1. IRDR & IR-CAP Briefing April 25 th,2016 1:30-2:30

2. Grab Tab Audio Pane Use Settings to configure and test audio and other preferences. Click arrow to expand and collapse control panel Click hand icon to raise/lower hand Control Panel Question Pane Enter questions here. Control panel options may vary slightly depending on webinar configuration. Attendee List See attendees on one tab, staff on another. GoToWebinar ® Attendee Controls

3. DIR Staff Deborah Hujar MODERATOR Matt Kelly PRESENTER

4. Welcome 53 registrants CPE Credit We will post slides and recording Find updates and more information on the IRDR page of dir.texas.gov Ask questions anytime using the question pane IHE Reminder

5. Background The IRDR is a standardized survey that: ​​​​​​ Measures an agency’s progress against the State Strategic Plan (SSP) Confirms that the agency is in compliance with the state's IR-related statutes, rules, and standards Examines how each IR deployment has supported the agency's mission, goals, and objectives

6. IR-Corrective Action Plans The IR-CAP process is designed to elevate agency awareness of IR compliance issues and to demonstrate to DIR that you are making progress toward correcting them. While full compliance remains a challenge for some agencies, DIR stands ready to assist IRMs in their efforts.

7. Agenda Introduction and Background IRDR Findings Q&A IR-CAP Process Overview IR-CAP Demo Q&A Wrap-up

8. Agency Environment

10. Software Currency

11. Security 98  156 Security Professionals (59% Increase) 23% of agencies have increased security budgets over the biennium Top Five Security Initiatives for the biennium: 1.Data protection 2.Security training and awareness 3.Business continuity 4.Security risk assessment 5.Application security

12. Accessibility Participation in free website accessibility scanning program has doubled over the last biennium.

13. Computing Inventory Type2011201320152011-2015 Change Desktops108,666112,31994,700 -13% Laptops29,46639,94544,920 52% Tablets7,5909,85312,943 71% Smartphones10,04622,36827,299 172% Not-so-Smartphones17,1279,6726,763 -61% Printers32,74944,28346,387 42%

14. Computing Inventory

15. Cloud

16. Desktop Virtualization

17. Training

18. Legacy Based on the assumption that security is always a factor, what are the main legacy applications issues facing the agency? Software maintenance upgrades - limited or unavailable29 Extensibility, adaptability, agility - inability to enhance or revise26 Technical support - unavailable or difficult to obtain24 None20 Documentation - non-existent or out-of-date18 Application development tools - limited expertise (dead languages)17 Accessibility - remediation cost, time, feasibility11 Other6 Software - no longer available or difficult to obtain6 Hardware - no longer available, limited or no support4 Hardware maintenance - limited or unavailable3 Recoverability - uncertain how or where to recover3

19. E-Gov

20. Domain Names

21. Data Management

22. Data Utility

23. Compliance Each agency must perform and document an annual assessment of High Risk information resources, and a biennial assessment of Medium/Low Risk information resources. Each agency must comply with all EIR Accessibility Policy and Coordinators provisions 1 TAC 213.21(b) through 1 TAC 213.21(f) or 1 TAC 213.41(b) through1 TAC 213.41(f). The agency shall institute, approve, and publish an operating procedure that communicates an agency-wide approach for information technology project management practices, meeting listed standards.

24. Compliance SecurityState WebsitesAccessibilityGISElectronic Record MgmtIRMProject Mgmt Procuremen t Privac y 2.01.012.01.022.01.032.01.042.01.052.01.062.01.072.02.012.02.022.02.032.02.042.02.052.02.062.02.072.02.082.03.012.03.022.03.032.03.042.03.052.03.062.04.012.04.022.04.032.05.012.05.022.05.032.05.042.05.052.05.062.05.072.06.012.06.022.06.032.06.042.06.052.06.062.06.072.06.08 1 1 1 1 11 1 1 1 111 1 1 1 111 1 0 0 11 111 1 0 1 00 1 111111 1 1 1 1 1 1 1 0 1 1 1 1 1 0 00000000 0 1 1 111 1 1 1111 1 1 1 1 11 11 1 1 11 1 111111 1111111 1 1 1 1 1 1 11 11 1 1 1 1 11 111 1 1 1 1 11 111 1 31100012510011007888710000413352242 11000

