Transformation Innovation

4 Factors Driving Digital Transformation ROI

The critical assessment factors for cloud ROI risk probability are the following:     

• Infrastructure utilization
• Speed of migration to cloud
• Ability to scale business/mission processes
• Quality delivered by the new cloud-based process 

These four factors directly drive digital transformation ROI because they affect revenue, cost, and the time required to realize any investment return. Differences between actual and projected values in these metrics indicate a likely failure to achieve the desired goals.

Although business alignment is always a primary digital transformation drive, ROI remains a key decision component. This metric should, however, be addressed from multiple vantage points to include cloud workload utilization, workload size versus memory/processor distribution and the virtual hardware instance to physical asset ratio. 

Value delivered through innovation should also be part of the business value calculation. Value can be delivered through operational cost reductions, optimization of resource capacity, and a reduced total cost of ownership. Business process time reductions, product quality improvements and customer experience enhancements are also useful outcomes.

Security Controls

Business/mission model changes can also introduce operational risk. Acceptance of these risk are based on executive risk tolerance. Their risk mitigation decisions result in the implementation of security controls. A control will restrict a list of possible actions down to what is allowed or permitted by the organization. Encryption, for example, can be used to restrict the unauthorized use of data.

The security control continuum extends over three categories:         

• Management (administrative) controls: policies, standards, processes, procedures, and guidelines set by corporate administrative entities (i.e., executive to mid-level management)         
• Operational (and physical) controls: operational security (execution of policies, standards and process, education, and awareness) and physical security (facility or infrastructure protection)
• Technical (logical) controls: Access controls, identification and authentication, authorization, confidentiality, integrity, availability, and non-repudiation 

They also encompass the following types:

• Directive controls: often referred to as administrative controls, advise employees of the behavior expected of them during their interfaces with or use of information systems
• Preventive controls: include physical, administrative, and technical measures that preclude actions that violate policy or increase the risk to system resources
• Deterrent controls: use warnings and a description of related consequences to prevent security violations
• Compensating controls: Also called an alternative control, a mechanism that is put in place to address security requirements deemed impractical to implement
• Detective controls: Refer to the use of practices, processes, and tools that identify and possibly react to security violations
• Corrective controls: involves physical, administrative, and technical measures designed to react to a security-related incident in order to minimize the opportunity for an unwanted event to reoccur
• Recovery controls: restore the system or operation to a normal operating state once integrity or availability is compromised 

The costs associated with the implementation of any security control should be weighed against the value gained from digital transformation business/mission process improvements.

Would you like to learn more about digital transformation innovation? Pick up a copy of my new book, Click to Transform!