Cirrus Heroku and Contentful Service Roadmap

© 2015 Eli Lilly & CompanyCompany Confidential Heroku Enterprise Service Expansion – Transition Map Service & Support Quality & Security Architecture & Patterns MVP MVP+ Automation & Developer Experience ✓ Qualification Plan ✓ Security Plan ✓ Security Admin SOP ✓ Change Control SOP ✓ Add-On SOP ✓ Roles & Responsibilities ✓ Heroku Audit Finalization TS Projects ✓ Mercury CMS Cue Virtual Claudia ✓ Supplier Management Plan Training Materials Code Samples & Patterns Data & Integration Patterns Add-on support docs Identity & Authorization Pattern Developer Guidelines Formalize service offering and support ✓ LillyFit Update ✓ Heroku/Contentful Integration Patterns ✓ Security Code Scanning Support (Java, Node.js, HTM5, javascript) ✓ Identify Supported Buildpacks ✓ Identify Initial Add-ons Supplier Assessment for Add-ons ✓ GitHub Integration and Pipelines ✓ Private Spaces Docker Integration Identity Federation & SSO Enterprise Service Fully Operational Testing Guidance? Security Code Scanning LTG ✓ Define service offering and support Connect Lilly.com Implement Teams Update Add-on process Contentful Integration Accelerator Release Automation Support Model DNS/SSL Process

© 2015 Eli Lilly & CompanyCompany Confidential Architecture and Patterns Short Term Add-on Support Guidance Medium Term Identity and Auth Pattern Long Term - Ongoing Docker Integration Data and Integration Patterns Add-on Support Guidance Heroku service site pages for add-on configuration, security settings and governance. Identity and Auth Pattern Identify, develop and publish an accelerator for application integration with Identity Federation Service/Hub. Docker Integration Longer term (as Heroku support becomes available); develop guidance for running Docker containers natively in Heroku. Data and Integration Patterns (on-going) Identify, document and socialize patters for consistent integration to data and services from Heroku apps.

© 2015 Eli Lilly & CompanyCompany Confidential Quality and Security Short Term Implement Teams Identity Federation / SSO Medium Term Update Add- on Process Long Term - Ongoing Testing Guidance Implement Teams Heroku teams provides streamlined role management for apps and pipelines. Identity Federation / SSO Heroku Identity Federation / SSO allows integration with Lilly’s Ping or Salesforce platform as an IdP. This simplifies access provisioning and improves security. Update Add-on Process Cirrus and the Lilly Supplier Team are partnering with Heroku to develop a collaborative process by which Heroku evaluates third party add-on providers. This process must be formalized and documented. Testing Guidance Partner with Brad to incorporate any testing guidance documentation into the Heroku service.

© 2015 Eli Lilly & CompanyCompany Confidential Automation and Developer Experience Short Term Contentful Integration Accelerator Security Code Scanning Medium Term Developer Guidelines Release Automation Long Term - Ongoing Code Samples and Patterns Contentful Integration Accelerator Develop a “full stack” accelerator for Web App integration with Contentful; include config-driven Contentful access, caching, and ”helper classes” for JSON manipulation / HBS integration. Security Code Scanning Create and operationalize security code scanning process for Heroku apps. Developer Guidelines Establish Heroku developer guidelines. Release Automation Develop, build, and operationalize Heroku release automation process, integrated with MICO. MICO, approval to deploy to prod triggers slug promotion. Code Samples and Patterns Code samples, patterns, and accelerators will continue to be developed over time. Consider managing this as a service.

© 2015 Eli Lilly & CompanyCompany Confidential Service and Support Short Term Supplier Assessment for Add-ons DNS/SSL Process POC Process Medium Term Formalize Support Model Long Term - Ongoing Supplier Assessment for Add-ons Complete approval process for current add-on list. Finalize add-on support docs for each approved add-on. DNS/SSL Process Document and operationalize a process for Cirrus Operations to support custom DNS domain configuration and SSL certificates. POC Process Develop, document and socialize a process for executing Proof of Concept activities in the Heroku Eval org. Formalize Support Model Determine/develop additional Cirrus Operations capabilities to support Heroku.

© 2015 Eli Lilly & CompanyCompany Confidential Title Sponsor Projects ProjectAnticipated MVP Go-Live Lilly Trial Guide12-July-2016 Cue29-July-2016 Virtual Claudia8-August-2016 Lilly.comQ ConnectQ Current Statistics: Ideation: 2 Assessment: 12 Sprint 0: 2 Sprinting: 7 Prodution: 12

© 2015 Eli Lilly & CompanyCompany Confidential Heroku Roadmap – Short Term New Data Services Kafka Cassandra

© 2015 Eli Lilly & CompanyCompany Confidential Contentful Enterprise Service – Transition Map Service & Support Quality & Security Architecture & Patterns MVP MVP+ Automation & Developer Experience ✓ Qualification Plan ✓ Security Plan ✓ Security Admin SOP ✓ Change Control SOP ✓ Roles & Responsibilities TS Projets ✓ Mercury CMS Virtual Claudia ✓ Supplier Management Plan Code Samples & Patterns Developer Guidelines Formalize support model ✓ LillyFit Update ✓ Heroku/Contentful Integration Patterns Enterprise Service Fully Operational LTG ✓ Define service offering and support Connect Lilly.com Contentful Integration Accelerator Support Model and Service site ✓ LillyForBetter Content Promotion Service Version Control Environment Management Training Materials UI Extensions toolkit

© 2015 Eli Lilly & CompanyCompany Confidential Architecture and Patterns Short Term Contentful Integration Accelerator Medium Term Long Term - Ongoing Code Samples and Patterns Contentful Integration Accelerator Develop a “full stack” accelerator for Web App integration with Contentful; include config-driven Contentful access, caching, and ”helper classes” for JSON manipulation / HBS integration. Code Samples and Patterns (on-going) Code samples, patterns, and accelerators will continue to be developed over time. Consider managing this as a service.

© 2015 Eli Lilly & CompanyCompany Confidential Quality and Security Short Term Training Materials Medium Term Long Term - Ongoing Training Materials Create Contentful by Cirrus Service Site and populate with current training materials. Developer Guidelines Establish developer guidelines for Contentful integration with Cirrus-supported languages (Node.js and Java).

© 2015 Eli Lilly & CompanyCompany Confidential Automation and Developer Experience Short TermMedium Term Developer Guidelines UI Extensions Toolkit Long Term - Ongoing Developer Guidelines Establish developer guidelines for Contentful integration with Cirrus-supported languages (Node.js and Java). UI Extensions Toolkit Contentful has recently released a capability to extend the authoring UI with custom controls. Investigate this capability and provide guidance documentation to development teams.

© 2015 Eli Lilly & CompanyCompany Confidential Service and Support Short Term Version Control Content Promotion Service Environment Management Medium Term Formalize Support Model Long Term - Ongoing Version Control Develop and document process to version control content entries, media, and content types to Github to allow for recovery process. Content Promotion Design, and document guidance document for project teams which supports ”mediated content promotion”. Environment Management Design and document guidance document for managing environments through the development lifecycle. Formalize Support Model Determine/develop additional Cirrus Operations capabilities to support Contentful.

© 2015 Eli Lilly & CompanyCompany Confidential Contentful Roadmap Q SSO for enterprise security Dedicated infrastructure for enterprise Consolidation of notifications Wrapping up phase 1 of UI extensions, start preparing for phase 2 Improved authoring experience including entry level versioning Basic developer reports and access to logs Tool to support dev, test & prod environments Full stack getting started