2. ECAR, Benchmarking, and More Susan Grajek, Ph. D
ECAR, Benchmarking, and More Susan Grajek, Ph.D. Vice President, EDUCAUSE ECAR Working Groups Meeting October 15,

3. EDUCAUSE Center for Analysis and Research (ECAR)
Established in 2001 to provide research-based evidence to support effective decision making in higher education. Nearly 500 colleges and universities subscribe to ECAR.
ECAR - Established in 2001 to provide research-based evidence to support effective decision making in higher education.
Nearly 500 colleges and universities subscribe to ECAR.
CDS - ~825 respondents in 2011

4. EDUCAUSE Research and Staff
Susan Grajek,
Vice President,
Data, Research, and Analytics
Eden Dahlstrom, Director of Research
Jacqueline Bichsel, Senior Research Analyst
Pam Arroway,
Senior Statistician
Leah Lang,
Senior IT Metrics and Benchmarking Analyst
Joanna Grama, Portfolio Manager,
Director of Cybersecurity and GRC Programs
Karen Wetzel
Program Manager
Susan Nesbitt, Administrative Associate
Mike Roedema, Statistician
Ron Yanosky,
Senior Research Fellow
Valerie Vogel
Program Manager
TBN,
Data Visualization Specialist
TBN,
Director of Administrative IT Programs

5. Three primary research and benchmarking venues
Core Data Service
ECAR
Essentially three main product lines: Core Data Service, Research Studies, and Research Bulletins
The EDUCAUSE Core Data Service has been providing comparative data on IT in higher education since 2002, thanks to the dedicated contributions of over 750 institutions annually. Recently, the service underwent a substantial redesign to provide new interfaces for data entry and reporting, and new and expanded content. 
We’re always working to improve CDS.  Changes you can expect to see in 2013 include a new data collection timeline from June to September.  This timeline will ensure that we’re collecting the most recent financial data.  We’re also working to align all CDS content under three key pillars: IT Financials, Staffing and Services. 
Research Studies: The major ECAR publications are substantive examinations of issues of strategic importance to higher education.
7 Research Studies in 2012:
Student Mobile Computing Practices, Lessons from Qatar (May 2012)
2011 Enterprise Application Market (June 2012)
2012 ECAR Study of Analytics in Higher Education: Benefits, Barriers, Progress, and Recommendations (June 2012)
Information Technology Services in Community Colleges: Strengths, Opportunities, and Challenges (July 2012)
Measuring User Satisfaction: Why It's Important and How to Do It (August 2012)
2012 ECAR Study of Undergraduate Students and Information Technology (September 2012)
Research Computing: The Enabling Role of Information Technology (November 2, 2012)
Research bulletins are focused research on specific IT issues that may be authored by ECAR members or ECAR researchers. The special CDS Spotlight Series analyzes content from CDS not reported in the CDS Annual Summary Report.
In 2012, ECAR published 17 RBS and CDS Spotlights. These publications are produced roughly every three weeks. Two of our most recent RBs were “Classroom Technology” (December 2012), which looked at Core Data Service survey results related to classroom technology; and “Five Guidelines for Instituting IT Value Measurement” (November 2013), which outlines five recommendations to help advise IT leaders and others when implementing their own IT value measurement initiatives
In 2012, ECAR higher education subscribers (institutions only) received selected research services from Gartner, Inc., at no additional charge due to a joint agreement between EDUCAUSE and Gartner. In 2012 these services included Quarterly IT1 research reports, chosen by ECAR staff as the most relevant or timely for the higher education IT community. The agreement has been extended for 2013.
2012 Research Bulletin List (if needed)
Funding-Model Archetypes for Central Information Technology Functions (January 2012)
Open Wikis and the Protection of Institutional Welfare (February 2012)
Student Perceptions of Course Management System Tools: Implications for Evaluation and Adoption of Online Tools in Higher Education (February 2012)
CDS Spotlight: If I Had a Million Dollars (March 2012)
Analytics in Support of Student Retention and Success (April 2012)
The Future of Mobile Learning (May 2012)
A Dozen Gurus Describe IT Collaborations That Work (May 2012)
Identifying E-Portfolio Practices at AAU Universities (June 2012)
Networking, Telephony, and USF Patterns in Higher Education: A Sample Snapshot, (July 2012)
CDS Spotlight: Information Systems Risk Assessment (July 2012)
Game-Based Learning: Developing an Institutional Strategy (August 2012)
Through a Glass, Brightly: IT’s Impact on Higher Education by 2020 (August 2012)
Student Preferences for Mobile App Usage (September 2012)
Women CIOs in Higher Education (October 2012)
IT Infrastructure to Support Analytics: Laying the Groundwork for Institutional Analytics (October 2012)
Five Guidelines for Instituting IT Value Measurement (November 2012)
CDS Spotlight: Classroom Technology (December 2012)
IT Issues

