Lessons from Y2K for Strategic Management of IT Mark P. Haselkorn Professor and Founding Chair Department of Technical Communication University of Washington Prepared for World Congress of the International Society for the Systems Sciences Toronto, Canada July 21, 2000

“Managing Vulnerabilities Arising from Global Infrastructure Interdependencies: Learning from Y2K” A National Research Council Project Conducted for the Department of Defense With the support of IEEE and the University of Washington Final Report anticipated October 2000

Overview How Y2K changed How the problem changed Initial Observations Managing IT Complexity Aligning IT with the Organization Minimizing Risk Future Issues

How Y2K Changed Software to Chips Fix to Continuity Technology to Mission Technology to Political and Legal

How the Problem Changed From a study of fundamental flaws and cascading effects to a test of the overall strategic management of information and communication technology. For example, maintenance and modernization life cycle management of systems and software functional interdependency and continuity guidance policies and certification system ownership and responsibility training and organizational roles security and information assurance

Observations Managing IT Complexity Difficulty from pervasiveness of IT Difficulty from dynamic nature of IT Difficulty addressing system of systems Difficulty in stratifying specific responses

Observations Aligning IT with the Organization Unclear ownership, responsibility, and guidance Special groups and cross-functional matrixing Return to business as usual Central standards and guidance versus local flexibility and execution Higher levels of oversight and certification Version control/configuration management issues Funding issues Training and job position issues

Observations Minimizing Risk Things fail all the time Lower tolerance for risk Considerable redundancy Growing reliance Unclear role of ORM Importance of continuity plans Aligning security and information flow needs

Future Issues Clearer understanding of why Y2K was different Appropriateness of response Clarifying system robustness Hidden impacts Applications to information assurance and security Recommendations for improving strategic management of IT