Computer Science

of

National

Standards

Bureau and Technology

NBs NBS Special Publication 500-125

PUBLICATIONS

Issues in the Management

of Microcomputer Systems

John Barkley and Lynne S. Rosenthal
T# he National Bureau of Standards' was established by an act of Congress on March 3, 1901. The

m Bureau's overall goal is to strengthen and advance the nation's science and technology and facilitate their effective application for public benefit. To this end, the Bureau conducts research and provides: (1) a

basis for the nation's physical measurement system, (2) scientific and technological services for industry and

government, (3) a technical basis for equity in trade, and (4) technical services to promote public safety.

The Bureau's technical work is performed by the National Measurement Laboratory, the National

Engineering Laboratory, the Institute for Computer Sciences and Technology, and the Institute for Materials

Science and Engineering

.

The National Measurement Laboratory

Provides the national system of physical and chemical measurement;

coordinates the system with measurement systems of other nations and

furnishes essential services leading to accurate and uniform physical and

chemical measurement throughout the Nation's scientific community, in- dustry, and commerce; provides advisory and research services to other Government agencies; conducts physical and chemical research; develops,

produces, and distributes Standard Reference Materials; and provides

calibration services. The Laboratory consists of the following centers:

• Basic Standards^

• Radiation Research

• Chemical Physics

• Analytical Chemistry

The National Engineering Laboratory

Provides technology and technical services to the public and private sectors to address national needs and to solve national problems; conducts research in engineering and applied science in support of these efforts; builds and maintains competence in the necessary disciplines required to carry out this research and technical service; develops engineering data and measurement

capabilities; provides engineering measurement traceability services; develops

test methods and proposes engineering standards and code changes; develops

and proposes new engineering practices; and develops and improves

mechanisms to transfer results of its research to the ultimate user. The

Laboratory consists of the following centers:

Applied Mathematics

Electronics and Electrical Engineering^

Manufacturing Engineering

Building Technology

Fire Research

Chemical Engineering^

The Institute for Computer Sciences and Technology

Conducts research and provides scientific and technical services to aid Federal agencies in the selection, acquisition, application, and use of computer technology to improve effectiveness and economy in Government

operations in accordance with Public Law 89-306 (40 U.S.C. 759), relevant Executive Orders, and other directives; carries out this mission by managing

the Federal Information Processing Standards Program, developing Federal ADP standards guidelines, and managing Federal participation in ADP

volunt£iry standardization activities; provides scientific and technological advisory services and assistance to Federal agencies; and provides the technical foundation for computer-related policies of the Federal Government. The Institute consists of the following centers:

• Programming Science and

Technology

• Computer Systems

Engineering

77?^ Institute for Materials Science and Engineering

Conducts research and provides measurements, data, standards, reference

materials, quantitative understanding and other technical information fundamental to the processing, structure, properties and performance of materials; addresses the scientific basis for new advanced materials technologies; plans

research around cross-country scientific themes such as nondestructive

evaluation and phase diagram development; oversees Bureau-wide technical programs in nuclear reactor radiation research and nondestructive evaluation; and broadly disseminates generic technical information resulting from

its programs. The Institute consists of the following Divisions:

Inorganic Materials Fracture and Deformation^

Polymers

Metallurgy Reactor Radiation

'Headquarters and Laboratories at Gaithersburg, MD, unless otherwise noted; mailing address Gaithersburg, MD 20899. ^Some divisions within the center are located at Boulder, CO 80303. 'Located at Boulder, CO, with some elements at Gaithersburg, MD.
Computer Science

and Technology

NATIONAL ETOEfllj OF STANDARDS

LIBRARY

r

NBS Special Publication 500-125

Issues in the Management

of Microcomputer Systems

John Barkley

Lynne S. Rosenthal

Institute for Computer Sciences and Technology

National Bureau of Standards

Gaithersburg, MD 20899

U.S. DEPARTMENT OF COMMERCE

Malcolm Baldrige, Secretary

National Bureau of Standards

Ernest Ambler, Director

Issued September 1985
Reports on Computer Science and Technology

The National Bureau of Standards has a special responsibility within the Federal

Government for connputer science and technology activities. The programs of the

NBS Institute for Computer Sciences and Technology are designed to provide ADP

standards, guidelines, and technical advisory services to improve the effectiveness

of computer utilization in the Federal sector, and to perform appropriate research

and development efforts as foundation for such activities and programs. This

publication series will report these NBS efforts to the Federal computer community as

well as to interested specialists in the academic and private sectors. Those wishing

to receive notices of publications in this series should complete and return the form

at the end of this publication.

Library of Congress Catalog Card Number: 85-600588

National Bureau of Standards Special Publication 500-125

Natl. Bur. Stand. (U.S.), Spec. Publ. 500-125, 54 pages (Sept. 1985)

CODEN: XNBSAV

U.S. GOVERNMENT PRINTING OFFICE WASHINGTON: 1985

For sale by the Suoerintendent of Documents, U.S. Government Printing Office, Washington, DC 20402
Contents

Executive Summary 1

1 Introduction 3

1.1 Overview 3

1.2 Document Structure 4

2 Information Issues 6

2.1 Naming and Organization 7

2.2 Sharing 8

2.3 Collection 8

2.4 Security 9

2.4.1 Confidentiality 9

2.4.2 Integrity 11

2.4.3 Availability 12

3 User Issues 13

3.1 Basic User Skills 14

3.2 Classification of Users 16

3.3 Application Development 16

3.3.1 Changing Nature of Development Activity 18

3.3.2 Potential Problems 19

4 Management/Support Groups 21

4.1 Organizational Structure 21

4.2 Management/Support Services 22

4.2.1 For the Information 23

4.2.2 For the Users 24

4.2.3 For the Technology 24

4.3 Acquisition 25

4.3.1 Procurement Roles and Responsibilities 26

4.3.2 Justification 26

iii
5 Technology Issues 29

5.1 In-house Standards 29

5.1.1 Advantages of In-house Standards 31

5.1.2 Disadvantages of In-house Standards 33

5.2 Managing Technological Change 34

5.2.1 Phasing in Systems Over Time 36

5.2.2 Acquiring Leading Edge Technology 36

5.2.3 Acquiring Systems from Several Producers 36

5.2.4 Combining Approaches 37

6 Microcomputers and Organizations 38

6.1 Nature of Microcomputer Usage 39

6.2 Nature of an Organizational Mission 39

6.3 ADP and End User Experience 40

6.4 Long Term Impact on the Organization 41

7 SUMMARYrDeveloping a Policy 42

7.1 Elements for Consideration 42

7.2 Policy Topics 45

8 REFERENCES AND RELATED READING 47

iv
EXECUTIVE SUMMARY

End user computing encompasses a broad range of technologies, all of which enable an individual to directly control his information processing needs. It consists of office

automation, personal computers, mini and mainframe computers, and supporting technologies which provide the potential for improving information management within the

Federal Government. This report focuses on just one aspect of end user computing, the

microcomputer.

