Technology Management Strategy

Note 1: The authoritative source (and latest version) of this Strategy is on ESDC’s internal network

Note 2: Some of the links within this strategy are accessible only within the ESDC corporate network. These links are marked (ESDC only).

Situational Awareness

The Government of Canada (GC) released its Digital Ambition in 2022, a list of priorities and plans to fulfill the ambition of the GC’s Digital Strategy as per the aspirations of the GC’s Digital Standards. At the same time, ESDC launched the Benefits Delivery Modernization (BDM) Programme seeking to transform its Programs Service delivery to be digital.

The GC and ESDC are embarking on this journey while most of ESDC’s technology infrastructure is suffering from chronic technical debt affecting existing critical technology solutions that Programs depend on. The GC’s cloud smart strategy seeks to incentivize and prepare departments in migrating current workloads and deploy new ones to the public cloud or SSC end state data centre.

These ambitions and resulting technological demands all converge to IT organizations creating a risk of not being able to keep pace of relevance and, as a result, inhibiting the department to fulfill its digital ambitions.

Specific to ESDC’s context we see that:

• The department runs 53 social benefit programs¹
• That delivers 116 services to Canadians²
• That are enabled by 435 Corporate IT Solutions, 116 of which are mission critical³
• That employs more than 40,000 employees, distributed across 25 Branches⁴
• That has 75 IT-Enabled Projects approved and started, one of which is the first project of many from the BDM Programme ⁵

This seems to place IT organizations in an impossible situation to maintain operations, build new, integrate old and new, and transition from old to new without affecting Program operations.

As digital encompasses service delivery, data, identity, cyber security, and technology, how can an IT organization realistically succeed in this environment?

Strategic Goals

IT exists to enable Programs to deliver services to Canadians. If Programs meet their service standards⁶ and Canadians are happy with its delivery, then IT succeeds. This User Experience aspect of Program service delivery puts IT at the forefront since technology is now a medium for Program service delivery.

ESDC is equipped with multiple strategic functions. It’s the combination of those strategic functions that make up “Digital”:

• Service Strategy (a mandate of SSPB) and Identity Management (a mandate of ISB) are being transformed as part of the BDM Programme’s Business Change Authority(ESDC only)
• Data is the mandate of the Chief Data Officer (CDO) who has produced ESDC’s Data Strategy (ESDC only)
• Information is the mandate of the Chief Information Officer (CIO), delegated to the DG of Business Solutions and Information Management (BSIM), who has produced ESDC’s Information Management Strategy(ESDC only)
• Cyber Security is the mandate of the Designated Official for Cyber Security, the DG of Enterprise Operations, who has established a Cyber Security Program(ESDC only)
• Information Technology is the mandate of the CIO, delegated to the DG of Strategy, Architecture, and Business Relations (SABR). This document serves as the Strategy for Information Technology.

This highly complex and distributed environment requires different levers: it is not about asking for more money for technology investments using committees to oversee approval and compliance, but rather investment in a skilled public service; fit-for-purpose governance and policies; explicit support for empowered, multidisciplinary teams that work together in lockstep, from policy to implementation and iteration.

To that effect, this IT Strategy focuses on three main goals:

1) Change the approach to funding technology

Digital is a game changer. Treasury Board has now codified that Program services use technology for their delivery which resets the relationships between policy, delivery and evaluation. This means technology is no longer a back-office function but a medium.

Saying “the website is not what we do” is no longer an option. For Programs to inform realistic policy agenda, to timely respond to new insights, and to deliver at the speed of relevance, they require timely access to technology services.

The current mechanism Programs use to engage with technology services is to launch temporary projects so that the Corporate function of the department can then evaluate its capacity to prioritize and assign work. This inadvertently promotes risky behaviours that are incompatible with digital-era practices.

Funding technology-related work in the digital era requires seeing technology as products, and for the IT organization providing services associated to those products to timely adjust their capacity based on product demands, not project demands.

Progress on this goal is measured by:

A) Percentage of Applications from ESDC’s Corporate Solution Directory that have onboarded the IITB Product Management Framework (data source: PPRC⁷)

B) Percentage of IITB’s Budget that is categorized by ESDC’s Corporate Solutions (data source: IITB Resource Management)

2) Raise Awareness on the costs and risks of using technology for Programs Service delivery

Risks equate to Data and Information. Technology is but a tool, the asset the organization cares about is Data and the story it tells (Information). Stemming from Data and Information is the privacy, security, and now ethical concerns of using technology as part of Programs service delivery.

Although theTB Policy on Service and Digital puts the accountability towards technology risks on multiple officials, the integrated management requirement starts shifting the responsibility towards Programs by having sufficient understanding on the implications of using technology (legal, security, ethics).

Costs equate to Programs needing to be realistic in their digital ambition as difficult prioritization decisions over limited capacity will need to be made, and the purchase of commercial software comes at a price.

Risks equate to Data and Information. Technology is but a tool, the asset the organization cares about is Data and the story it tells (Information). Stemming from Data and Information is the privacy, security, and now ethical concerns of using technology as part of Programs service delivery.

This goal directly points to the efforts by ESDC’s Chief Data Officer and Enterprise Information Management team.

Progress on this goal is measured by:

A) Percentage of Programs that identified technology’s on-going expenses in their periodic Treasury Board Submission Renewals (data source: Programs Treasury Board Submissions)

B) Degree of Data and Information literacy (data source: Data and IM Strategies desired outcomes and measurement methods)

3) Modernize IITB’s software delivery capabilities

This goal directly points to Foundational Capabilities identified in the IITB Strategic Priorities(ESDC only). In particular “higher velocity and quality through the adoption of modern ways of working” and “maturing cloud services capabilities”.

Technology is no longer a “package” that you purchase at a store and install. Technology, including infrastructure, has become software services that are configured, consumed, and that keeps on improving over time. Demands for their use require a variety of internal IT services for their effective and secure delivery, but ultimately when a Program seeks technology services, they seek to obtain software services.

Project demands, maintenance, migration to the public cloud or end state data centre, are all sources of requirements that inform the “Application’s” roadmap (a grouping of software). The ability for an IT Organization to execute and make progress on all demands submitted to it is heavily dependent on its ability to perform more frequent and smaller software changes.

Progress on this goal is measured by⁸:

A) Decrease in lead time for change: the time code changes take to go from check-in to release in production (data source: TBD, may be a combination of Application’s source code repository and IT change record)⁹

B) Increase in deployment frequency: the rate at which software is deployed to production or released to end users (data source: IT change record)

C) Decrease in change failure rates: the change failure rate measured by how often deployment failures occur in production that require immediate remedy (data source: IT change record)

D) Decrease in time to restore: the time it takes from detecting a user impacting incident to remediating it (data source: National Service Desk record)

E) Decrease in Cyber Security Vulnerabilities: the number of cyber-security vulnerabilities registered per application (data source: Vulnerabilities Registries)

Coherent set of actions

A coherent set of actions is necessary to align resources, internal policies, and maneuvers in a coordinated fashion to support each other as opposed to fighting against each other. This set of actions needs sufficient buy-in at a sufficient level of authority to provide cover for the personnel that will be doing the work.

References