The year 2020 has presented significant challenges to businesses worldwide. Leaders in those businesses have had their lives turned upside down personally and professionally. Business plans have been blown apart. In some cases, the fundamental assumptions about products, customer’s supply chains and staff have been thrown into question. Enterprise architects, or EA’s charged with defining the technical strategies that have been supporting and transforming businesses find themselves in new and unfamiliar environments. Major paradigm shifts have taken place and EA’s are now responsible for rationalizing the technical architecture for a new environment.  

Disruption is unsettling but the same disruption contains opportunities as the landscape changes and customers, employees, and suppliers have new needs, expectations, and constraints. One constant in the pre and post pandemic environment that technology architects will recognize is Technical Debt. Experienced architects know their biggest challenge is not necessarily in deploying new applications, new platforms, or capabilities but managing investment in technology, balancing that investment with other business priorities. Striking that balance means recognizing and managing technical debt. The pandemic crisis presents EAs with new priorities and opportunities for managing that Technical Debt.  

I recently published “Tech Debt 2.0® How to Future Proof Your Small Business and Improve Your Tech Bottom Line”. The timely release of that book is crucial to small and medium businesses. However, reaction from readers has shown that the book’s concepts and recommendations, especially now, are equally valuable to CIOs and technology architects in larger enterprises. 

Let’s step back though and examine the concept of Tech Debt. Initially technical debt was defined as defective code released to rush a product to market. Today with technology permeating nearly every aspect of a business and in light of the realities of the new environment, it’s important to expand the definition of tech debt – Tech Debt 2.0 is any liability incurred in the development, acquisition, use and retirement of technology – i.e. hardware and software systems, or the skills set needed to support them. EAs must reevaluate the role of technology in their enterprise. This means reprioritizing investments in legacy systems, infrastructure and skill sets, be ready to abandon obsolete, dysfunctional systems, processes and methodologies.  

Architects must assess the changed needs of the business, – customers, staff, supply chain and identify efficient technology to support those new requirements. 

There is opportunity to walk away from legacy technology containing Unplanned Tech Debt that has never been corrected, the result of poor practices or poorly communicated requirements.  

The move to remote workspace may present the option to discontinue the use of equipment or applications that have become instances of Creeping Tech Debt where features become obsolete, replaced by the better, faster more capable upgrades. Or, the applications and operating systems are no longer supported, causing security vulnerabilities. 

Changes in market dynamics as the customer base struggles to understand their new needs, constraints and opportunities invite architects and product developers to consider incurring Intentional Tech Debt. By releasing prototypes and minimal viable products (MVPs) customers become partners in product development, helping to build the plane even as it reaches cruising altitude. Architects know this will entail false starts as perceived requirements morph or fade away and require rework as the product matures. But the approach may buy competitive advantage as all players scramble to find their way in the new market space.  

Internally the pandemic disruption will raise the threat of Tech Debt in the form of shadow IT, as frustrated, impatient functional area leaders are tempted to deploy their own solutions outside the guidelines required by a coherent architecture.  Hmmm, let’s see will it be Zoom, or Skype, or Aircall, Slack, Microsoft Teams, GoToMeeting, Hopin and on and on. Unapproved, unmanaged tools can have cybersecurity issues or fracture data integrity by creating multiple versions of the truth. 

This far into the Covid-19 crisis we have seen the very real existential threat as businesses in more vulnerable industry sectors are forced to permanently close. 

As this continues there will be increased activity in mergers and acquisitions. Enterprise architects have an important role to play on both sides of an M&A transaction. Both involve the aggressive management of Tech Debt.  

To maximize the benefit of selling a business or merging with another organization a company must recognize and eliminate excessive Tech Debt. Unsupported, dysfunctional legacy technology can represent major liability to a potential buyer or merger partner. Such a liability could significantly affect the value of the transaction. An EA needs to foresee and mitigate this by communicating effectively with stakeholders the consequences of Tech Debt. 

The EA with the acquiring company is responsible for effective due diligence that uncovers instances of Tech Debt. These include, not just some of the obvious liabilities mentioned so far but also unsuspected instances such as software license stipulations where, for example, the sheer number of employees in a new organization can vastly increase the software maintenance costs even if the number of actual users doesn’t increase. Tech Debt can not only alter the price of a transaction but create an unsurmountable deal breaker. 