6. ECAR 2013 Research 42 publications
8 original studies
E-learning
Students and technology
Workforce
BYOE
ERP costs
Measuring IT costs
Mobile IT
E-Textbooks
Collaborations with Gartner, CHECS, CUPA-HR
Research bulletins and case studies

7. Core data service Multiple infrastructure improvements
Reporting interface
Survey tool
Benchmarking professional development and support
Content
More data on more enterprise systems
New strategic measures
Alignment among costs, services, and staffing

8. A look ahead to 2014 Planned research GRC (with NACUA)
Student and faculty studies
Cloud (probably)
Expansion of Top 10 IT Issues
Major program focuses on
GRC
Administrative IT
Grant from Lumina Foundation
MIDAS
SITAR
Higher education research briefs

9. GRC program Vision of Success
The overall goal of the EDUCAUSE IT GRC program will be to position the program as the “go to” and most reliable, relevant, and respected resource for higher education IT leaders seeking more information about IT governance, risk, and compliance issues.
We are seeing more and more that governance, risk, and compliance issues pervade the information technology (IT) space; and we are seeing these concepts transcend information technology silos such as central and distributed IT units, information security, and service management. As institutional investment in information technology and reliance on information systems have grown, so has the need for reliable structures and measures to ensure success and minimize failure. Information technology governance, risk, and compliance (GRC) programs intend to do just that: They develop a framework for the leadership, organization, and operation of the institution's IT programs to ensure that those programs support and enable the institution's strategic objectives.
EDUCAUSE has identified “launching an IT GRC program and services” as a 2014 priority goal. Over the years, a number of independent activities within EDUCAUSE have addressed IT GRC topics. This proposal suggests that EDUCAUSE build on its already successful activities to establish its new program. As the IT GRC area is quite large, this proposal suggests that EDUCAUSE focus on IT GRC activities in the following order, which correlate to needs our members have identified:
IT risk management
IT governance
IT compliance
This proposal also suggests that EDUCAUSE build its IT GRC program on the things that EDUCAUSE does best:
Soliciting advice from member subject matter experts to guide the program
Facilitating working groups of interested members to contribute to the relevant literature
Bringing members together to share their experiences and network
Informing thought leadership by providing actionable data and research analysis
Partnering with other organizations for the benefit of our members
“GRC” can also refer to enterprise governance, risk, and compliance programs. The scope of this document is specifically limited to information technology governance, risk, and compliance programs only. In this document, the use of the terms IT GRC, or simply GRC, refer to such programs.
Governance
At its core, a governance program ensures that all institutional resources and activities are aligned with the institution's business goals. For higher education information technology programs, IT governance means ensuring that the campus IT strategy is aligned with a college or university’s strategic plan.
Risk
Enterprise IT risk management helps an organization identify the risks that it faces with regard to its information technology resources and systems and affirmatively address those risks in a way that satisfies its organizational goals. Enterprise IT risk management programs move beyond information security risks and look at the strategic, operational, financial, legal, and reputational risks inherent in operating information technology systems.
Compliance
An enterprise compliance program is generally defined as a formal program that specifies the organizational activities that are designed to help prevent and detect violations of applicable laws and regulations. For higher education information technology programs, IT compliance means ensuring that a program exists to ensure that the institution’s information technology resources and systems are operated in a way that meets those laws and regulations that impact those systems and also complies with institutional policy.

