April 6-9, 2009 | Rosen Shingle Creek Resort | Orlando, Florida

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida IT Infrastructure Transformation in the Commonwealth of Virginia Dave Burhop, Virginia Department of Motor Vehicles April 8, 2009

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Presentation Topics Virginia’s information technology (IT) model – The need – Structure and governance – Responsibilities IT Infrastructure Partnership Progress in core services – Governance – IT procurement – IT infrastructure operations Lessons learned

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Call to Action: State of Technology in independent, autonomous IT shops Independent, duplicative systems $75M in failed IT projects in 5 years Inadequate protection of sensitive information and equipment Inability to leverage buying power or manage investments Obstacles to sharing information across agencies Few metrics on performance and service delivery

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida The Numbers Revealed The Need 90+ Independent, Autonomous IT Shops Responsible for: 67,000 PCs 3,000 servers 100 primarily independent data centers 85 Internet connections 61 helpdesks 45 individual Wide Area Networks 40 different /messaging systems 18 different telephony systems

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Governor and General Assembly Took Action in 2003 Created VITA, Virginia ’ s centralized IT “ utility ” – Abolished three IT agencies – Transferred IT assets and staff from 90+ agencies to VITA over 18 months Defined VITA ’ s primary responsibilities – IT governance – IT procurement – IT infrastructure operations Established funding mechanism – Internal Service Fund - budget is largely fees collected – Rates approved by Joint Legislative Audit & Review Commission (JLARC)

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Governor and General Assembly Took Action in 2003 Created Information Technology Investment Board (ITIB) – 10-member supervisory board – 3 government members – 7 citizen members: 4 appointed by legislature, 3 by Governor – Responsible for VITA and all IT oversight and investments Chief Information Officer (CIO) – Hired by ITIB to a 5-year contract – ITIB ’ s agent as VITA Agency Head – Advise Governor and legislature of investment opportunities

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Technology Management Governance Structure General Assembly Appoint Board members Pass legislation including budget Appointed JLARC oversight of VITA For more details see the Code of Virginia – 2032 and IT Investment Board (ITIB) Approve funding priorities Approve project development Approve policies, standards, guidelines Approve Virginia’s IT Strategic Plan Chief Information Officer Develop VA IT Strategic Plan Approve Agency IT strategic plans Approve project planning Develop policies, standards, & guidelines (for ITIB) Manage & support infrastructure Procure IT goods & services Support CIO and ITIB Chief Security Officer Chief Applications Officer Governor Set Executive branch priorities Appoint Board members Develop budget Executive Branch Agencies Develop Agency IT Strategic Plan Adhere to Policies, Standards & Guidelines Manage Agency Applications and Staff

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida IT Infrastructure Partnership

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida State of the IT Infrastructure (Pre-VITA) Aging, inefficient infrastructure – 1980s technology environment – 50% of equipment 8 to 10 years old The Commonwealth at risk – No maintenance on thousands of devices – 80% of agencies vulnerable to data breaches, hacking – Virginia’s data center building rated a high security risk – Inadequate ability to resume operations after a disaster – Copyright software license violations (legal liability)

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Solution: Build a 21st Century Infrastructure Nation’s largest public-private partnership – Commonwealth of Virginia and Northrop Grumman Corporation formed partnership in November 2005 – Contract valued at $1.9 billion over 10 years Northrop Grumman invests $270 million in up-front capital – Replace aging, inefficient infrastructure in agencies – Modernize and standardize IT services and support – Consolidate and centralize infrastructure equipment and monitoring Investment in people and communities – Creates more than 400 jobs in rural southwest Virginia – No layoffs of state IT employees – Northrop Grumman is positioned to grow in Virginia

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Infrastructure Investments Through Private Partners Messaging Services People – Process – Tools Reliable, High-Performance, Enterprise-Wide IT Infrastructure $270 Million Investment Enterprise Exchange/Outlook Enterprise Collaboration Tools Active Directory, DNS $25M Investment Mainframe and Servers New IBM and Unisys Mainframes Consolidation and Refresh of Servers Migration of servers to the Data Center $50M Investment Tier 3 and Tier 2 Facilities New Data Center/Office Building in Chesterfield New Disaster Recovery Center and Help Desk in Lebanon, Russell County $60M Investment Desktop Mass Desktop Refresh Network Printer Consolidation and Refresh Enterprise Desktop Management Systems $35M Investment Network New Commonwealth-Wide MPLS Core WAN LAN upgrades to Local Switches/Routers as Needed Network Re-addressing of IP, DHCP $60M Investment Help Desk Enterprise Help Desk in Russell and Chesterfield Field Based Agents and Technicians for Level 3 Enterprise Help Desk System (Peregrine) $10M Investment Security Enterprise Security Operations Center Computer Security Incident Response Center Secure Internet Gateway $10M Investment Voice / Video Voice-Over IP Network Optimized for Voice and Video Traffic $20M Investment