Managing Tech Debt is an important part of an organization’s response to the pandemic crisis. Enterprise architects and leaders charged with IT governance have the opportunity and actions they can take on offense and defense to manage Tech Debt to protect their business. 

 Top 10 Plays for EAs managing Tech Debt:

• Stay healthy, your family and business need you. 
• Do a health check of your project portfolio and reprioritize any Tech Debt backlog. 
• Refocus IT governance to accelerate decision making and maintain goal alignment with the organization 
• Develop an “acute” action plan with intent and purpose for the next 30,60, 90 and 180 days and execute flawlessly. 
• Prioritize actions that focus on revenue preservation and customer experience. 
• Diagnose your Tech Debt and plan to address root causes. 
• Conduct a business impact analysis to prioritize your cyber risks. 
• Review and revise essential “pandemic” security policies and practices. 
• Engage your internal team and external partners to best utilize their resources and identify cost saving opportunities. 
• Protect core operations and monitor critical infrastructure services for internal users. 

Michael C. Fillios is the Founder and CEO of IT Ally, LLC., a leading IT and Cyber Advisory firm for small and mid-size businesses. He is a four-time CIO, entrepreneur and senior global business and technology executive with over 25 years of experience in transformation, change leadership and operations management in the Pharmaceutical, Industrials, Automotive, Banking and Consulting Industries. His first book, Tech Debt 2.0®: How to Future Proof Your Small Business and Improve Your Tech Bottom Line, was published by the IT Ally Institute in April, 2020. 

In 2020, he formed the IT Ally Institute, a non-profit organization that provides research, best practices, thought leadership and peer to peer programs specifically developed for small and mid-sized businesses. To learn more about the IT Ally Institute and register for our latest research, thought leadership and peer to peer round tables, please visit www.Itallyinstitute.org. 

[This article was originally published on architectureandgovernance.com.]

The virus pandemic of 2020 is severely disrupting the economy and the large and small businesses that drive it. Poor practices such as ignoring safe distancing, insufficient sanitation, and not mandating mask-wearing open the door to infection of customers and staff and threaten the viability of a business.

Similarly, poor practices that allow a business to incur technical debt open the door to cybersecurity exploits that can bankrupt a business financially or through loss of trust and reputation in the eyes of its customers. Leaders of small and medium size businesses (SMBs) often think their size lets them operate under the radar, as less attractive targets to bad guys. But, actually, their lack of robust security strategy and resources make them easier to penetrate. And, sadly, the National Cyber Security Alliance (NCSA) reports that 60 percent of small companies are unable to sustain their business more than six months following a cyberattack.

Years of experience working and advising businesses domestically and internationally has shown that business leaders find it difficult to recognize tech debt and how it exposes cyber vulnerability. As technology has evolved over time from main frame to client server to the Internet and now the cloud, the impact of a new Tech Debt 2.0® has grown stealthier and more sinister. This is especially true for SMBs that lack the resources to apply to cybersecurity. CEOs and CFOs managing technology may not recognize tech debt building up in their SMBs—because it is not revealed in monthly variance reports or other accounting controls. Someone in their organization, without explicit or implicit authority or oversight, may be making decisions adding to the Tech Debt 2.0 load and increasing exposure to cyberattacks. Let’s look at how that might happen and how to prevent it.

Old and Obsolete Infrastructure:

Azeotrope, an aerospace firm in the Southeast, realized they were compromised when a number of clients complained of receiving invoices from Azeotrope that contained confidential information about their client’s orders and projects. Months of investigation by a cyber consulting firm finally determined the source of the vulnerability to Azotrope’s network: a combination printer/fax machine in their testing and QA area that engineers regularly used to fax lunch orders to a local Chinese restaurant. Because the device was connected to the company’s network for printing purposes, it provided network access using out-of-date insecure facsimile protocols. This gave the bad actors access to the company’s customer accounts and valuable data.

“Fax is an ancient technology; the protocols we use today haven’t been changed for the past 30 years,” notes Yaniv Balmas of Check Point Software, a leading provider of cyber threat intelligence. “Fax data is sent with no cryptographic protections; anyone who can tap a phone line can instantly intercept all data transmitted across it. Fax is always sent unauthenticated. There are absolutely no protections over fax.” Balmas advises: “If you can’t stop using fax, segregate the printers, put them on a separate network.”

