Sandi Conrad
Principal Research Director
Info-Tech Research Group

The business needs to move quickly to adopt new ways to collect and analyze data or automate actions. IoT may be the right answer, but it can be complex and create new challenges for IT teams.

Many of these solutions are implemented by vendors as point solutions, but more organizations are recognizing they need to bring the data in-house to start driving insights.

As IoT solutions become more prolific, the need to get more involved in securing and managing these solutions has become evident.

The business is often engaging directly with the vendors to better understand how they can benefit from these solutions, and IT is often brought in when the solution is ready to go live.

When IT isn’t involved early, there may be challenges around integrations, communications, and getting access to data.

Management becomes challenging as many devices are suddenly entering the environment, which need to be inventoried, added to lifecycle management practices, and secured.

Info-Tech’s approach starts with assessing the proposed solutions to:

• Ensure they will meet the business need.
• Understand data structure for integration to central data store.
• Ensure privacy and security needs can be met.
• Determine effort and technical requirements for integration into the infrastructure and appropriate onboarding into operations.

• Point solutions may be installed and configured with support outsourced to vendors, where integrations may be light or non-existent.
• Each point solution will be owned by the business, with data used for a specific purpose, and may only require infrastructure support from the internal IT department.
• Operational needs must be met to protect the business’ investment, and without involving IT early, agreements may be signed that don’t meet long-term goals of high value at reasonable prices.
• To fully realize value from multiple disparate systems, a cohesive strategy to bring together data will be required, but with that comes a need to improve technology, determine data ownership, and improve oversight with strengthened security, privacy, and communications.
• Where IoT is becoming a major source of data, taking a piecemeal approach will no longer be enough to be successful.

IoT solutions may be chosen by the business, but to be successful and meet their requirements, a partnership with IT will ensure better communications with the service provider for a less stressful implementation with governance over security needs and protection of the organization’s data, and it will ensure that continual value is enabled through effective operations.

• Solutions managed outside of IT, whether through an operational technology team or an outsourced vender, will require a comprehensive approach that encourages collaboration, common understandings of risk, and the ability to embrace change.
• Technical expertise required will be broad and deep for a multi-solution implementation. Many types of devices, with varied connections and communications methods, will need to be architected with flexibility to accommodate changing technology and scalability needs.
• Understanding the myriad options available and where it makes sense to deploy cutting-edge vs. proven technologies, as well as edge computing and digital twins.
• External consultants specializing in IoT may need to be engaged to make these complex solutions successful, and they also need to be skilled in facilitating discussions within teams to bring them to a common understanding.
• Analysis skills and a data strategy will be key to successfully correlating data from multiple sources, and AI will be key to making sense of vast amounts of data available and be able to use it for predictive work. According to the Microsoft IoT Signals report of October 2020, “79% of organizations adopt AI as part of their IoT solution, and those who do perceive IoT to be more critical to their company’s success (95% vs. 82%) and are more satisfied with IoT (96% vs. 87%).“

1. SECURITY
   • Risk identification and assessment
   • Threat modeling – ineffective because of scale
   • Dumb, cheap endpoints without users
   • Massive attack surface
   • Data/system availability
   • Physical access to devices
   • Response to anonymized individuals
2. COMPLIANCE
   • Internal
   • External
     NIST, SOC, ISO
     Profession/industry
   • Ethics
   • Regulatory
     PII, GDPR, PIPEDA
     Audit process

3. OPERATIONAL STANDARDS
   • Industry best practices
   • Open standards vs. proprietary ones
   • Standardization
   • Automation
   • Vendor management
4. TECHNICAL OPERATIONAL MODEL
   • Platforms
   • Insourcing/outsourcing
   • Acquisition
   • Asset management
   • Patching
   • Data protection
   • Source image control
   • Software development lifecycle
   • Vendor management
   • Disposition/disposal

IoT Steering Committee Charter

IoT Solution Playbook

IT Benefits

• Aggregation of processes and data may have compelling implications for increasing effectiveness of the business, but this may also increase risk. A framework will help to drive value while putting in appropriate guardrails.
• IoT use cases may be varied within many industries, and the use of many types of sensors and devices complicates management and maintenance. A common understanding of how devices will be tracked, managed, and maintained is imperative to IT securing their systems and data.
• A pilot program to evaluate effectiveness and either reject or move forward with a plan to onboard the solution as quickly as possible will ensure quick time to value and enable immediate implementation of controls to meet operational and security requirements.

Business Benefits

• Aggregation of many disparate groups of data can provide new insights into the way an organization interacts with its clients and how clients are using products and services.
• As organizations innovate and new IoT solutions are introduced to the environment, solutions need to be evaluated quickly to determine if they’re going to meet the business case and then determine what needs to be put in place for technology, process, and policy to ensure success.
• As new solutions are introduced, anyone who may be impacted through this new data-collection process will need to be informed and feel secure in the way information is analyzed and managed. This project will provide the framework to quickly assess the risks and develop a communications plan.

