A SPICE-Based Maturity Model for the Governance and Management of Green IT

Abstract

Organizations around the world are increasingly concerned about the environment, adopting sustainable practices in their business processes. In the field of Information Technologies (IT) several Green IT practices have been proposed, but in isolation, so a framework is needed if the Green IT is to be implemented and improved in an efficient and integrated way. In this paper, we propose a maturity model (based on SPICE) to help organizations to implement the governance and management of Green IT gradually, as well as to improve their maturity level in this area. The validation of this proposal by experts and a case study seems to indicate that the proposal can be useful for implementing and improving the Green IT processes in organizations.

Appendix A: Processes of the “Governance and Management Framework for Green IT” Organized by the SPICE Maturity Levels

A.1 Level 1

BAI09: Manage assets

• Description of the process: Manage IT assets through their life cycle to make sure that their use delivers value at optimal cost, they remain operational (fit for purpose), they are accounted for and physically protected, and those assets that are critical to support service capability are reliable and available. Manage software licenses to ensure that the optimal number are acquired, retained and deployed in relation to required business usage, and the software installed is in compliance with license agreements.

• Statement of the purpose of the process: Account for all IT assets and optimize the value provided by these assets.

DSS01: Manage operations

• Description of the process: Co-ordinate and execute the activities and operational procedures required to deliver internal and outsourced IT services, including the execution of pre-defined standard operating procedures and the required monitoring activities.

• Statement of the purpose of the process: Deliver IT operational service outcomes as planned.

A.2 Level 2

APO01: Manage the IT management framework

• Description of the process: Clarify and maintain the governance of organization IT mission and vision. Implement and maintain mechanisms and authorities to manage information and the use of the organization IT in support of governance objectives in line with guiding principles and policies.

• Statement of the purpose of the process: Provide a consistent management approach to enable the organization governance requirements to be met, covering management processes, organizational structures, roles and responsibilities, reliable and repeatable activities, and skills and competencies.

APO02: Manage strategy

• Description of the process: Provide a holistic view of the current business and IT context, the future direction, and the initiatives required to migrate to the desired future context. Leverage organization architecture building blocks and components, including externally provided services and related capabilities to enable nimble, reliable and efficient response to strategic objectives.

• Statement of the purpose of the process: Align strategic IT plans with business objectives. Clearly communicate the objectives and associated accountabilities so they are understood by all, with the IT strategic options identified, structured and integrated with the business plans.

APO06: Manage budget and costs

• Description of the process: Manage the IT-related financial activities in both the business and IT functions, covering budget, cost and benefit management, and prioritization of spending through the use of formal budgeting practices and a fair and equitable system of allocating costs to the organization. Consult stakeholders to identify and control the total costs and benefits within the context of the IT strategic and tactical plans, and initiate corrective action where needed.

• Statement of the purpose of the process: Foster partnership between IT and organization stakeholders to enable the effective and efficient use of IT-related resources and provide transparency and accountability of the cost and business value of solutions and services. Enable the organization to make informed decisions regarding the use of IT solutions and services.

APO08: Manage relationships

• Description of the process: Manage the relationship between the business and IT in a formalized and transparent way that ensures a focus on achieving a common and shared goal of successful organization outcomes in support of strategic goals and within the constraint of budgets and risk tolerance. Base the relationship on mutual trust, using open and understandable terms and common language and a willingness to take ownership and accountability for key decisions.

• Statement of the purpose of the process: Create improved outcomes, increased confidence, trust in IT and effective use of resources.

BAI02: Manage requirements definition

• Description of the process: Identify solutions and analyze requirements before acquisition or creation to ensure that they are in line with organization strategic requirements covering business processes, applications, information/data, infrastructure and services. Co-ordinate with affected stakeholders the review of feasible options including relative costs and benefits, risk analysis, and approval of requirements and proposed solutions.

• Statement of the purpose of the process: Create feasible optimal solutions that meet organization needs while minimizing risk.

BAI03: Manage solutions identification and build

• Description of the process: Establish and maintain identified solutions in line with organization requirements covering design, development, procurement/sourcing and partnering with suppliers/vendors. Manage configuration, test preparation, testing, requirements management and maintenance of business processes, applications, information/data, infrastructure and services.

• Statement of the purpose of the process: Establish timely and cost-effective solutions capable of supporting organization strategic and operational objectives.

A.3 Level 3

EDM01: Ensure governance framework setting and maintenance

• Description of the process: Analyze and articulate the requirements for the IT governance of the organization, and put in place and maintain effective enabling structures, principles, processes and practices, with clarity of responsibilities and authority to achieve the organization’s mission, goals and objectives.

• Statement of the purpose of the process: Provide a consistent approach integrated and aligned with the organization governance approach. To ensure that IT-related decisions are made in line with the organization’s strategies and objectives, ensure that IT-related processes are overseen effectively and transparently, compliance with legal and regulatory requirements is confirmed, and the governance requirements for board members are met.

EDM02: Ensure benefits delivery

• Description of the process: Optimize the value contribution to the business from the business processes, IT services and IT assets resulting from investments made by IT at acceptable costs.

• Statement of the purpose of the process: Secure optimal value from IT-enabled initiatives, services and assets; cost-efficient delivery of solutions and services; and a reliable and accurate picture of costs and likely benefits so that business needs are supported effectively and efficiently.

EDM05: Ensure stakeholder transparency

• Description of the process: Ensure that organization IT performance and conformance measurement and reporting are transparent, with stakeholders approving the goals and metrics and the necessary remedial actions.

• Statement of the purpose of the process: Make sure that the communication to stakeholders is effective and timely and the basis for reporting is established to increase performance, identify areas for improvement, and confirm that IT-related objectives and strategies are in line with the strategy of the organization.

MEA03: Monitor, evaluate and assess compliance with external requirements

• Description of the process: Evaluate that IT processes and IT-supported business processes are compliant with laws, regulations and contractual requirements. Obtain assurance that the requirements have been identified and complied with, and integrate IT compliance with overall organization compliance.

• Statement of the purpose of the process: Ensure that the organization is compliant with all applicable external requirements.

A.4 Level 4

MEA01: Monitor, evaluate and assess performance and conformance

• Description of the process: Collect, validate and evaluate business, IT and process goals and metrics. Monitor that processes are performing against agreed-on performance and conformance goals and metrics and provide reporting that is systematic and timely.

• Statement of the purpose of the process: Provide transparency of performance and conformance and drive achievement of goals.

A.5 Level 5

EDM03: Ensure risk optimization

• Description of the process: Ensure that the organization’s risk appetite and tolerance are understood, articulated and communicated, and that risk to organization value related to the use of IT is identified and managed.

• Statement of the purpose of the process: Ensure that IT-related organization risk does not exceed risk appetite and risk tolerance, the impact of IT risk to organization value is identified and managed, and the potential for compliance failures is minimized.

EDM04: Ensure resource optimization

• Description of the process: Ensure that adequate and sufficient IT-related capabilities (people, process and technology) are available to support organization objectives effectively at optimal cost.

• Statement of the purpose of the process: Ensure that the resource needs of the organization are met in the optimal manner, IT costs are optimized, and there is an increased likelihood of benefit realization and readiness for future change.