The Tech-away: Identify and remove obsolete components from your network. Not just equipment with obvious vulnerabilities like fax, but all equipment no longer supported and updated by the manufacturer for cybersecurity risk.

A Stitch in Time . . .

Patches are often created after a software or hardware company has experienced a data breach or recognized a vulnerability that might allow one. The patch is issued to ensure other businesses’ data remains safe. Applying a patch as quickly as possible lessens the risk of your business becoming affected. But it is each business’s responsibility to know a patch has been issued and to apply it promptly. That is patch management—a relatively straightforward process, 10 or 20 years ago. Today, however, the vast proliferation of software and hardware components in our business environment have made patch management a complex, time- and resource- consuming necessity, critical to the cybersecurity of a business’s network. Failure to effectively manage patching is a main cause of accumulating excessive Tech Debt 2.0 and security penetration.

NETGEAR, a highly respected manufacturer of network equipment in data centers, offices, and the homes of hundreds of thousands of people working from home now, and, possibly, far into the future, recently sent an email alert to its customers. An excerpt is below. How would your CFO or CIO handle this?

Hello.

We have become aware of vulnerabilities involving certain NETGEAR products and have issued a security advisory.

We have released hotfixes addressing some of the vulnerabilities for certain impacted models and continue to work on hotfixes for the remaining vulnerabilities and models, which we will release on a rolling basis as they become available. We strongly recommend that you download the latest firmware containing the hotfixes as instructed in the security advisory. We plan to release firmware updates that fix all vulnerabilities for all affected products that are within the security support period.

Until a hotfix or firmware fix is available for your product, we strongly recommend turning off Remote Management in your product. Please follow the steps below to turn off Remote Management immediately. . .

The Tech-away: Take steps to reduce the burden and complexity of patch management. Adopt software and hardware that automatically detect and apply patches. Look for opportunities to shed responsibility for patch management through outsourcing cybersecurity responsibility or utilizing cloud services that provide monitoring and patch management services. Tech Debt accrued through failure to manage patching effectively can fatally compromise your network and business.

People, Policies and Processes

Of greater consequence than obsolescence and patch management to Tech Debt 2.0 and cybersecurity are the people, policies, and processes that make up the culture and collective mindset of a business organization. Properly patched, up-to-date infrastructure is not going to stand in the way of the accounts payable clerk or chief marketing officer who clicks on the attachment to an email from some bad actor posing as a trusted vendor or prospective customer. Equally dangerous is the computer operator who props open the data center door to make it easier to allow the guy who says he’s the A/C maintenance engineer get in and out. Or the CEO who shares her password with her husband and children so they can access her mail and messaging accounts.

Establishing a data security mindset from the bottom to the very top of an organization is a basic essential to safeguarding a business from cyberattacks. Policies and processes must instill in all the company’s people an always-on awareness of their responsibility to protect the physical and digital assets of the enterprise. That mindset needs to be reinforced frequently and backed up by actions that demonstrate commitment and consequence behind company policies and processes.

The Tech-away: Formulate and clearly communicate policies and processes governing any actions that involve cybersecurity. Visibly demonstrate across the organization the commitment to security.

Make cybersecurity awareness a visible priority for every person in the organization.

[This article was originally published on strategydriven.com.]

Years of experience working in finance and technology at large, mid-sized, and small businesses have taught me that business leaders face real challenges managing the technology their company needs to operate effectively and stay competitive. This is especially the case for small and mid-sized businesses (SMBs), which typically do not have the resources available to large enterprises. The challenge has grown significantly in recent years as businesses have adopted technologies to meet the expectations of their customers and to compete for advantage in the digital world.

The challenge is not necessarily in deploying new applications or platforms but in managing investment in technology and balancing that investment with other business priorities. Striking that balance means recognizing and managing technical debt.

Technical debt is similar to the financial debt a business can incur through salary and benefit commitments, plant and equipment payments, and loans. But there are critical differences. Unlike financial debt, technical debt is not paid to outsiders: It is debt a business owes internally that needs to be paid with internal resources such as time, diverted funding, market opportunity, and competitive standing. Also, unlike financial debt, technical debt is not clearly identified by the reporting built into a business’ financial and accounting practices. Unless it is routinely monitored and measured, it can accumulate unchecked and become a destructive threat to the future of a business.

