April 6-9, 2009 | Rosen Shingle Creek Resort | Orlando, Florida

IT Infrastructure Transformation in the Commonwealth of Virginia Dave Burhop, Virginia Department of Motor Vehicles April 8, 2009

Presentation Topics Virginia’s information technology (IT) model The need Structure and governance Responsibilities IT Infrastructure Partnership Progress in core services Governance IT procurement IT infrastructure operations Lessons learned

Call to Action: State of Technology in 2002 90+ independent, autonomous IT shops Independent, duplicative systems $75M in failed IT projects in 5 years Inadequate protection of sensitive information and equipment Inability to leverage buying power or manage investments Obstacles to sharing information across agencies Few metrics on performance and service delivery

The Numbers Revealed The Need 90+ Independent, Autonomous IT Shops Responsible for: 67,000 PCs 3,000 servers 100 primarily independent data centers 85 Internet connections 61 helpdesks 45 individual Wide Area Networks 40 different email/messaging systems 18 different telephony systems

Governor and General Assembly Took Action in 2003 Created VITA, Virginia’s centralized IT “utility” Abolished three IT agencies Transferred IT assets and staff from 90+ agencies to VITA over 18 months Defined VITA’s primary responsibilities IT governance IT procurement IT infrastructure operations Established funding mechanism Internal Service Fund - budget is largely fees collected Rates approved by Joint Legislative Audit & Review Commission (JLARC)

Governor and General Assembly Took Action in 2003 Created Information Technology Investment Board (ITIB) 10-member supervisory board 3 government members 7 citizen members: 4 appointed by legislature, 3 by Governor Responsible for VITA and all IT oversight and investments Chief Information Officer (CIO) Hired by ITIB to a 5-year contract ITIB’s agent as VITA Agency Head Advise Governor and legislature of investment opportunities

Technology Management Governance Structure IT Investment Board (ITIB) Approve funding priorities Approve project development Approve policies, standards, guidelines Approve Virginia’s IT Strategic Plan Governor Set Executive branch priorities Appoint Board members Develop budget General Assembly Appoint Board members Pass legislation including budget Appointed JLARC oversight of VITA For more details see the Code of Virginia 2.2-2005 – 2032 and 2.2-2457 Chief Information Officer Develop VA IT Strategic Plan Approve Agency IT strategic plans Approve project planning Develop policies, standards, & guidelines (for ITIB) Executive Branch Agencies Develop Agency IT Strategic Plan Adhere to Policies, Standards & Guidelines Manage Agency Applications and Staff Manage & support infrastructure Procure IT goods & services Support CIO and ITIB Chief Security Officer Chief Applications Officer

IT Infrastructure Partnership

State of the IT Infrastructure (Pre-VITA) Aging, inefficient infrastructure 1980s technology environment 50% of equipment 8 to 10 years old The Commonwealth at risk No maintenance on thousands of devices 80% of agencies vulnerable to data breaches, hacking Virginia’s data center building rated a high security risk Inadequate ability to resume operations after a disaster Copyright software license violations (legal liability)

Solution: Build a 21st Century Infrastructure Nation’s largest public-private partnership Commonwealth of Virginia and Northrop Grumman Corporation formed partnership in November 2005 Contract valued at $1.9 billion over 10 years Northrop Grumman invests $270 million in up-front capital Replace aging, inefficient infrastructure in agencies Modernize and standardize IT services and support Consolidate and centralize infrastructure equipment and monitoring Investment in people and communities Creates more than 400 jobs in rural southwest Virginia No layoffs of state IT employees Northrop Grumman is positioned to grow in Virginia

Infrastructure Investments Through Private Partners Messaging Services Help Desk Desktop Enterprise Exchange/Outlook E-mail Enterprise Collaboration Tools Active Directory, DNS $25M Investment Mass Desktop Refresh Network Printer Consolidation and Refresh Enterprise Desktop Management Systems $35M Investment Enterprise Help Desk in Russell and Chesterfield Field Based Agents and Technicians for Level 3 Enterprise Help Desk System (Peregrine) $10M Investment Mainframe and Servers Security Transformation People – Process – Tools Reliable, High-Performance, Enterprise-Wide IT Infrastructure New IBM and Unisys Mainframes Consolidation and Refresh of Servers Migration of servers to the Data Center $50M Investment Enterprise Security Operations Center Computer Security Incident Response Center Secure Internet Gateway $10M Investment $270 Million Investment Tier 3 and Tier 2 Facilities Network Voice / Video New Data Center/Office Building in Chesterfield New Disaster Recovery Center and Help Desk in Lebanon, Russell County $60M Investment New Commonwealth-Wide MPLS Core WAN LAN upgrades to Local Switches/Routers as Needed Network Re-addressing of IP, DHCP $60M Investment Voice-Over IP Network Optimized for Voice and Video Traffic $20M Investment

Progress in Core Services

IT Infrastructure Accomplishments Significantly improved information security Corrected software copyright licensing violations Constructed two data center facilities (Chesterfield & Russell) Began creating over 400 high-tech jobs in southwest Virginia Replaced much of the infrastructure with new, standard equipment Implementing standard, consistent processes and metrics statewide Establishing predictable, consistent prices that are planned for and budgeted