The growth in the use of microcomputers challenges managers to organize and support

microcomputer-based information resources so that the microcomputer technology can become an effective part of the organization's total information resources. This document

provides those individuals responsible for the management of information resources with an

understanding of the issues and activities that lead to effective information management.

It identifies issues related to the management of microcomputer systems and analyzes some

of the options available for the effective integration of small systems into an organization's

overall ADP usage. Included in the discussion are overall organizational characteristics,

information issues, user issues, and technology issues.

Organizations have the opportunity to take advantage of the benefits which can be

gained by the use of microcomputer technology. However, the realization of these benefits

requires that the organization carefully consider the nature and extent of microcomputer

usage, the organization's missions, end-user experience, and overall ADP experience within

the organization. It is important to understand the impact these factors will have on the

organizational strategy for using microcomputers to improve information management.

Related to the organization's use of information, there are several issues to be addressed.

The use of data naming and data organization conventions enables information to be

known and shared among departments. As new data is entered into microcomputers, the

validation of this data should be performed before it is integrated into the organization's

databases. Of particular concern should be those problems associated with information

and microcomputer system security.

The time when all computer users were ADP professionals is long past. End users with

no previous computer experience as well as ADP professionals are using microcomputers to

perform their jobs more effectively. Regardless of the microcomputer users' background,

they need basic skills in order to operate the microcomputer system and maintain the

information contained on it. To provide these skills, support services are necessary. The

services can promote information management, user efficiency, and/or effective management of the technology. Every office within the organization should have at least one

individual providing local support with more formal and extensive support provided at a higher, centralized organizational level. The integration of the support services into

existing organizational structures can benefit from the experience of existing ADP and

microcomputer experts.

Microcomputer technology is only a means by which users gain access to and make

more effective use of information. Technology issues include acquisition management and

1
in-house standards. Acquisition management helps insure that a microcomputer system

will meet an information or user need and be representative of current technology. In- house standards promote compatibility between systems, thus enhancing resource sharing

and lowering the cost of support. It often consists of a list of organizationally supported

hardware and software or a set of minimum requirements that a microcomputer system

must meet. In-house standards should be carefully selected based on application and support needs. When possible, such standards should be consistent with standards developed

by recognized standards organizations and with defacto standards set in the marketplace.

In-house standards should be continually scrutinized so that equipment is not locked-in

and made obsolete by rapidly changing technology, thus becoming unable to meet current

and future application requirements.

The availability, quality, and variety of off-the-self software packages has minimized

the need for in-house application development. Since these application packages can be

purchased and installed rapidly, return on investment can be realized more quickly than

with custom program development. However, many application packages contain features

that will allow the end user to customize or program within the package. As the number

of end users, developers, and systems affected by this type of programming increases, the

required level of formal software development documentation also increases.

The rapid pace of technology, continually making new capabilities possible, leads to a changing perception of application requirements. For example, before technology made

microcomputers economically feasible, there was never a requirement for a professional

to have his own computer. These changes are a natural result of new alternatives made

possible by advances in technology. In examining the changes, it is important to make

the distinction between what is technically possible and what is valuable in the context of

existing organizations.

To use and manage microcomputers effectively, organizations should develop a plan addressing the information, user, and technology aspects of its microcomputer usage. Such

a plan should delineate the objectives to be achieved, the management/support services

needed, the roles and responsibilities of those implementing the plan, and any in-house

microcomputer standards. The purpose of these plans is not to obstruct the use of microcomputer systems, but rather to maximize the benefits to be derived from their usage.

Information about other NBS/ICST microcomputer related publications and activities can be obtained from the authors at:

National Bureau of Standards

Institute for Computer Sciences and Technology

B266 Technology

Gaithersburg MD 20899

(301) 921-3485

or electronically from the NBS/ICST information service on microcomputers at

(301) 948-5718.

2
Chapter 1

Introduction

The influx of microcomputers into the organization has changed the way information

is processed and handled. The microcomputer has become a tool that enables end-users

to have more control over their information processing needs. This end-user computing

technology is evolving at great speed. The availability of these systems, their cost, their

adaptability to various applications, and their compact size (small enough to fit on a desk)

have helped to promote this use. As the use of microcomputers within an organization continues to grow, that organization is faced with the question of how to manage this new technology efficiently and

eff^ectively. Several organizations have already developed policies pertaining to the microcomputer technology, whereas others are just beginning to explore and develop such

policies and directions.

This document provides individuals who are faced with the task of managing information resources with an understanding of the issues and activities that lead to effective

information management. It addresses the need for establishing a management policy,

presents various considerations and problems associated with the management of microcomputers, and discusses the development and implementation of a management strategy.

1.1 Overview

Traditionally, the use and management of computers within an organization was the

responsibility of the centralized ADP department. These computers are extremely expensive and require qualified ADP professionals to operate and program them. With low cost

microcomputers and easy-to-use application software, the role of computing within the

organization is changing. The microcomputer creates a new class of computer users (typically, unskilled in computer technology) and provides them with a means of automating

functions that were not previously automated, and thus, the ability to solve problems and

make decisions more rapidly. The great speed at which this end-user technology is being

incorporated into the organization and the nature of its acquisition and use has created a management problem. The microcomputer has decentralized the organization's computing

3
resources and has made it necessary to reexamine the management of information systems

and their technology.

A managed approach to the organization's microcomputing activities can help to achieve

the following:

• coordination of microcomputer resources

• the benefits commensurate with the investment of equipment, software, and training

• the compatibility of the microcomputer equipment and its use with existing systems

• the accuracy of data and compatibility with existing systems and practices

• the security of the microcomputer and the information associated with it

• the smooth transition from the current environment to an end-user environment,

e.g., implement training structures

• consideration of the consequences of implementing microcomputer systems e.g., the

effect on human and organizational characteristics

The policy can focus on the management of various resources associated with enduser computing, specifically with microcomputing; and can manage those resources at

various levels with a variety of incentives and controls. A common organizational reaction

is to restrict or prohibit the use of facilities which are not well understood. However,

attention should be given to the consequences of implementing overly restrictive policies.

A restrictive policy can result in the inability of both the organization and the user to adapt

to the rapidly changing technology and the inability to take advantage of new applications

and uses.

1.2 Document Structure

This document includes eight chapters that describe the issues associated with the

management of microcomputers, the tradeoff's, and alternative directions. Since organizations have different goals and resources, there are few statements about the management

and support of microcomputers which apply to all organizations. Each organization must

weigh the alternatives according to its unique needs and resources. This document presents

background, issues, and alternatives which can help an organization in its management and

support of microcomputers.