Initially, technical debt was defined as defective code released to rush a product to market. Today with the widespread adoption of technology, the expanded definition of tech debt, or Tech Debt 2.0®, includes any liability incurred in the development, acquisition, use, and retirement of technology, from hardware and software systems to the skillsets needed to support them. Just like the evolution of technology over the past several decades has occurred from mainframe to client server to the internet and now the cloud, Tech Debt 2.0 has steadily grown smarter, stealthier, and more sinister.

Tech Debt 2.0 can be broken down into three main types:

Unplanned Tech Debt is unintentional. It typically stems from flawed practices, such as insufficiently trained code developers using overly complicated, undocumented, and unsupervised coding techniques. Poor communication between parties in preparation of requirement specifications and unforeseen changes to product requirements can also be factors. Unplanned tech debt often occurs in the beginning stages of a project and, if recognized, can be corrected without overhauling or scrubbing a project.

Creeping Tech Debt is sneaky. It may initially be non-existent in a new application or piece of hardware infrastructure. Over time though, obsolescence takes its toll. Changes to the needs or size of the user base reveal weakness in the design. Performance issues begin to increase. Increased incidents of downtime and time spent on maintenance drain the productivity and morale of technicians and engineers. At the same time, CTOS and CIOs face an uphill battle convincing the C-Suite to invest in replacing an infrastructure that has worked in the past and continues to work, if not optimally.

The way to combat creeping tech debt is to highlight the creep and its costs. Track time spent on staff performing rework, doing maintenance, and fixing the same issues over and over again. Track the time this work takes away from progress on new projects and product development. Measure the number and duration of failures. Communicate the effect of these incidents on customers to departments throughout the business. Correlate rework time and downtime to staff turnover and productivity measures. Benchmark technology performance and investment against industry best practices. Periodically review application and equipment portfolios. Know and communicate the life cycle status of the business’ technology. Include phone systems, physical plant and electrical components.

Intentional Tech Debt has the potential to be good for a business — if approached with balance. There is a constant tug of war and tension between marketing and technical development. Marketing product managers want to move product to customers as quickly as possible. That is key to capturing market share and gaining competitive advantage. Technology developers want all the time and information necessary to design, build, and test products of the highest quality with all the performance characteristics and capabilities a customer could envision. Give developers their way and the “perfect” product might well be late to market and just one of a number of similar products among leading competitors. Oh, and in the time it took to build and exhaustively QA that product, customer requirements might well have shifted.

A middle ground addresses time-to-market considerations while delivering customers a minimally viable product, with full disclosure that it lacks certain desirable features or may contain “bugs.” Accepting intentional tech debt has let the product get to market first or, at least, early. It has let customers benefit from the initial product capability and has given them a powerful voice in the product’s evolution, letting their user experience refine further requirements and priorities. Intentional tech debt has recruited the customer as a key part of future development and freed the technology developers to concentrate on evolving features instead of trying to discern from afar what the customer might want next. Tech debt deployed in this manner places the technology developer in the perfect position to exercise the agile methodology.

Different kinds of Tech Debt 2.0 lurk in all kinds of businesses, and even the most brilliant among us can miss what’s right in front of us. Like other business disciplines, technology departments require monitoring, measurement, and management. Implementing a comprehensive diagnostic provides unique insights into the causes of Tech Debt 2.0 and highlights areas that need improvement.

The results reflect your company’s level of technomic health:
• Excellent: Tech Debt 2.0 is being proactively managed jointly by the business and the tech team with a strong focus on innovation and customer experience while maintaining operational excellence.
• Good: Tech Debt 2.0 is proactively managed jointly by the business and the tech team and shows little or no negative impact on business performance.
• Fair: Tech Debt 2.0 management is a mix of reactive and proactive, is led by the tech team, and shows some signs of negative impact on business performance.
• Poor: Tech Debt 2.0 is reactively managed by the tech team and has significant impact on business performance.

Beyond any specific technology or group of technologies, Tech Debt 2.0 is about awareness of the role technology investment plays in determining the viability, success, and existence of an enterprise. Effective Tech Debt 2.0 management enables reaching a balance of investment and prioritization over time and in response to the dynamically changing environment — a priority for not only the CIO but all C-Suite occupants and stakeholders.

[This article was originally published on builtin.com.]