Commonwealth Enterprise Solutions Center Chesterfield County

Southwest Enterprise Solutions Center Town of Lebanon, Russell County

Enterprise IT Governance Accomplishments To 2009: Strong investment management program for new IT projects Strategic IT investment decisions promoting enterprise solutions No major IT project failures since 2003 From 2002: Lack of oversight Independent, autonomous decision-making $565 million spent on duplicative, stand-alone systems $75 million in failed major IT projects from 1998 - 2002

Centralized IT Procurement Accomplishments To 2009: Leveraged buying power Decreased costs Increased annual SWaM spend from $4M to $80M From 2002: Buying power not leveraged Lack of standards Multiple, inconsistent procurement processes Low spend with small, women- and minority- owned (SWaM) companies

IT Reform in Virginia Results in Efficiencies Had we done nothing, Virginia would have… Experienced additional failures of major IT projects Spent $200 million more over the next decade supporting an aging IT infrastructure Spent an additional $120 million on energy consumption over the next decade Paid $45 million more for IT products and services without central IT procurement management

Lessons Learned

Hard Lessons We Learned the Easier Way Executive sponsorship is essential Talk to others about what worked, what didn’t and why IT reform is about culture change Build and maintain momentum, confidence Manage stakeholder expectations Technology People & Process

Hard Lessons We Learned the Hard Way Get your arms around what you’ve REALLY got in your IT environment Be data-driven Conducted five “due diligence” exercises “Legasaurs” – ancient equipment Years of underfunded IT programs Poor inventory records and processes Lack of basic security protection 1,200+ employees organized by agency, supporting more than 2,000 sites Sorely under-utilized capacity for servers, printers Transformation takes longer than you think Virginia’s schedule is aggressive (36 months) Must accommodate agency business cycles (don’t transform Tax in April)

Hard Lessons We Learned the Hard Way Look behind the curtain Back-end processes and procedures (the “how”) must transform with technology services (the “what”) Asset inventory Service requests Pricing & billing Customer relationship management Communications IT support Documentation Purchasing New service offerings Change management Personnel management

Hard Lessons We Learned the Hard Way All stakeholders – especially employees – need to feel they are being treated equally and kept informed Focus on the 90 – 95 percent who are “with” the program or can be swayed either way Do not cater to the 5 – 10 percent you can never win over If outsourcing, understand the governance model and the relationship with your partner Traditional client-vendor relationship? A risk/reward-sharing partnership? Something in between? State policies do not contemplate an outsourcing arrangement

Hard Lessons We Learned the Hard Way Ensure agencies coordinate with state budget department on rates (cost impact, timing, etc.) BEFORE they are implemented Ensure agencies understand “what’s in the rates” Implement all aspects of disaster recovery as part of the base modernization rate package – don’t make DR optional Agency level SLAs should be identified early on so the “to-be” model can be designed to support them Streamline early on the process that supports agency service requests Centralized print close to the customer agencies is a necessity Delegated Procurement Authority to agencies should be considered on a case-by-case basis Delegated Project Authority to agencies should be considered on a case-by-case basis

Hard lessons we learned the hard way Embrace the media Informed reporting vs. investigative reporting Start with the big agencies The largest 15 agencies in Virginia represent ~80% of the spend What’s that noise? It is not a celebration….(yet) “There” is good; getting “There” is painful The noise level overall has not decreased, but We will eventually get There!

Recent recognition Virginia’s security program rated #1 in the nation in 2008 by National Association of State CIOs (NASCIO) Virginia’s infrastructure partnership rated #1 in the nation by NASCIO Virginia’s Web site ranked #1 in the nation by the Center for Digital Government Virginia received a 2008 Telly Award for its security awareness video “The Duhs of Security” Virginia ranked #3 in the nation for all aspects of technology by the Center for Digital Government

References/Resources

Virginia Information Technology Investment Board Links/References VITA (Many thanks to VITA for providing much of the information used in this presentation!) http://www.vita.virginia.gov/ Virginia Information Technology Investment Board http://www.vita.virginia.gov/itib Virginia’s official portal http://www.virginia.gov The Code of Virginia – IT governance http://leg1.state.va.us/cgi-in/legp504.exe?000+cod+2.2-2006 The Code of Virginia – PPEA (partnership vehicle) http://leg1.state.va.us/cgi-bin/legp504.exe?000+cod+TOC56000000022000010000000 Technology oversight http://www.vita.virginia.gov/oversight/

Links/References IT Infrastructure Partnership homepage http://www.vita.virginia.gov/itpartnership How we got here – proposals, history http://www.vita.virginia.gov/itpartnership/default.aspx?id=381 Comprehensive infrastructure agreement – the contract http://www.vita.virginia.gov/itpartnership/default.aspx?id=451 Frequently asked questions http://www.vita.virginia.gov/itpartnership/default.aspx?id=379 Media kit and fact sheets http://www.vita.virginia.gov/itpartnership/default.aspx?id=6404 IT infrastructure transformation, schedule http://www.vita.virginia.gov/itpartnership/default.aspx?id=371