Background information is provided in chapter 1, followed by management issues in

chapters 2, 3, and 4. Chapter 2 discusses the information management problems caused

by the ability to access and manipulate new and existing information on the microcomputer. Chapter 3 describes microcomputer users and the functions that these users will

4
need to perform. And, chapter 4 is concerned with the support and acquisition of microcomputers. It describes the support structures and activities that can be provided and

discusses procurement and justification procedures.

Standards and technological management alternatives are addressed in Chapter 5. The

chapter presents a general discussion of the problems created by the rapidly changing

microcomputer technology and the ways the organization can deal with these problems.

Organizational factors which affect the use of microcomputers are presented in chapter

6. The chapter addresses the development of a management style that reflects the existing

organizational structures and the nature of the microcomputer usage.

A general summary of this document is provided in chapter 7. An outline of the el- ements that can consitute a microcomputer management policy is presented. Chapter 8

contains references to several other publications which address microcomputer management issues.

5
Chapter 2

Information Issues

As microcomputers are introduced into an organization, data administration methodologies are challenged by two problems: the broader distribution of existing information

and the introduction of new information.

The use of microcomputers in an organization tends to distribute data which was once

located primarily on mainframes. Departments and individuals within many organizations use the rapid-response, human-engineered, software of microcomputers to manipulate existing data in order to gain new insights into the information. In most cases, this is advantageous to an organization, since it enables the operating units to perform their

functions more effectively. Because microcomputers have the ability to easily acquire and

store existing information, because there is a demand within departments for access to an organization's information, and because of the availability of microcomputers, many

copies, in many forms, of vital data can be generated. This rapid dispersion and manipulation of information made possible by microcomputers can compromise information

security and accuracy.

The other challenge to data administration is the generation of new data by those using

microcomputers. As information is proliferated and analyzed using the highly interactive

techniques of microcomputer software, the conclusions formed by this analysis becomes

new information which is often organized and stored electronically. Moreover, the departments of an organization have the opportunity by means of microcomputers, to collect

information to be used exclusively within the department, to be distributed throughout

the organization, or to be disseminated externally.

As with the generation of information from the analysis of existing data, the collection

of new data can enable an operating unit to do its job better. However, the creation

of new information can lead to redundant efforts on the part of the departments. In

addition, the department which created or collected the information may be unaware of

security implications.

Several of the information management issues which arise from the use of microcomputers are discussed below.

6
2.1 Naming and Organization

All large organizations have experience with information management. The basic principles of information management are the same regardless of the means by which the

information is collected or the media on which the information is stored. Fundamental to

data administration is the use of data naming and data organization conventions.

Data naming and organization conventions may be promulgated by automated and/or

manual methods. In a mainframe environment, data naming and organization conventions can be supported by means of the data dictionary and the data file structures of the

database management system. New information conforms to these conventions in order to

take advantage of the capabilities of the database management system on the mainframe.

However, microcomputers typically do not have easy access to the data dictionaries on

mainframes. Moreover, the database management methods used on microcomputers are usually different from those on a mainframe. Even in those cases where the data dictionaries on the mainframe are available to the microcomputer, the microcomputer most often

operates in a mode which does not permit immediate access to the mainframe. Thus, the

automated support for maintaining data naming and organization conventions may not be

easily available to the microcomputer.

The problems of consistent data naming and organization are exacerbated when the

database management system on the mainframe has a file organization fundamentally

different from those database management systems used on the microcomputer system.

The most prevalent type of database management system on microcomputers are those

that use the relational data model. Many mainframe database management systems do

not support the relational data model, but rather support file structures of hierarchical,

network, or inverted organization.

There are two common solutions to this problem. The first solution is to create files on the mainframe and/or the microcomputer which are subsets of the full database and

which have the same file organization. This permits users to see the same data organization

regardless of the system they are accessing. The second solution is to translate the file organization into a standard sequential form on one system, transmit the sequential form

to another system, and then translate the sequential form to the file organization of the

other system.

These solutions require increased storage capacity for the intermediate files, and increased processing capacity in order to create and transmit the intermediate files. The

mainframe's storage and processing capacity is often the most affected.

Organizations without data naming and structuring conventions have special problems.

Some departments may have data naming conventions that are different from those conventions used by other departments and/or a central data administration group. When

microcomputers are brought into such an environment, it may be preferable for departments to maintain their existing conventions and when exchanging information, perform

the required translations as they are accustomed. On the other hand, the introduction of

microcomputers may facilitate the adoption of organization-wide data naming and orga7
nization conventions because of the extra measure of automation that results from using

microcomputers. Each organization must decide this based on its own circumstances.

2.2 Sharing

Planning for the distribution of this information can be as important as planning for

the generation of the information. It can often happen that one group will spend resources producing data which another group already has. In order to prevent this from happening,

it is necessary to insure that all within an organization are aware of what information is produced and that all have access to the information they need. The use of data naming

and organization conventions, supported by automated methods such as data dictionaries,

and the dissemination of these conventions, can keep all informed of the existence of data.

Users need to have easy access to the information.

This access is normally provided either by communication links or by media exchange,

e.g., by physically transporting a magnetic medium such as a floppy diskette. Data interchange between microcomputer and mainframes is usually by communication links, while

data interchange between microcomputers is often by either method.

The regular exchange of data, by whatever means, can be said to form a communications

channel between two systems. The aggregate of these communications channels and the

connected systems form a network. The topology of the network and magnitude of the

information flows through the network will not remain constant for long periods of time. An

organization should implement data exchange procedures among its groups in such a way

as to allow for orderly change in the patterns of communications within the organization.

2.3 Collection

The departments of an organization can use microcomputers to collect information

solely for the department's use or information for other groups in the organization. In

most cases, the information collected should conform to the organization's data naming

and data organization conventions.

A common data collection implementation is use of the microcomputer as a stand-alone

data entry system. Data validation can be performed on both the microcomputer and/or

the mainframe. As the data elements of a new record are entered into the microcomputer,

validation criteria based on the relationship of new data elements to each other can easily

be verified on the microcomputer. Validation criteria based on the relationships of new

data elements to data elements already a part of central databases can also be verified

on the microcomputer. This may be accomplished in two ways. The microcomputer may

immediately and automatically access a central database to obtain the data necessary for

validation in the same manner that an interactive terminal would. This approach requires a fast communications link and sophisticated software. Where these are not available, data

8
from the central databases needed for validation of new transactions can be downloaded

to the microcomputer.

