By Darwin John, Strategic Advisor and Greg Siefert, Director of Application Solutions Although still stretched to the limit, CIOs today are approaching each day with a renewed sense of comfort and the ability to focus on enterprise strategic direction as well as the day-to-day operations they didn’t always have time to before outsourcing. They are patting themselves on the back for jumping on the outsourcing bandwagon and saving their company ample time, money and resources. Unfortunately, as the trend progresses, these same CIOs are experiencing a new, unanticipated result: the loss of self-sufficiency. Each organization needs to be clear on the work only they can perform. Whether due to the proprietary nature or the level of expertise needed, there are certain core competencies that only members of the organization can perform. As companies have placed responsibility for mission critical systems in the hands of application service providers (ASPs) and outsourcing partners, the shift from internal self-sufficiency to external vendor dependency has become a slippery slope. As a result, CIOs are faced with the challenge of reclaiming self-sufficiency – defining additional core competencies that enable them to control their own destiny by not being solely reliant on a single source. To overcome this challenge, CIOs need to adopt right-sourcing, a model that produces results with a cost-effective mix of internal and external resources to enable their organization to obtain true self-sufficiency. Although many CIOs are confident they have these plans in place, when the self-sufficiency challenge becomes a sudden reality, they aren’t nearly as prepared as they thought. The volatility in today’s business climate can leave CIOs faced with the imminent need to take back ownership of previously outsourced functions and intellectual property. This can happen for numerous reasons, including vendors going out of business or ASPs overselling reality and using a single client as a source of “venture capital” only to resell the service to their competitors. With the right mélange of planning and analysis, CIOs will be equipped to handle these types of situations, become self-sufficient and employ right-sourcing in their organization. While CIOs cannot prevent sudden changes in the business climate or control the business vitality of vendors, they can, however, have the framework in place to quickly extinguish unexpected fires. CIOs can go a step beyond and even prevent these fires from igniting in the first place. Processes and procedures to regain self-sufficiency and attain right-sourcing can be built into the upfront planning and vendor selection process, enabling an organization to not only have a self-sufficiency model, but to have tactical plans in place to ensure their self-sufficiency. Furthermore, this approach can be used at any point in a project life-cycle allowing CIOs to measure their level of self-sufficiency and validate their right-sourcing models.The following five steps are geared to enable CIOs to deal with abrupt changes, quickly define internal self-sufficiency and develop their right-sourcing models. Step 1: Define Critical Success FactorsThis step is the cornerstone to achieving self-sufficiency. Critical success factors enable prioritization, communication and measurement of the project. They become the focal point and measuring stick for all of the associated activities. Typically, goals are set for current and future states for productivity levels/service levels, costs, and quality. These need to be concise, achievable and have metrics to clearly layout how to report on success. An example of a critical success factor could be: Productivity levels/service levels will not drop during transition period as measured by average turnaround time for issue tickets and system downtime. Step 2: Create and Formalize a Post-Transition VisionThe post-transition vision defines the steps in the support process (see the example in Figure 1) and more importantly, it establishes the appropriate level of self-sufficiency for the organization. Each enterprise and, potentially, each application will require a different level of self-sufficiency. While determining this level, a CIO must address the concepts of “Competency vs. Capacity” and “Mastery vs. Leverage,” as outlined below, in order to create a successful post-transition vision.Competency – retaining the expertise to complete processes and tasks strategically and successfully. Internally, an organization may not actually have resources assigned to these processes and tasks on a daily basis, but has the knowledge of how it is done. Capacity – staffing enough people with competency. Capacity implies that there are a number of internal resources actually engaged in doing the work.Mastery – maintaining the expertise and the ability to perform processes and tasks in a specific area, albeit less cost-effectively than other resources. The mastery level is attained by a handful of typically expensive resources.Leverage – ensuring the ability to do the work as competently and as cost-effectively as the vendor. This implies that companies are leveraging the mastery level resources with lower cost resources working at the direction of the masters. While, at face value, achieving this goal may seem impossible given competitive vendor rates, there is an opportunity to eliminate “off the radar” costs (additional project management costs, increased telecommunications cost, etc.) if you bring the entire operation in-house. Leverage can be accomplished by having a consistent delivery approach on which you train and coach your resources.An organization must have competency throughout the support process in order to manage tasks and make the appropriate staffing