.


25/30


Island Topology

The project team has its own workstation PCs, printer, developmentserver, testing server, and email server, all installed in the restricted area.The team is connected to their own LAN, which is separate from thecorporate network. As a result, the team will not be directly connected toInternet. This eliminates the threat of hackers, and the workgroup has noaccess to Internet.

To eliminate the possibility of duplication, no PC has a removable drive,floppy disk drive, or CD writer and all file exchange is through the servers.Connecting any data storage device, e.g. USB hard disk, to any machineis prohibited.

No user is able to change hardware or software configurations. Whennecessary, the system administrator will perform configuration changeswith the prior approval from the security manager. All changes are loggedin detail.

Workstation PCs do have Internet access. Email programs are installedon selected machines only when necessary. However, they only accessthe workgroup email server.

No PCs have file and print sharing functions. This will protect themachines from unauthorized remote login.

A key logger program can be installed on all machines to capture every

keystroke. The program is invisible to the user and a log file is sent to adedicated email account. The security manager audits the log regularly.Configuring or disabling the program requires a special administratorpassword.


26/30


Benefits Drawbacks

1. Very low threat of physicalduplication

1. Reduced communicationsefficiency (via email/fax)

2. All activities can be loggedthrough key stroke andconfiguration change tracking

2. Reduced efficiency in onlineresearch, if needed

3. Totally isolated developmentnetwork minimizes both outgoingleaks and incoming hacks

Option A: Gatekeeper

In this scenario, a gatekeeper is added to the above island topology, andat least one PC (most likely the team leaders PC) acts as a gateway tothe corporate network. This gateway machine will have 2 NICs (networkinterface cards). One is connected to the workgroups internal LAN andthe other is connected to the corporate network. Everything sent outsidethe workgroups internal LAN passes through the gatekeeper and thegatekeeper will be responsible for scanning content and attachments forany security threats.

Outgoing email must go through the gatekeeper.

Benefits Drawbacks


1. Partially reduced communicationsefficiency (via email/fax)



3. Isolated development networkwith highly controlled outgoingaccess

3. Cost of additional PC

Option B: VPN Gateway

A VPN gateway can be added to the island topology to enable Partners toconnect to the workgroup LAN for access to the development and testservers. The VPN gateway will be configured to accept incoming callsonly.

If higher protection is required, the VPN gateway can be activated onlyduring pre-confirmed scheduled times, and left off all other times.

Either a dedicated telecommunication VPN or other broadband line canbe used.


27/30


Benefits Drawbacks





3. Isolated development networkwith highly controlled incomingaccess enables visibility into thedevelopment environment

3. One-off and ongoing line costs

Option C: Hybrid Approach

Both Options A and B can both be added to the island topology in a hybridapproach. This is the most flexible of the four options, and enables bothincoming and outgoing secure access.

Benefits Drawbacks



2. All activities can be loggedthrough key stroke and

configuration change tracking


3. Isolated development networkwith both highly controlledoutgoing email and networkaccess and visibility for Partnerinto the developmentenvironment

3. PC and ongoing line costs

Data Security

Data protection is achieved with physical access and electronic accesscontrol as described above.

Data on the development server is backed up to tape every day atmidnight using a grandfather-father-son backup scheme. With thisscheme, data can be restored up to any one day within a one-monthperiod. The weekly backup tape will be stored at a secure locationoutside the restricted area. The monthly backup tape will be stored at asecure remote site.

A disaster recovery plan will be created, and approved by the client. All team members undergo a training course in Bamboos security policy

(and be required to sign it). Team leaders monitor team members, while asecurity manager and senior management monitors team leaders.

A senior team member acts as the Security Manager and is accountablefor implementing this procedure. The Security Manager reports to the anybreaches of the security policy COO.