Very often, only partial validation of new transactions can take place on the microcomputer as the transactions are being entered. The common approach when using a microcomuter for data entry is as follows: An operator keys data into the microcomputer

during the day, and at the end of the day, the data collected is transmitted to the mainframe for processing, final validation, and archival storage. On the following morning,

data which will be used to partially validate the transactions entered during the day, is downloaded to the microcomputer from the mainframe.

When using this type of data collection method, care should be taken to insure that

transaction validation is timely, and that the bandwidth of the upload and download operations is large enough so that these operations do not interfere with the transaction entry

process. Failure to perform a data transmission on any given day because of unforeseen

circumstances, should not cause the validation process on the microcomputer to fail. A special case of microcomputer-based information collection is the collection of scientific or engineering data. Microcomputers are often an integral part of scientific instrumentation, which automatically accumulates data obtained from observing physical

phenomena. Such scientific instrumentation can generate large volumes of data in a short

period of time. Moreover, these data are usually represented in binary floating point formats. The floating point format on the microcomputer may be difl"erent from the floating

point format of the mainframe. The communication procedure between the microcomputer and the mainframe may not support the transmission of binary data. Additionally,

floating point formats may not be supported by the database management system. Both

the volume of data and the processing which may be required to convert number representations, can place tremendous demands on the microcomputer, the mainframe, the

communications procedures, and the database management systems.

2.4 Security

The concept of information security refers to the security of not only the data, but

also to the hardware and software which generate and process the data. An application is the collection of the data associated with the application, and the hardware and software

procedures which operate on the data. Thus, it is possible to speak of information security

in terms of an application's security. There are three aspects to information security:

confidentiality, integrity, and availability.

2.4.1 Confidentiality

This concept refers to the protection of information from unauthorized disclosure. Distributing programs and data throughout an organization by implementing applications on

microcomputers increases the chance that information confidentiality could be compromised.

9
The situation is considerably different in tlie mainframe environment. Mainframes

usually have software which limits access to data and programs, and audits all accesses made. Mainframes are usually made secure by limiting physical access to the hardware

and the storage media, and by the presence of an operations staff. The storage media used

by mainframes, such as tape reels and disk packs, are bulky and not easily concealed.

Microcomputers usually do not have hardware or software which limits access to data

and programs. While a microcomputer system can be kept in a locked room or fastened

to a non-portable object, a microcomputer is small and is usually left unattended during

non-business hours. Also fioppy diskettes are very portable and easily concealed.

The following methods can be used to protect confidential information:

• File Protection

Protecting the information on the floppy diskette then becomes a matter of protecting the diskettes themselves. Providing protection for floppy diskettes is very

similar to protecting paper files. Protecting information on those microcomputers which have hard discs is more

complicated. While microcomputers are often single user systems, it is not uncommon for the same microcomputer system to be used by several different people at

different times. When using microcomputer with only floppy disks, individuals can

bring their programs and data on floppy diskettes to the system, and when finished,

the floppy diskettes can be removed. While it is possible to do this with hard disk

based microcomputers, it is more efficient to leave programs and data on the hard

disk. However, hard disk based microcomputer may not have file protection mechanisms for the hard disc.

• Login

Some single user and most multi-user microcomputer systems support a user login

procedure, similar to those on a mainframe. Those that do support user login, most

often support file protection schemes.

• Call Back

Most microcomputer systems, even single user systems, can support remote interactive access through a telephone connection. Many organizations support microcomputer bulletin board or videotex systems which can be accessed remotely.

A call back procedure is a login procedure which attempts to verify the identity of

the user seeking access. The procedure goes as follows. The user establishes a communications link to the system, and identifies himself. The system verifies the user's

identity by breaking the communications link and establishing a new communications

link to the location where the system knows the user should be.

10
• Encryption

The protection provided by hardware/software mechanisms, like those described

above, may be defeated if physical access to the system is permitted. On a mainframe, the modification of system hardware and software is difficult because the

architectures of mainframes are complex and very often unique to a specific producer. Modifications to mainframe hardware or software can only be accomplished

by a highly trained individual.

Microcomputer systems have much simpler architectures, commonly consisting

of several standard components. Many microcomputer users know how to change a board or install system software. Thus, microcomputers can present an easy target

for anyone to defeat protection mechanisms such as those described above.

Encryption of the information on a floppy or hard disk is a means of protecting

the confidentiality of information on a microcomputer without having to provide

physical access protection for the system. There are several commercial products

which permit data to be encrypted for storage and/or for communications.

2.4.2 Integrity

Information integrity results when the improper modification or destruction of information is prevented i.e., data quality is maintained. To protect information from destruction,

archiving procedures are almost always used on mainframes and are usually performed

automatically by the operations staff. The user need not request the service and may not even be aware that archiving is performed on a regular basis. With microcomputers, since

the user is normally the operations staff and software for archiving is limited, the user must be responsible for the archiving of information residing on the microcomputer.

Archiving procedures prevent data from being destroyed. Techniques, similar to those

used to insure confidentiality, can be applied to protecting the integrity of information from

improper modification, regardless of whether the information resides on the mainframe or on the microcomputer.

Additional techniques, used to maintain data quality on the mainframe, include the

batching of input transactions, and the creation of read-only files which contain subsets of

databases. The read-only database subsets are called views of a database. These views are transmitted upon demand to microcomputers which need access. As new data is generated

on remote systems, it is transmitted to the mainframe, where it is batched into temporary

files. The transactions remain in these temporary files until the new data is fully validated

and can be used to update the organization's database. Since the view is a read-only file,

and incoming data is validated before the database is updated, the integrity of the database can be protected from unauthorized or accidental modification. The disadvantage of using

views is that, at any given time, the view may not represent of current state of a database.

Views of databases can help maintain the integrity of databases on the mainframe.

However, the integrity of the information on the microcomputer, consisting of new data

11
and data downloaded from the mainframe is likely to be more susceptible to improper

modification. Bad data on the microcomputer can lead to input transactions being lost

because they fail validation on the micocomputer and/or the mainframe, and to false

conclusions when used as input to analysis.

2.4.3 Availability

A key dimension of information security is assuring information availability to authorized individuals and applications. Application availibility requires that an application's

data be accurate, the programs be the current versions, and the hardware be properly

configured to run the programs. Application availability implies that not only should

data, software, and hardware be in place and properly configured, but also be accessible.

Very often, planning for security concentrates so much on preventing improper access that

proper access is frustrated and in some cases, incorrectly denied.

12
Chapter 3

User Issues

Organizations are entering an age in which every member of the organization may

become a computer user. This trend started as mainframes and minicomputers began

to be accessed interactively. But, because mainframes are so costly, interactive access has

been available to only a limited number of users. On the other hand, microcomputers have

greatly expanded both the quality and quantity of interactive computer usage. The low

cost of the microcomputer system and the high quality of a microcomputer's interactive

software, has attracted many new users who were never able to use computers before,

either because of the mainframe's limited capacity or its difficulty of use. Organizations,

through their use of microcomputers, face an influx of new computer users. Computer literacy has increased greatly during the last few years. However, for many

in an organization, the poorly planned introduction of microcomputers into the working

environment can cause both acute and chronic future shock. An organization should take

advantage of the interest in microcomputers by some users, but should take care with those

who may feel threatened.

Although some users may be slow in embracing microcomputer technology, an organization should find that their users quickly learn the new capabilities. In fact, the organization

should find that most users rapidly become sophisticated in their use of microcomputers.

This increasing sophistication typically leads to greater expectations. Greater expectations

may increase the demand for applications to be implemented on microcomputers.

Most organizations who already use computers have a large backlog of applications

waiting to be implemented. Most of the application backlog is caused by a shortage of the

people needed to implement the applications. On the one hand, there is the increasing

computer literacy of users, who can reduce the application backlog by implementing applications. On the other hand, increasing computer literacy creates demand for applications

which adds to the application backlog. It is not clear that the use of microcomputers and

the influx of new users will help an organization reduce its application backlog in the long

run.Nevertheless, it is clear that most organizations find it necessary to provide increasing

support for the growing number of users. The nature of the support and the organization

13
of user support is discussed more fully in a separate chapter.

A microcomputer can be used almost anywhere. In particular, microcomputer users need not be in their offices to use a system, but can be at home. Many organizations

keep a supply of portable microcomputer systems which a user can take home. The

practice of computer users working at home began with the interactive use of mainframes.

Accessing a mainframe from a user's home requires a terminal, a modem, and a telephone

line. A microcomputer can be used in a user's home on a standalone basis. Although a communications link may be desirable for microcomputer users at home, it is not necessary.

Work produced at home on the microcomputer can be hand-carried to the office. While

microcomputer technology permits a user to work at home, there are many factors, such

as, the nature of the application, the attitude of the user, and organizaional rules which

must be considered before this practice is adopted.

The use of an organization's microcomputer systems for purposes other than work

authorized by the organization is a user issue regardless of where the user is located. With

mainframes, accounting logs and audit trails can be used to determine who is using a system and for what purpose. With microcomputers, applications may be carried to the

systems and removed with little capability of detecting how the system was used. It is not uncommon for many microcomputer systems to be idle during regular business hours

and thus, be available for private or recreational uses. An organization can often deal

with this problem in the same manner that it protects its other office equipment, such as, typewriters and copiers, from private use. Providing users with microcomputer systems usually means much more than simply

providing hardware and software. To successfully introduce micocomputers into a workplace, planning must include the physical design of the work area. Adequate space, light,

ventilation, heating and air conditioning must be supplied. Several microcomputers in a room can impact the ventilation, air conditioning, and noise level of the room. Electrical outlets and/or electrical capacity may need to be increased. Furniture should provide

enough workspace for both the microcomputer and the user. Additional space is needed

for the storage of supplies, such as, diskettes, printer paper, and ribbons. If microcomputers are to communicate, the installation of network cables and/or telephone lines may be

required.

3.1 Basic User Skills

A microcomputer user needs a more thorough understanding of the system than the

typical mainframe user. Beyond knowing how to submit batch jobs to an operator or how to turn a terminal on and off, the mainframe user usually needs to know little else

concerning the care and operation of the system. Services, such as, file backups, booting

system software, installing software packages, and connecting peripherals, are provided

by the operations staff of the computer center. In many cases, the microcomputer user performs these functions. Among the things that all microcomputer users need to know

are:

14
• System startup and shutdown

Unlike mainframes, most microcomputers are not left on all the time. The user must know how to start the system and how to shut it down. This may include

following an ordered sequence of steps to: apply or remove power to the main chassis

and peripherals, insert or remove storage media, and/or enter commands to start or stop the software system. While many microcomputers can be started or stopped by

toggling a power switch like a terminal, many cannot.

• Media handling and storage

Microcomputer users must know how to grasp storage media, insert and remove

storage media from a peripheral, and how to store the media so as not to damage

the information contained on the media.

• Care of microcomputer hardware

Microcomputer users must understand how to take proper care of the system

hardware. This includes such things as maintaining adequate open space around

cooling fans to prevent overheating, insuring that persons or objects do not get

caught in the cabling, preventing hard disks from being jarred, and protecting the

phosphorus of displays from burn-in by either dimming or turning off the display

when not in use.

Some users may also need to know such things as:

• System and information security procedures

When many users access a single microcomputer which has few integrity protection mechanisms, such as file protection, it is necessary for the users to understand

the procedures to be followed in order not to destroy the data and programs of other

users, or compromise data confidentiality. When a user is finished using a system,

he should know how to leave the hardware and software configured so that the next

user is confronted by a known configuration. A user should also know how to archive

data and programs.

• Installation and maintenance procedures

Many microcomputer users may perform hardware and/or software installation

and maintenance. When installing or updating software packages, users should know

how to apply proper backup procedures in the event of catastrophic failure during

the software installation or update. Software maintenance also includes configuring software according to the hardware configuration and maintaining adequate free

space on mass storage in order for some software packages to function. Installing

new hardware components or modifying the hardware configuration is a common

practice among microcomputer users. Such users should know the basic procedures

which apply to all hardware modifications, such as, removing power when inserting

15
or removing boards or chips, and orienting the boards, chips, or cables correctly

when they are inserted into their receptacles.

3.2 Classification of Users

Users can be grouped into three broad categories.

• ADP professionals

ADP professionals are those users whose major job function is to implement

systems or applications on computer systems. They may or may not have formal

education in information systems, computer science, or computer engineering.

• End users who program

This category consists of experienced and sophisticated end users. Their major

job function and formal education is in an application area, such as finance, ac- counting, or a physical science. They may have some formal training in computer

technology. Although not necessarily their major job function, these end users implement applications software in the area of their expertise.

• End users who operate

This category of user is made up of end users who have less experience in the use

of computers. The major job function of end users who operate is in an applications

area. These users do not implement applications on microcomputers; but rather, uses the computer implementations of others in the performance of their job.

Because of the varying needs of the different types of users, an organization should try

to tailor the microcomputer systems to the specific requirements of a user. Menu driven

systems, which often prevent the user from accessing the more general capabilities of a system, are typically the choice for end users who operate. On the other hand, menu

driven systems which limit access usually cannot meet the needs of a more experienced

user. The practice of customizing the microcomputer system to a user usually becomes

an ongoing activity since it often happens that a user moves from one category of user to

another.

3.3 Application Development

The concept of application development is taking on new meaning with the availability of both microcomputers and powerful software packages. Applications are no longer

developed solely by ADP professionals using algorithmic language based development techniques. The creation and validation of a financial model using a spreadsheet has all of the

elements of traditional application development.