decisions. Additionally, the CIO must strive to have internal capacity for the tasks in the process that relate to core business knowledge and technical architecture given intellectual capital is the lifeblood of a company. Internal capacity becomes less important for some of the lower level roles, such as development and unit testing. The goal is to define the level of self-sufficiency that allows a CIO to control the organization’s IT destiny. The vision should illustrate that a company is in possession of the competency and mastery and, as a result, not solely dependent on one vendor. Right-sourcing defines the appropriate use of vendors to provide a company with the capacity and leverage while not affecting self-sufficiency. Step 3: In-Depth Current State Analysis Once a CIO has established the critical success factors and post-transition vision, he or she must analyze the current process to determine where to concentrate the transition effort. This is done through the examination of each role in the current support model – both internal and vendor roles. This detailed analysis will focus on the functions, responsibilities, skills necessary, time allocation, resource cost and resource headcount for each of the current roles in the support process. The output of this analysis is used to determine the differences between the future vision and the current state. This analysis feeds directly into Step 4.Step 4: Develop Strategies to Move from Current to Future StateAfter the CIO uncovers the specifics of the current state, he or she will develop specific strategies to achieve the vision. These strategies should be measured against the critical success factors from Step 1. With a critical eye, a CIO must answer the following questions to successfully transfer into the future state:Resource Training – Will the company use formal training “boot camps” or pair resources with the current vendor’s resources for on-the-job training? Standards – Are the standards “word of mouth” or does the CIO have documented artifacts, guidelines and templates?Transition Service Level – Will the CIO maintain current service levels for quality and throughput during the transition or will this have more cost than benefit? Transition Staffing – Does the company increase overall staffing during the transition and replace vendor headcount as the internal staff becomes more proficient? Or does the company make a radical change?Knowledge Management – How does the company store and share documents, specifications and frequently asked questions? How does it create a meaningful taxonomy to categorize and index this information? Step 5: Project, Staffing and Financial PlanningAs the CIO commits to his company’s transitioned state, he or she must translate the strategies of the planning stages into a tactical implementation plan. This should include a detailed work plan and timeline with clear tasks and owners, as well as a clear staffing plan. Additionally, a formal ROI analysis can be included to show the initial investment and ongoing costs, as well as evaluate various models (i.e., staffing mix, transition duration, etc.). The ROI analysis will show the value of the post-transition support model and can be used as an additional measure of success. This analysis is especially useful during the upfront planning process or as an ongoing measurement and validation of a CIO’s current level of self-sufficiency and right-sourcing.Extinguishing the FiresThese steps are typical of a strategic assessment and planning projects, but however smart and strategic, this is not magic. The steps are a consistent proven vehicle for a CIO to leverage during the transition from a current disaster state to the post-transition and fully self-sufficient state. The magic does lie, however, in how a CIO thinks about self-sufficiency and right-sourcing – as critical components of the planning stages.A CIO can indeed be prepared for the ever-changing nature of the business climate. By clearly defining the success factors and vision for application support during the project definition, a CIO can actually work with external vendors to build a predisposed transition plan at the start, given a future change in the relationship. Additionally, CIOs can measure their current self-sufficiency and validate their right-sourcing model. With some additional upfront planning and discipline, self-sufficiency and right-sourcing can become part of the corporate culture and CIOs can continue to take comfort in their decisions and focus on the day-to-day activities that often get lost in the mix. Related content feature Top cybersecurity M&A deals for 2023 Fears of recession, rising interest rates, mass tech layoffs, and conservative spending trends are likely to make dealmakers cautious, but an ever-increasing need to defend against bigger and faster attacks will likely keep M&A activity steady in By CSO Staff Sep 22, 2023 24 mins Mergers and Acquisitions Mergers and Acquisitions Mergers and Acquisitions brandpost Unmasking ransomware threat clusters: Why it matters to defenders Similar patterns of behavior among ransomware treat groups can help security teams better understand and prepare for attacks By Joan Goodchild Sep 21, 2023 3 mins Cybercrime news analysis China’s offensive cyber operations support “soft power” agenda in Africa Researchers track Chinese cyber espionage intrusions targeting African industrial sectors. By Michael Hill Sep 21, 2023 5 mins Advanced Persistent Threats Cyberattacks Critical Infrastructure brandpost Proactive OT security requires visibility + prevention You cannot protect your operation by simply watching and waiting. It is essential to have a defense-in-depth approach. By Austen Byers Sep 21, 2023 4 mins Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe