Organizations goals and objectives

Introduction

Organizations exist to create value for their stakeholders by retaining a balance between achievements of profits by pursuing opportunities, optimizing the use of resources and reducing related and potential risks. In order to so, organizations need first to set clear set of objectives a goals that articulate their mission, value and reason for existence, and then strive to achieve them. While the organizations' goals represent the desired destination, the chosen objectives characterize the road map to get there.

Below some of the organizations’ typical and common goals and objectives

• Increasing sales and market share;
• Improving customer service and retention;
• Strengthening partnerships; 
• Hiring talented people and training current staff; 
• Minimizing logistic costs; and 
• Expanding the organizations' presence...etc.

Such goals and objectives should inevitably lead the organization to the right direction and track through achieving profitability, maintaining employees and customer’s satisfaction and thus ensuring continual growth.

Business-IT alignment

Business-IT alignment is the sustainable ability of organizations to effectively overtime integrate and use information technology to achieve their objectives and create value. In reality, a misalignment is noticed as most organizations fail to close the gap between IT and the rest of the business, this situation often enlarges due to distinction of objectives, drives, cultures, attitudes as well as ignorance. Such scenario leads often into expensive and inadequate IT deployments without real return of investment (ROI).

The alignment usually aims to improve the business value of IT investments and maintain organizations' success by

• Building a trust relationship and facilitating communication between decision-makers and IT managers; 
• Flexibility in implementing business plans and Enterprise Architecture;
• Presenting the Enterprise Architecture’s capability and limitations; 
• Efficiency in managing organizations budget and resources; and
• Ensuring optimal return of investment (ROI) of IT funds.

Ensuring better business-IT alignment can be implemented by translating organization’s goals and objectives into adaptable, specific and mapped IT-related goals, processes and practices. This is can done by adopting standard Enterprise Architecture and IT governance frameworks as TOGAF, COBIT and ITIL.

Business-IT risk alignment

Organizations tend to have limited resources and poor considerations in implementing effective enterprise-wide risk management, it’s often to see the organization’s risk profile outdated and not aligned with their goals and objectives, and not focused on top management issues.

In responding to internal and external events, factors and changing business landscape, organization’s objectives and strategic priorities constantly changes over time to keep pace with the environment in which it operates. Unless frequently revised and updated; risk management efforts become responsive and compliance-oriented rather than supportive, and risk appetite and tolerance thresholds became unrealistic and then cannot reflect current organization’s objectives.

Organizations traditionally organize separate meetings for strategic decision-making, planning and risk related initiatives, and thus limit the interaction between these activities which generate ineffective and redundant efforts and result in additional risks. However, the alignment aims reduce such activities and eliminates the gaps in between by integrating risk management with business strategy.

Risk management activities are often limited within IT department by assessing threats and vulnerabilities related to the department’s assets only which narrows risk mitigation and exposes the rest of business to wide range of risks and uncertainties. However, risk practitioners should consider the overall business scope and extends the risk assessment to all the entities, processes and projects supported by IT division as well as external suppliers. Risk practitioner should also study previous incidents and proactively act to prevent similar incidents from occurring in future by implementing appropriate mitigation controls, and so not underestimating any potential risk.

Another key factor in establishing an effective risk alignment is setting up communication channels with top management to facilitate assessing business goals, strategies, priorities and decisions toward embracing emerging technologies, assuring regulatory compliance and covering the overall enterprise end-to-end. Moreover, Risk practitioners should be involved in assessing potential risks related to strategic and confidential plans which produce major impacts such as acquisitions, mergers, changing markets and staff reduction in order to put in place adequate and effective mitigation plans.

One of the best approaches in aligning risks with business objectives is implementing information security frameworks, risk management methodologies and standards such as

• ISO/IEC 27001 - Information security management systems;
• NIST SP 800-39 - Managing Information Security Risk;
• ISO/IEC 27005 - Information Security Risk Management;
• COSO Enterprise Risk Management - Integrated Framework;
• ISO 31000 - Risk Management - Principles and Guidelines; and
• NIST SP 800-30 Revision 1, Guide for Conducting Risk Assessments.

Such practices advocate for holistic approach in managing information security and associated risks and provide an assurance in achieving business objectives and thus ensuring risk alignment with business goals.

Conclusions

Risk management focuses on constant understanding, alignment and securing the organization’s strategies and objectives by promoting the adequate security controls. Moreover, associated risks can be sometimes overlooked in favor of pursuing opportunities that meet organization’s goals.

Risk practitioners should continually and intelligently advertise and over time cultivate risk culture into people’s mindset, and integrate risk management activities and practices into the overall business strategies and processes.

By admitting that risks impacting the organization can be originated either from the technology in use, the people operating this technology, or from the applied processes; failing to integrate these main sources of risk into the risk profile inevitably puts the organization in great danger.

Enterprise Architecture

Introduction

Enterprise Architecture (EA) is the process of developing enterprise IT architecture’s description and implementation. The description focuses on a holistic and integrated view of the why, where, and who uses IT systems, how and what they are used for within an organization. The implementation develops the strategy and enables the decisions for designing, developing, and deploying IT systems to support the business operations as well as to assess, select, and integrate the technology into the organization’s infrastructure.