16
The all-inclusive term software package refers to both turnkey packages (i.e., packages

which users simply operate) and software packages, such as spreadsheets and database

management systems, which are tools to support high productivity application development. This section addresses the broader concept of application development by both ADP

professionals and end users, and their use of software packages to support application development.

Because of the high cost of application development, it is always better to minimize application development activities. Assuming the requirements of an application are met, it

is preferable to use a turnkey package in an application rather than develop anew. Should

some application development be necessary, it is preferable to use use high productivity

application development tools rather than algorithmic languages. Because of the large

market for software packages created by the popularity of microcomputers, the number

and variety of software packages is greater than ever before. Consequently, a large number of applications may be implemented on microcomputers with little or no application

development.

However, the use of microcomputers can increase the total amount of application development activity within an organization. Moreover, the manner in which applications

are developed can be significantly different from the manner in which applications are developed in a mainframe environment. There are several factors which can cause this

phenomenom.

• Increased capacity of computing resources Microcomputers are a low cost means of increasing the overall capacity of the

computing resources in an organization. In a mainframe environment, computing

capacity is very often strained by the needs of the production workload with very

little left over for application development. On the other hand, a microcomputer can

have more idle CPU capacity than used CPU capacity. The computing capacity for

application development using sophisticated application development techniques can

be made available with microcomputers.

• Increased capabilities of application development tools

Because of the increase in the overall computing capacity of computing resources

afforded by microcomputers, the capabilities of the available application development tools has increased. Advanced application development tools such as syntax

directed editors, interactive debuggers with graphics displays of the line-by-line and

procedure call activity of a running program, multi-window interactive development

environments, and fourth generation languages are becoming commonplace. These

application development tools facilitate the development of applications in a shorter

period of time. The resultant applications are more complex, of higher quality, and

more reliable.

17
• Increased sophistication of end users The easy access to the increased capacity provided by microcomputers, along

with the enthusiasm of end users for microcomputers, can cause naive users to become sophisticated users in a brief period of time. End users may begin to create

and implement their own applications. The growth in end user sophistication is an

ongoing process.

3.3.1 Changing Nature of Development Activity

The factors mentioned above can increase the application development activity in an

organization. Application development is no longer concentrated within traditional application development groups. All aspects of application development and maintenance,

such as, the managers, the developers, and the computing resources used, tend to become

distributed administratively and physically throughout an organization. This distribution

of application development activities happens not only with the aggregate of all application development activities in an organization, but can also happen with an individual

application development project.

Application development may be distributed across computer systems. In the traditional software development environment, several programmers coded and debugged new

applications on a mainframe. The microcomputer permits another approach to application development. By using standard languages, portable programs can be developed on

microcomputers. Each programmer produces his portion of the project on a microcomputer with the final integration and testing of the application on the mainframe. Some

mainframe applications may be small enough to be developed and tested entirely on a microcomputer.

While some applications run exclusively on a mainframe, most applications run partly

on the mainframe and partly on the microcomputer. Consequently, a significant aspect of

most applications is the implementation of micro-mainframe communications tailored to

the needs of the application.

In addition to the distribution of computing resources used for application development,

the responsibilities for the implementation of the various phases of the application life cycle is often distributed among several groups in an organization. The central application

development group continues to be the focus of most development activities. However,

many user departments are forming development groups made up of bcth professional

programmers and user programmers. These user department groups often participate in

the development of large projects.

For example, requirements analysis may be done by the user department who will use

the application. Design, coding, and testing for those portions of the application to run on the mainframe may be done by an applications development group. At the same time,

the design, coding, and testing of those portions to run on microcomputers may be done

by the user department. Maintenance may be done in the computer center.

In the example, both the managers and the implementors of the project were distributed

18
among several groups. It is very often the case that the programming languages and tools

used in the development of an application differ among the groups involved in the development. For example, the application development group may use high level algorithmic

languages such as FORTRAN and COBOL to implement their parts of the application

on the mainframe. On the other hand, the users may use fourth generation languages

to implement their parts on the microcomputers. Users who program tend to use such

high productivity tools as fourth generation languages, program generators, and database

query languages. With an increasing use of microcomputers, there is usually an increasing

demand on the part of users for such high productivity application development tools.

Because of the more distributed nature of application development activities, there is a

greater need for communication, coordination, and cooperation between the various groups

and individuals doing development. There is a greater need on the part of mangagement

to be aware of this distribution of development activities and responsibilities. The central

application development group is no longer the sole source for all development resources.

3.3.2 Potential Problems

The increase in application development activity, especially on the part of end users and the changing nature of application development can cause several problems.

• Lack of standardization of high productivity tools

In the traditional application development environment, it is good practice to

evaluate the transportablility requirements of an application during the application's

requirements specification. Standard algorithmic languages are often used to meet

the requirement that an application be transported between mainframes of different

producers. The technology of high productivity tools has yet to mature to the point

where a significant level of standardization can be achieved. Consequently, it may

be very difficult to transport those applications implemented using high productivity

techniques between computer systems.

• High productivity techniques require more computer resources As the users' demand for high productivity applications development tools increases, the need for additional computer capacity required by these tools increases.

High productivity tools produce heavy demands on CPU and disk resources. Moreover, many tools require high resolution graphics displays, both black-and-white and

color. Such graphics displays can also drain communications capacity.

• Distribution and maintenance of end user software

End users often produce software solely to enhance their own productivity and

are not responsible for either the distribution or maintenance of the software. These

end user applications are often useful to many groups in an organization. Such useful

software should be documented, maintained, and included in a software inventory

for distribution.

19
Despite the changing nature of application development, the changing roles of the users who develop the applications, and the changing technology on which and with which the

applications are built, the basic nature of the application development life cycle and the

principles of information management seem to remain the same. It is therefore necessary

for an organization to apply these principles to the resources at their disposal.

20
Chapter 4

Management/Support Groups

Throughout the discussions of the issues related to the impact of microcomputers on

organizations, there are the common themes of more and different. As microcomputers

become a significant part of the information resources, there is more information, a larger user community, and more technology to be managed and supported. The organization

that has experience with computer-based information systems should discover that the

information kept on microcomputers, the microcomputer users, and microcomputer technology have characteristics different from the characteristics of the information, users, and

technology associated with mainframes or minicomputers.

4.1 Organizational Structure

An organization may respond to this situation by modifying its management services

and support structures. There are two basic ways of accomplishing this; modify existing

structures or create new ones. Traditional mainframe management policy and support

structures can be described as consisting of four functional groups:

• The Information Resource Management Group

This group is usually located at the highest level of the organization's management and is responsible for the overall coordination of information resources throughout the organization.