28/30


Team leaders audit the daily entrance report and then file it properly. Team members are required to wear unique identity badges. Using another persons computer or materials is forbidden. During working hours there are always at least two people in attendance

in the secure area (i.e. it will not be deserted during lunch time). Without prior approval, no document, printout, or any other media may be

brought out from the restricted area. Bags and overcoats are not allowed into the project room. No photos or videos may be taken in the working area without prior

approval from senior management.


29/30


About Bamboo

Bamboo provides managed software solutions to clients in Asia and the U.S.through an extensive on-and-offshore infrastructure. The company isheadquartered in Hong Kong, with offices in Tokyo, Seoul, San Francisco,and New York and a state-of-the-art offshore software development facilitylocated in Guangzhou, China. Since 1990, Bamboo has servedpredominantly multinational clients, offering a comprehensive suite of bothindustry-specific as well as horizontal solutions. Our areas of expertiseinclude:

e-Business Solutions Enterprise Application Integration (EAI) Custom Application Development ERP/SCM Solutions Outsourced Software Production Digital Design and Web Development Platform/Database Migration Internationalization and Localization

Bamboos team offers a diverse range of talents and expertise in a broadarray of industries. Senior management, who hail from the USA, Great Britainand Hong Kong, have established international standards of management andaccountability to serve clients in multiple locales with a unified, consistentapproach. Our development center in Guangzhou, China, rigorously followsCMM protocols for software development to insure the highest quality ofservice.

Industry SolutionsBamboo is a primary outsourcing partner to the consulting arms of both IBMand Hewlett Packard, partnering on a wide range of client challenges. Inaddition, our firm focuses on key practice areas, including:

Financial ServicesBamboo offers a range of retail, commercial, and investment banking servicesand solutions. This includes message-oriented middleware, risk management,wealth management, online banking, and online securities trading solutions.

Retail and Consumer GoodsBamboo designs and develops e-business solutions that leverage best ofbreed practices, latest technologies, and our extensive background inenterprise resource planning (ERP), e-commerce, logistics, and supply chainmanagement (SCM) solutions.

GovernmentBamboo provides services and solutions to help governments automate theirinternal processes and improve efficiency and deliver e-government servicesto the public.


30/30

Technology

Seasoned senior technology managers who joined the firm after workingtogether for many years at IBM spearhead Bamboos technology efforts.These experts lead our team to meet the highest international development

standards.

Ongoing training on the latest technologies is a central tenant at Bamboo. Ourdevelopers are certified in major technologies such as Java, Microsoft andOracle as well as more specialized applications. Key technology expertiseincludes:

Software DevelopmentBamboo develops application software for Windows, Unix and Linux platformsusing J2EE and Microsoft .NET technologies.

Other programming languages used are C++, Visual C++, Visual Basic,Power Builder, Cold Fusion, Delphi, ASP, Perl, & CGI. We also developapplications/solutions for Windows CE/PocketPC platform.

Platforms/ Servers/ DatabasesPlatforms: AIX, HP-UX, Linux, Sun Solaris, Windows NT/2000Application Servers: WebSphere, WebLogic, BroadVision, BlueStoneWeb Servers: Apache, IIS, iPlanet, TomcatDatabases: Oracle, MS SQL Server, IBM DB2, MySQLFrameworks: J2EE, Struts, .NET, MVCIntegration: MQ, Tibco RV, SNA Gateway, BizTalk Server, Web Services

Security/ Virus ProtectionBamboo provides Internet/Intranet security solutions based on products fromISS, CheckPoint (FireWall-1), Microsoft (ISA Server 2000) and Symantec.We develop SSL / SET protected websites.

E-commerce SolutionsWe develop e-commerce solutions based on the following platforms: Microsoft.NET, WebLogic. WebSphere, Bluestone, and BroadVision.

Wireless/ MobileWe build WAP and iMode Websites and wireless notification solutions basedon SMS, and can provide wireless solutions based on Microsoft MobileInformation Server.

Design Tools

Bamboo uses Flash, Director, and VR-350 to provide multi-media designsolutions.

Approach to Outsourcing

Documents

Transcript of Approach to Outsourcing