25. 2014 SSP Progress SSP PriorityNo progress Minor progress Moderate progress Significant progress Business Continuity1%22%28%49% Cloud8%22%29%33% Data Management7%32%37%21% Enterprise Planning & Collaboration8%28%24%32% IT Workforce8%33%27%21% Legacy Modernization3%13%32%45% Mobility8%32% 22% Network3%12%33%49% Security0%20%41%38% Virtualization8%9%26%50%

26. 2016-2020 SSP

27. 2016 SSP Alignment Focus AreaNot applicableNo plans to alignPlan to alignMinor alignment Moderate alignment Significant alignment Cloud5% 3%21%34%32% Connectivity4%0%3%11%20%63% COOP0% 3%11%33%53% Analytics13%0%8%28%29%22% Data Mgmt1%0%13%24%36%26% Digital Services5%1%7%16%32%39% IoT30%13%8%24%17%8% IT Funding3%1%7%16%32%41% IT Planning and Gov3%0%4%16%33%45% IT Workforce8%1%4%25%33%29% Legacy9%1%3%11%25%51% Mobile Apps12%7%19%20%24%19% Open Data14%3%8%20%29%26% Security0% 12%36%52% Shared Services7%4%7%32%24%28%

28. Data Evaluation Data Statement Strongly Disagree DisagreeNeutralAgree Strongly Agree Our data are accessible to those who need it. 0% 7%60%33% Our data are collected for a purpose. 0% 2%31%67% Our data are of the right quality/are clean. 0%2%24%57%17% Our data are standardized to support comparisons across agencies. 0%10%55%26%10% Our data are standardized to support comparisons across areas within the agency 0%7%20%56%17% Our data are “siloed”; we have pockets of individuals who protect their data. 10%30%28%23%10% Our data, reports, and processes are repeatable. 0%2%7%59%32% Reports are in the right format and show the right data to inform decisions. 0% 20%61%20% The data used for reporting and making decisions are current/reviewed periodically for accuracy. 0% 7%68%24% We eliminate data that are beyond the scheduled retention period, and no longer has value to the organization. 2%24%12%51%10% We have policies that specify rights and privileges regarding access to organizational and individual data. 0%7%5%54%34% We have sufficient capacity to store, manage, and analyze increasingly large volumes of data. 0%10% 63%18% We have the right kinds of data. 0% 20%61%20% We have the right tools or software for analytics. 0%24%27%41%7%

29. Mobility Evaluation Mobility Statement Strongly Disagree DisagreeNeutralAgree Strongly Agree Our current developers have existing knowledge of mobile development tools and programming languages.16%34%21%26%3% Our mobile strategy was developed in conjunction with IT and business leaders.11% 34%32%13% Our website has responsive design.5%18%13%44%21% There is a significant demand for a mobile application from our end users.8%34%29%21%8% There is a thorough understanding of the intended end-users' needs.5% 29%55%5% We follow a standard methodology for mobile app development (SDLC, agile, etc…).8%24%41%24%3% We have an enterprise mobile strategy and roadmap.11%32%34%18%5% We have governance structures made up of key stakeholders to guide the business, technology, and investment decisions around mobile engagement.13%16%50%16%5% We have metrics that communicate progress and success regarding mobile engagement.11%34%42%11%3% We have successfully deployed one or more mobile applications in the past.16%42%11%16% We monitor the number of mobile devices accessing our network.11%29%21%26%13% We take mobility into account in our security program.11%3%14%65%8%

30. Q&A Takeaways Focus on Cybersecurity Troublesome Accessibility Compliance Poised for Data Utility Continued Mobile Deployment Questions?

31. Process

32. IR-CAP Process Overview

33. Key Dates IR-CAP Webinar 4/25 Archer Portal Release week of 4/25 Data collection 4/25 – 6/10 IR-CAP Review 6/10 – 6/17 Plan approval/revision notification 6/20 IR-CAP Submission Deadline: Friday, June 10 th

34. Data Collection Logging in/refreshing accounts Navigating to remediation plans Required fields Changes from 2014 Delegating Submitting Tips and assistance

35. Login URL: https://egrc.archer.rsa.com/Default.aspxhttps://egrc.archer.rsa.com/Default.aspx Instance: 20224

36. Dashboard

37. Remediation Plan

38. Edit Mode

39. Q&A

40. Thank you For additional information contact: irdr@dir.texas.gov 512.463.0424 or visit our IRDR page on DIR’s website: www.dir.texas.gov