10. Potential GRC deliverables through 2014
2013 Q4
2014 Q1
2014 Q2
2014 Q3
2014 Q4
November/December EDUCAUSE Review focused on GRC topics
ECAR survey on GRC topics
GRC article in quarterly edition of EDUCAUSE Policy newsletter
EDUCAUSE library GRC products marketed to members
GRC program advisory group established
Publication of IT Governance “Role Models” research
Release of 2014 ECAR study on GRC
Create GRC discussion group listserv
GRC web presence announced
GRC program advisory group whitepaper that further defines IT governance, risk, and compliance needs and presents a list of questions that higher education leaders must ask about IT GRC efforts.
IT risk management working group whitepaper on list of strategic, operational, financial, legal, and reputational risks inherent in operating information technology systems
IT governance working group whitepaper on common elements of effective IT governance programs
GRC article in quarterly edition of EDUCAUSE Policy newsletter
IT GRC program advisory group and working groups meet at E14 to discuss GRC issues and network
Publish IT governance maturity index (and consider marketing opportunities such as an E-Live! Presentation, perhaps in conjunction with reviewing results from the ECAR GRC study)
GRC activities at E14
Possible ECAR research bulletin focusing on IT governance case studies (either 2nd or 3rd quarter)
Publish summary of E14 GRC activities
Publish IT risk management interactive template (and consider marketing opportunities such as an E-Live! Presentation)
Release IT GRC strategic directions plan for 2015
Member-Facing Deliverables
4th Quarter 2013: Planning activities and activities that set the stage for 2014.
Publication of November/December EDUCAUSE Review focused on GRC topics.
ECAR survey on GRC topics.
GRC article in quarterly edition of EDUCAUSE Policy newsletter
EDUCAUSE library GRC products marketed to members
1st Quarter 2014: Additional planning activities as well as quick-win projects to demonstrate forward momentum in the GRC program.
GRC program advisory group established
Release of 2014 ECAR study on GRC
Publication of IT Governance “Role Models” research
Create GRC discussion group listserv
GRC web presence announced
2nd Quarter 2014: Begin substantive efforts to contribute to the body of knowledge on IT GRC in higher education.
GRC program advisory group whitepaper that further defines IT governance, risk, and compliance needs and presents a list of questions that higher education leaders must ask about IT GRC efforts. (Output from 1st and 2nd Quarter 2014 discussions)
IT governance working group whitepaper on common elements of effective IT governance programs
IT risk management working group whitepaper on list of strategic, operational, financial, legal, and reputational risks inherent in operating information technology systems
Possible ECAR research bulletin focusing on IT governance case studies (possibly a 3rd Quarter 2014 activity)
3rd Quarter 2014: Continue substantive efforts to contribute to the body of knowledge on IT GRC in higher education. In addition, the 2014 EDUCAUSE Annual Conference at the end of September will be used for the IT GRC program advisory group and working groups to meet in person to discuss GRC issues and network.
Publish IT governance maturity index (and consider advertising opportunities such as an E-Live! Presentation, perhaps in conjunction with reviewing results from the ECAR GRC study)
Possible ECAR research bulletin focusing on IT governance case studies (if not published in 2nd Quarter 2014)
GRC activities at E14
4th Quarter 2014
During the fourth quarter of 2014, the GRC program will review its activities completed to date for 2014, assess the success/failure of those activities against the products and services noted as needed in this document, and plan for 2015 activities.
Publish write up of E14 GRC activities
Publish IT risk management interactive template (and consider advertising opportunities such as an E-Live! Presentation)
Release IT GRC strategic directions plan for 2015

11. Administrative IT program
Still being defined
Themes so far
Costs of administrative IT systems…and processes
Analytics as a strategic differentiator
Hiring a practice leader

12. Lumina Foundation grant

13. A Higher Ed IT Research and Benchmarking Framework
IT Service Management, Policy, Governance, and Strategy
Deployment, service management, and governance toolkits, standards, standard processes (create and connect to and adapt existing materials)
Emergent Areas
Practices, Solutions, Technologies, Applications 
Frameworks
Landscapes
Models
Building HE markets
IT Domain Areas
Teaching and Learning
Informa- tion Security
IT Support
ERP
Research
Network, Voice and Data
Data Center Services
Web
Product- ivity Apps , Calendar, etc.)
Staffing
Finances
Deployment indices
Maturity Indices
Standards
Core Technologies and Applications (several within each domain)
Detailed tracking in CDS (solution, costs, quality, contextual info, plans to change)
Annual market analysis reports
Solution-specific SIGs
Customer panel wishlists
Adjunct Technologies and Applications (many within each domain)
High-level tracking in CDS or via recurring brief surveys
Simple almanac-type reports

14. MIDAS: Maturity indices
Examines multiple dimensions of progress, not just technical
Enables institutions to determine where they are…and where they aspire to be
Both expert- and data- driven
Research computing
Analytics

15. MIDAS: Deployment indices
Stages of deployment for specific technologies and services
Aggregate to track progress in a domain
Example: MOOCs

16. What are your aspirations for us?
Working groups
Research
GRC
Administrative IT
Etc.