• The Computer Center

The Computer Center(s) may be located anywhere within the hierarchy of an

organization and is responsible for the operation of large computer systems. It is usually made up of several subgroups, such as, computer operation, systems programming, and user services.

21
• The Application Development Group

These groups may also be located anywhere within the hierarchy of an organization and are responsible for developing and maintaining the applications specific to an organization.

• The Information Center

This group is typically located at a high level of management and is responsible

for providing services directly to end users. While some of the services may be similar

to those provided by the user services group, the services of the Information Center

are greatly expanded and may be tailored to end users' application areas.

The advantage of integrating microcomputer management/support services into existing structures is that there is usually much ADP experience and much knowledge of the

ADP problems of the organization concentrated within existing structures. This experience

is a valuable resource when microcomputers are brought into an organization.

However, many existing support/policy structures are already overwhelmed with re- sponsibility and may not be either able or inclined to undertake the effort required to

apply microcomputer technology. This may be particularly true for the Computer Center

and Application Development Groups since they are usually responsible for specific hardware and software systems. On the other hand, the Information Resource Management

Group and the Information Center may deal with an organization's information and applications on a more conceptual level, and may be better able to provide the additional

management/support services for microcomputer systems and their users. For many organizations, the creation of new management/support groups happened

virtually spontaneously. Because of the low cost of microcomputer systems, departments

and operational units within an organization were able to use microcomputers without

the approval or notice of upper management. As the number of systems increased, intradepartmental and inter-departmental user groups were formed. When these microcomputer activities became known to upper management, not only were the systems in place,

but also the nucleus of new management /support groups were in operation. For example, the creation of local support personnel or user coordinators evolved from the pool of users who gained microcomputer expertise. These individuals provide support to their

organizations and act as liasons to other support groups.

Additional management/support services are required if an organization is to benefit

from the use of microcomputer technology. How these services are fit into the structure of an organization seems less important than inclusion of provisions for additional

management/support services in the overall plan for integrating microcomputers into the

information resources of an organization.

4.2 Management/Support Services

There are many management/support services which can be provided. Most organiza22
tions are already providing such services in some form. The management/support services

listed are grouped into three general classes: those services which promote information

management, those services which promote the users' efficient use of information technology, and those services which promote the effective management of the technology.

4.2.1 For the Information

These management/support services focus on the information, i.e., the data and procedures, which an organization uses to conduct its business.

• Naming and organization conventions

For most organizations, it is necessary to develop and maintain information

naming and organization conventions. Such conventions help minimize data re- dundancy. Conventions are necessary for the viability of most other information

management/support services.

• Library services

With the use of microcomputers comes a large increase in the production of data

and software by end users. A library of existing data and procedures helps to prevent

the duplication of efforts, i.e., the regeneration of existing data or the redevelopment

of existing programs.

• Security

One of the most important management/support services is the development and

maintenance of practices which insure the confidentiality of information where re- quired and minimizes the loss of information from deliberate and accidental causes. An important aspect of assuring integrity is to insure that information, which becomes distributed throughout an organization, is both consistent and accurate.

• Collection and retention

One of the problems which can result from the widespread use of microcomputers

is a large increase in the volume of information. Good information management

requires that there should be a reason for the collection of new information. In

addition, procedures may be needed to identify information lifetimes and insure that

information which has exceeded its lifetime is not retained.

• Critical data custodianship

An organization may find it necessary to centralize the custodianship of data

which the organization considers critical to its functioning. In particular, the input

and modification of critical data may need to be entrusted to individual groups.

Particular segments of this information can be made accessible, with restrictions

(e.g., read-only), for other groups in the organization.

23
4.2.2 For the Users

Management/support services which focus on users include the following:

• Education

Perhaps the most important service to the user is training. This may consist

of organized classes and/or on-the-job training. Many organizations set up a microcomputer demonstration facility in which individuals can come for a hands-on

introduction to microcomputer technology.

• System selection

This service helps insure that the end user chooses the system which will meet his

needs. This process includes help in defining requirements, selecting the applications

software, and selecting and configuring the hardware. The user can be made aware of

the current marketplace situation, and of standards beyond those adopted in-house

which may aff"ect his application.

• Application development

Application development services can range from informal consultation to the tra- ditional application development activity, i.e., a complete implementation of a user's

application. With microcomputers, application development includes such things

as custom ROMs, intelligent interfaces, and procedures written in the specialized

languages associated with application packages.

• User Group support

Microcomputer users are often enthusiastic about their systems. In most cases, user groups are a means whereby microcomputer users may provide many support

services to each other in a friendly atmosphere. By permitting and supporting microcomputer user groups, an organization may reduce the cost of providing some

direct support services since the user group provides them.

• Hotline assistance

One of the most valuable services for a user is to be able to have immediate access to a knowledgeable person when a problem arises. Such immediate access can be provided

by a telephone hotline. A user who has quick access to someone who can help is less

likely to damage the microcomputer system and/or the information contained on the

system.

4.2.3 For the Technology

Services which help manage and support the microcomputer system components include

the following:

24
• In-house standards development

The development of in-house standards is an important aspect of the management

of microcomputers. In order to provide this service it is necessary to be aware of

both the application requirements of an organization and the defacto standards of

the marketplace.

• Product evaluation

Exhaustive product evaluation can be an important support service. A determination can be made of the effectiveness of a microcomputer system hardware and/or

software component across a wide range of applications. Future directions in the

microcomputer marketplace and technology can be monitored.

• Installation and maintenance

Support groups may perform installation and maintenance of systems, or monitor

the performance of these services by contractors and computer stores.

• Acquisition

Discounts can be obtained on microcomputer system components purchased in

volume. A storeroom of microcomputer components can be maintained.

4.3 Acquisition

The amount of money spent on microcomputer systems continues to increase. To maximize the benefits and minimize the cost of acquiring these systems, it becomes necessary

to have an acquisition plan in place. The implementation of such a plan would enable an

organization to:

• take advantage of the economies of quantity purchasing

• plan and develop appropriate support structures

• insure compatibility with existing systems and applications

• maintain consistency with current policies and strategic goals

There is no single, best way to acquire a microcomputer system. An organization's

needs and style of management are key factors in the determination of an optimum acquisition strategy. Each organization should examine the role and responsibilities of the end

user, functional manager, systems staff, and organization's information resource management group with respect to the acquisition policy development and process.

25
4.3.1 Procurement Roles and Responsibilities

Traditionally, the acquisition of a computer system is performed by a central computer

systems staff. Due to the low cost of single microcomputer systems and their widespread

use, this approach to acquisition is no longer the only choice. End user computing has made

it feasible and often desirable for the end user to define his requirements and actively participate in the procurement activity. The roles and responsibilities within an organization can be assigned to either a central group or distributed throughout the organization.