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Progress in Core Services

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida IT Infrastructure Accomplishments Significantly improved information security Corrected software copyright licensing violations Constructed two data center facilities (Chesterfield & Russell) Began creating over 400 high-tech jobs in southwest Virginia Replaced much of the infrastructure with new, standard equipment Implementing standard, consistent processes and metrics statewide Establishing predictable, consistent prices that are planned for and budgeted

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Commonwealth Enterprise Solutions Center Chesterfield County

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Southwest Enterprise Solutions Center Town of Lebanon, Russell County

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Enterprise IT Governance Accomplishments From 2002: Lack of oversight Independent, autonomous decision-making $565 million spent on duplicative, stand-alone systems $75 million in failed major IT projects from To 2009: Strong investment management program for new IT projects Strategic IT investment decisions promoting enterprise solutions No major IT project failures since 2003

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Centralized IT Procurement Accomplishments From 2002: Buying power not leveraged Lack of standards Multiple, inconsistent procurement processes Low spend with small, women- and minority- owned (SWaM) companies To 2009: Leveraged buying power Decreased costs Increased annual SWaM spend from $4M to $80M

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida IT Reform in Virginia Results in Efficiencies Had we done nothing, Virginia would have… Experienced additional failures of major IT projects Spent $200 million more over the next decade supporting an aging IT infrastructure Spent an additional $120 million on energy consumption over the next decade Paid $45 million more for IT products and services without central IT procurement management

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Lessons Learned

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Hard Lessons We Learned the Easier Way Executive sponsorship is essential Talk to others about what worked, what didn’t and why IT reform is about culture change Build and maintain momentum, confidence Manage stakeholder expectations Technology People & Process

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Hard Lessons We Learned the Hard Way Get your arms around what you’ve REALLY got in your IT environment – Be data-driven – Conducted five “due diligence” exercises “Legasaurs” – ancient equipment Years of underfunded IT programs Poor inventory records and processes Lack of basic security protection 1,200+ employees organized by agency, supporting more than 2,000 sites Sorely under-utilized capacity for servers, printers Transformation takes longer than you think – Virginia’s schedule is aggressive (36 months) – Must accommodate agency business cycles (don’t transform Tax in April)

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Hard Lessons We Learned the Hard Way Look behind the curtain Back-end processes and procedures (the “how”) must transform with technology services (the “what”) Asset inventory Service requests Pricing & billing Customer relationship management Communications IT support Documentation Purchasing New service offerings Change management Personnel management

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Hard Lessons We Learned the Hard Way All stakeholders – especially employees – need to feel they are being treated equally and kept informed – Focus on the 90 – 95 percent who are “with” the program or can be swayed either way – Do not cater to the 5 – 10 percent you can never win over If outsourcing, understand the governance model and the relationship with your partner – Traditional client-vendor relationship? A risk/reward-sharing partnership? Something in between? – State policies do not contemplate an outsourcing arrangement

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Hard Lessons We Learned the Hard Way Ensure agencies coordinate with state budget department on rates (cost impact, timing, etc.) BEFORE they are implemented Ensure agencies understand “what’s in the rates” Implement all aspects of disaster recovery as part of the base modernization rate package – don’t make DR optional Agency level SLAs should be identified early on so the “to-be” model can be designed to support them Streamline early on the process that supports agency service requests Centralized print close to the customer agencies is a necessity Delegated Procurement Authority to agencies should be considered on a case-by-case basis Delegated Project Authority to agencies should be considered on a case-by-case basis

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Hard lessons we learned the hard way Embrace the media – Informed reporting vs. investigative reporting Start with the big agencies – The largest 15 agencies in Virginia represent ~80% of the spend What’s that noise? – It is not a celebration….(yet) – “There” is good; getting “There” is painful – The noise level overall has not decreased, but We will eventually get There!

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Recent recognition Virginia’s security program rated #1 in the nation in 2008 by National Association of State CIOs (NASCIO) Virginia’s infrastructure partnership rated #1 in the nation by NASCIO Virginia’s Web site ranked #1 in the nation by the Center for Digital Government Virginia received a 2008 Telly Award for its security awareness video “The Duhs of Security” Virginia ranked #3 in the nation for all aspects of technology by the Center for Digital Government

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida References/Resources

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Links/References VITA (Many thanks to VITA for providing much of the information used in this presentation!) Virginia Information Technology Investment Board Virginia’s official portal The Code of Virginia – IT governance The Code of Virginia – PPEA (partnership vehicle) bin/legp504.exe?000+cod+TOC Technology oversight

April 6-9, 2009 Rosen Shingle Creek Resort Orlando, Florida Links/References IT Infrastructure Partnership homepage How we got here – proposals, history Comprehensive infrastructure agreement – the contract Frequently asked questions Media kit and fact sheets IT infrastructure transformation, schedule 371