• Search for real problems to solve, with visible improvement possibilities
• Don’t choose technology for technology’s sake
• Keep an eye to the future
• Strategic foresight

• Avoid the “Big Bang” approach
• Test technologies in multiple conditions
• Run inexpensive pilots
• Increase flexibility
• Technology ecosystem

• Collaborate with the community
• Gain and sustain support
• Increase uptake of city technology
• Crowdsource community ideas

• Production increases and efficiency
• Reliability as data quality increases
• New product development opportunities through better understanding of how your products are used
• New product offerings with automated data collection and analysis of aggregated data

• Improved wellness programs for employees and patients through proactive health management
  • Reduction in health care/insurance costs
  • Reduction in time off for illness
• Reduction in human error
• Improved safety – fewer equipment malfunction incidents
• Sustainability – reduction in emissions

• Cost efficiency – lower energy consumption, less waste, improved product consumption
• Reliability – reduced downtime of equipment due to condition-based maintenance
• Security – decrease in malware attacks

• # supported devices
• % of projects using IoT
• % of managed systems
• % of increase in equipment optimization

DIY Toolkit

Guided Implementation

Workshop

Consulting

Diagnostics and consistent frameworks used throughout all four options

Call #2: Define process for meeting and assessing requests.

Call #4: Define the role of the BRM & assessment criteria.

Call #6: Define assessment requirements for other IT groups.

Steering Committee

1.1 Define the committee’s roles and responsibilities in the IoT Steering Committee Charter

1.2 Define the IoT steering committee’s vision statement and mandates

1.3 Define procedures for reviewing proposals and roles and responsibilities

Intake Process

2.1 Define requirements for requesting new IoT solutions

2.2 Define procedures for reviewing proposals and projects – BA/BRM

2.3 Define procedures for reviewing proposals and projects – Data specialists

2.4 Define procedures for reviewing proposals and projects – Privacy & Security

2.5 Define procedures for reviewing proposals and projects – Infrastructure & Operations

2.6 Define service objectives and evaluation process

Proof of Value

3.1 Determine the criteria for running a proof of value

3.2 Define the template and process for running a proof of value

Create an IoT steering committee to ensure value will be realized and operational needs will be met

The goals of the steering committee should be:

• To align IoT initiatives with organizational goals. 
• To effectively evaluate, approve, and prioritize IoT initiatives.
• To approve IoT strategy & evaluation criteria.
• To reinforce and define risk evaluation criteria as they relate to IoT technology.
• To review pilot results and confirm the value achievement of approved IoT initiatives.
• To ensure the investment in IoT technology can be integrated and managed using defined parameters.

As IoT solutions move beyond their primary goals, it will be critical to evaluate the continually increasing data to mitigate risks of unintended consequences as new data sets converge. The security team will need to evaluate solutions and enforce standards.

CDO and analysts will assess opportunities for data convergence to create new insights into how your services are used.

Operational plans will include asset management, monitoring, and support to meet functional goals and manage throughout the asset lifecycle.

Each solution added to the environment will need to be chosen and architected to meet primary functions and secondary data collection.

• The committee should include team members experienced enough to provide an effective assessment of IoT projects, and to provide input and oversight regarding business value, privacy, security, operational support, infrastructure, and architectural support.
• A data specialist will be critical for evaluating opportunities to expand use of data and ensure data can be effectively validated and aggregated. Additional oversight will be needed to review aggregated data to protect against the unintended consequences of having data combined and creating personas that will identify individuals.
• Additional experts may be invited to committee meetings as appropriate, and ideas should be discussed and clarified with the business unit bringing the ideas forward or that may be impacted by solutions.
• Invite appropriate IT and business leaders to the initial meeting to gain agreement and form the governance model.

• Define the IoT vision in alignment with the organizational strategy and mission.
• Define strategy, policies and communication requirements for IoT projects.
• Assess and bring forward proposals to utilize IoT to further organizational strategy.

• Define criteria for evaluating and prioritizing proposals and projects.
• Validate the IoT proposals to ensure value drivers are understood and achievable.
• Identify opportunities to combine data sets for secondary analysis and insights.

• Evaluate data and combined data sets to avoid unintended consequences.
• Ensure security standards are adhered to when integrating new solutions.
• Reinforce privacy regulations, policy, and communications requirements.

• Identify and validate investment and resource requirements.
• Evaluate technical requirements and capabilities.
• Align IoT management requirements to operations goals within IT.

• Assess validity of pilot project plan, including success criteria.
• Identify corner cases to assess functionality and potential risks beyond core features.
• Monitor progress, evaluate results, and ensure organizational needs will be met.
• Evaluate pilot to determine if it will be moved into full production, reworked, or rejected.