Whether it’s the cool craft brew pub on the corner or the hottest new app, it’s clear that Americans love the excitement, risk, and reward of creating the next big thing in a small package. What also is clear: the US economy loves small and medium-sized businesses because their innovations propel economic resilience, allow us to compete more successfully overseas, and create opportunities for diverse and inclusive business ownership. While many assume huge multinational corporations motor the marketplace, the truth is local SMBs do.

Until very recently, SMBs comprised 99.9 percent of businesses and 47.5 percent of private sector employment in the US. Sadly, SMBs have taken a tremendous hit in 2020, with the COVID-19 outbreak presenting unexpected obstacles to their success and survival. How SMB owners and C-suite leaders have deployed technology is turning out to be a major factor in how, or if, their company will survive those challenges.

Like large companies, SMBs have become dependent on technologies to support critical functions such as marketing, sales, manufacturing, and customer experience, in addition to traditional back office. Those SMBs that have managed their technology with oversight and efficiency are realizing opportunities for competitive advantage. Of those that haven’t, many are struggling to overcome the effects of technical debt—specifically, what I call “Tech Debt 2.0®.”

The concept of technical debt has been around for nearly three decades. Howard G. “Ward” Cunningham, a programmer known for developing the first wiki, is credited with coining the term. “Shipping first-time code is like going into debt,” according to Cunningham. “Every minute spent on not-quite-right code counts as interest on that debt.” In other words, a little debt speeds development, as long as it is paid back promptly with a rewrite. This description makes the trade-off clear: Speedier development time and the ability to rush to market is leveraged against future work to improve and support the first version’s imperfections. The “interest” is a stand-in for future development costs, increased support headaches, and potential hits on credibility.

In my book Tech Debt 2.0®, I compare the concept of technical debt to financial debt. One way in which the analogy doesn’t work quite as neatly is that financial debt is typically owed to someone else, usually a bank, credit union, or rich uncle. Tech Debt 2.0, however, is something your small business owes to itself.

Similar to the original definition, Tech Debt 2.0 refers to an imperfection in the state of technology that a business should rectify in the near future, causing interest to accrue that is either financial or non-financial in nature. But, the definition is not simply limited to software development—because the problem isn’t simple at all.

For example, Tech Debt 2.0 can be attributed to the version of software and operating systems, the level of security capabilities employed on systems, the age of networking equipment in the data center, or the compatibility of existing solutions with new, cutting edge technologies. If you know where to look, the effects of Tech Debt 2.0 can also be found in data quality, business processes, and even among IT talent. The effects can be compared to accrued interest and directly impact, or irrevocably threaten, the bottom line.

Tech Debt 2.0 can translate into excessive costs for businesses, whether from rectifying security breaches, recouping lost revenue, or increasing expenditures. It also comes with a significant non-financial price tag. Tech Debt 2.0 can drive down employee morale, inhibit the recruitment and retention of good talent, and negatively affect the merger and acquisition process. And, it can have disastrous effects on a company’s reputation.

SMBs may not recognize IT as the key strategic asset it is, and, therefore, may wind up underutilizing IT for competitive advantage. Another distinct challenge for SMBs is their ability to minimize the impact of Tech Debt 2.0. The challenges of proactively managing their company’s technology investments are aggravated as SMB leaders confront the challenges of COVID-19.

The first step for leaders is getting a firm grasp of tech debt, the intersection of technology and economics, and how to recognize the different types: unplanned, creeping, and intentional. With an understanding of tech debt, SMB leaders can then take steps to avoid it, eliminate, or use it to their advantage. In Tech Debt 2.0®, I offer SMB leaders a tool to measure their company’s tech debt to help guide the future direction of their business.

Every SMB leader has an opportunity to positively impact their organization during this time of crisis and throughout the uncertainty ahead. Following are offensive and defensive actions you can take today:

On Offense:

• Do a health check of your project portfolio and reprioritize backlog.
• Refocus IT governance to accelerate decision-making and maintain alignment.
• Develop an “acute” action plan with intent and purpose for the next 30, 60, 90, and 180 days.
• Prioritize actions that focus on revenue preservation and customer experience.

On Defense:

• Diagnose your tech debt and plan to address root causes.
• Conduct a business impact analysis to prioritize your cyber risks.
• Review and revise essential “pandemic” security policies and practices.
• Engage your team and external partners to identify cost-saving opportunities.
• Protect core operations and monitor critical infrastructure services of internal users.

Above all, stay healthy and stay positive—for the sake of your family as well as your business.

[This article was originally published on ceoworld.biz.]