EA main components

Enterprise Architecture is the unifying logic for an organization core business processes and IT capabilities captured in a set of main correlated architectural modules such as

• Business Architecture which covers the organization’s structure, objectives, processes, roles and projects;
• Application Architecture which includes applications and interactions in between; 
• Data Architecture which handles data, data flows and data access;
• Technical Architecture which consist of hardware, software, systems, networks and IT platforms.

An IT system is composed by software and hardware, while the software includes programs, libraries and data which are translated into operating systems, drivers, APIs, applications and databases...etc., the hardware is the physical parts that forms a computer (e.g. motherboard, CPU, monitor, hard disk, memory...etc.).

An operating system (OS) such as OS X, Linux, Windows, Android and iOS is a component of system software that manages computer hardware and software resources and provides common services for computer programs which usually require an operating system to execute and operate on top of it.

A network such as the Internet allows computers (as network nodes) to exchange data via network devices (e.g. interfaces, switches, routers, firewalls), over communication links and mediums (i.e. cable or wireless), laid out following specific topologies (e.g. line, ring, star, mesh), which is geographically scaled (e.g. using LAN, MAN or WAN), carried out using certain protocols (i.e. TCP/IP) and caries various applications (e.g. web, email, audio and video).

An IT platform is a collection of physical or virtual resources (e.g. servers, storage, networks) that supports an overall IT environment established to capture, generate, process, transmit, present and store information. The IT platform can be formed within a single mainframe, or composed by several resources unified altogether as a single entity (e.g. middleware) in a centralized location (e.g. datacenter), or formed by decentralized components remotely interconnected (e.g. cloud computing or platform as a service).

IT platform hosts wide range of business applications such as

• Enterprise Resource Planning (ERP), 
• Customer Relationship Management (CRM); 
• Human Resource Management (HRM); and 
• Project management. 

These applications can be internally accessible within the organization premises, or externally reachable using VPN connections from users using various endpoint devices such as PCs, laptops, tablets or smartphones.

Energy related supplies and utilities such as power supply, power generators, UPS (Uninterruptible Power Supply), HVAC (Heating, Ventilating, and Air Conditioning) and air purifying are critical auxiliary assets that support the overall IT infrastructure.

Challenges in maintaining EA

Enterprise Architecture is a quarter-century concept created to align with business objectives to tackle the increasing complexity of IT systems on top of following traditional issues:

• Lack of support and commitment from stakeholders
• Absence of communication channels, reporting and awareness;
• Shortage of skilled and experienced talented;
• Incompatibility of outdated standards;
• Inapplicability of available frameworks; 
• Nonexistence of measurement and performance metrics…etc.

Even though, the same old issues still persist today and enlarged by the accelerating pace of emerging technologies, alignment between business and IT, besides the required talent, cost and time to put in place such concept represent the organization’s top issues in establishing a mature Enterprise Architecture.

Enterprise Architecture is often wrongfully translated to the practice of documenting the organization’s IT infrastructure and spending all the efforts applying a framework instead of solving real problems, and carrying out business changes by constantly transforming organization’s structure and behavior within a complex environment.

An Enterprise Architecture can be exposed to wide range of risks such as for instance

• Obsolete hardware or software;
• Equipment or application failure or malfunction;
• Non-redundancy of services or links;
• Unpatched vulnerabilities;
• Misconfigured devices or settings;
• Unlogged and untraced events;
• Default security passwords; 
• Poor network cabling;
• Wireless signal interference;
• Unprotected wireless access points;
• Power outages;
• Poor maintenance or maintenance fault; and 
• Unsecured facilities...etc.

Since the IT system of an Enterprise Architecture is an interrelated set of components connected to each other; an adverse risk related to an IT subsystem can disturb the overall IT system. Hence, the risk assessment of the entire system should be established by assessing the threats, vulnerabilities and impacts related to each subsystem and component.

EA frameworks

An Enterprise Architecture Framework describes how to build and use an Enterprise Architecture by providing a set of principles, practices and tools to manage the complexity and scalability of IT systems and producing valuable description documentation.

There are countless Enterprise Architecture frameworks, some of them focus on modeling existing organization infrastructure, others focus on solving business issues. While some of the frameworks are proprietary, others are open source, certain frameworks were developed by either specialized groups, government or defense organizations. Below some of leading methodologies

• The Zachman Framework for Enterprise Architectures 
• The Open Group Architectural Framework (TOGAF) 
• The Federal Enterprise Architecture (FEA) 
• The Department of Defense Architecture Framework (DoDAF)
• The Gartner Methodology (GEA).

As these frameworks very different in their nature and approach; the appropriate framework should be selected and used based on the organization’s criteria.

Conclusions

Enterprise Architecture is a conceptual blueprint for business processes and IT system that defines the structure and operation of an organization which intended to determine the most effective ways to achieve the current and future objectives.

The Enterprise Architecture can be seen as the well-defined set of practices for conducing organization’s mission in achieving its strategic objectives, improving decision making, adapting to market trends, creating value and realizing benefits while maintaining optimal levels of risks and use of resources.

In regard to risk management, Enterprise Architecture contributes to reduction of business risks from system failures, security breaches and reduces project delivery risks.