For example, using technical assessments provided by the systems support staff,

the end user identifies the microcomputer system to be acquired and prepares

a justification. The functional manager reviews the request with respect to

current budget and programmatic activities. Higher level management coor- dinates and consolidates all microcomputer requests and ensures consistency

with organizational policies. Finally, the procuring activity arranges volume

discounts wherever possible and negotiates the purchase.

Organizations should be careful to assure that assigned responsibilities are clearly designated and adequately address government or organizational acquisition policies, budget

and programmatic priorities, compatibility with existing systems, microcomputer technical

aspects, and the user application/problem.

4.3.2 Justification

A request for a microcomputer system or product may be accompanied by a justification statement. The amount of documentation required for the justification can vary.

Often the criteria for determining this level of justification is based on system type, cost, or application. System type refers to the specification of a particular model or version

of hardware and/or software. A minimum justification could be required for any product

chosen from a pre-established standard set of microcomputer products, whereas detailed

justifications and waivers could be required for any request not compliant with the standards. System cost refers to the purchase price of the microcomputer system or products.

The level of justification usually depends on the cost amount of the system; the greater the

cost, the more detail the justification. System application is the way in which the microcomputer system will be used. If a microcomputer will be used as a general productivity

tool, only a brief justification statement may be needed. Microcomputers that are to be

an integrated part of a larger system would require an in-depth justification describing the

relationship and impact of the microcomputer with the larger system. (Table 1 outlines

these criteria and levels).

Justification procedures can be prescribed in the acquisition policy and can include not

only the amount of documentation required, but the type of documentation. Justification

statements may:

26
clearly specify the proposed microcomputer product, indicating how it will be used,

the benefits provided by its use, and the features required to satisfy application

requirements (e.g., specific technical capabilities, minimum configurations, or compatibility with existing products)

provide evidence of the proposed product's technical feasibility, soundness, and timeliness of implementation

identify and explain why alternative products are not appropriate

describe any planned telecommunication interfaces and/or integration with other

systems. Indicate required compatibilities, special needs, and expected impact to

the other systems

describe possibilities for future expansion or upgrade capability with respect to

prospective activities and/or the rapidly changing microcomputer technology

state costs and where applicable, include life cycle costs such as development, installation, training, and maintenance. If possible include comparative costs of alternative

products and/or producers.

27
Minimum

Justification

Detailed

Justification

System Type if in-house

"standard"

if not in-house

"standard"

System Cost

if below

$ threshold

if above

$ threshold

System

Application

if general

productivity

tool

if integrated

into larger

system

SUMMARY OF JUSTIFICATION LEVELS

Table 1

28
Chapter 5

Technology Issues

5.1 In-house Standards

As part of the planning process, an organization should consider carefully the adoption

of in-house standards for microcomputers. Recall the comparisons of the management

structure for mainframes as opposed to microcomputers. Similar comparisons apply to

in-house standards.

Just as management style is dictated by an organization's use of a mainframe, many

in-house standards are also determined by the use of a mainframe. A particular large

mainframe may dictate the nature of communications, the operating system, the terminals,

the programming languages, the application programs, etc. that all will use. In some cases, these standards were never planned.

In the case of microcomputers, in-house standards can be chosen based on the needs

of the organization and consistent with widely accepted standards. On the other hand, an

organization may choose to have no in-house standards.

The method of choosing standards is similar to choosing a single computer system.

With a single system, the process consists of determining the application requirements,

and then selecting the software and hardware which can meet those requirements. When

choosing in-house standards, the organization must first determine its requirements, and

then choose a set of standards which can fully satisfy those requirements. Since it is usually

impossible to satisfy all requirements with one set of standards, it is not unusual for an

organization to have several systems which do not conform to all of the standards.

An important consideration in choosing in-house standards is their conformance to

standards established by accepted standards making groups, such as, ANSI, IEEE, and

ISO. In the Federal Government, FIPS standards and guidelines have been issued for ADP

equipment including microcomputers. Whenever possible, these standards should be used

as in-house standards. However, because microcomputer technology has only recently

emerged and is continuing to change rapidly, there are many aspects of microcomputer

technology which are not addressed in formal standards.

In the absence of established national standards, an organization should give serious

29
consideration to choosing in-house standards which conform to defacto standards (i.e.,

standards determined by their widespread support by many users and producers). However, it should be realized that defacto standards are determined in the marketplace. They

can be less precisely specified and more short-lived than national standards developed by a

well established process of insuring consensus on a well defined specification among many

users and producers.

The in-house standards chosen should be specified precisely enough so that the re- quirement that is to be met by the standard will be realized. For example, if an operating

system is chosen as a standard in order to facilitate the development of communications

software to link all of the systems together, then it may be necessary to specify the version

of the operating system as part of the standard in order to realize the requirement of

compatible communications software.

The set of standards which can be adopted by an organization can take many forms.

For example, an organization may choose to adopt only a set of communications standards.

Their requirements are such that it does not matter what microcomputer system is chosen

for an application as long as it is able to communicate with the other systems. On the other

hand, an organization's requirement may only be met by completely specifying applications

software, operating system, and hardware. In-house standards will only be successful if consistent with the needs of the organization.

Not only can an organization determine how extensive their standards for microcomputers should be, but it may also choose to have no in-house standards at all. An organization

may decide that it needs to gain more experience with microcomputers before it is able to

determine its requirements and in-house standards.

The hasty adoption of standards before experience is gained and proper planning is performed may frustrate the learning process and eliminate many potential applications

for microcomputers. For example, a specific single-user operating system is adopted as the

standard operating system for all microcomputer systems. A group in the organization

has a requirement for electronic mail between the individuals located in several adjacent

offices. No microcomputer system using the single-user operating system is able to meet

this requirement. Thus the electronic mail application is deemed inappropriate for microcomputers. However, there are several microcomputer systems available which can meet

this requirement if running a multi-user system. Thus, an opportunity for an effective use

of a microcomputer has been missed.

The situation in the example might have occurred even after reasonable planning activity had taken place. The selection of a single-user operating system as a standard for all microcomputer systems would have covered most applications suitable for microcomputers

a year ago. However, as a result of the ever decreasing cost of microcomputer hardware,

multi-user systems are becoming more widely available and the number of applications

suitable for multi-user microcomputers is increasing.

Because the microcomputer marketplace changes so rapidly, the planning and standards

making process must be ongoing. This is in sharp contrast to the planning activities of

some organizations with respect to mainframes. During a mainframe acquisition phase,

30
the planning activity is intense, but once the system is in place, the planning activity may

cease as a result of the realization that not much will change during the several year life- cycle of the mainframe. The cessation of planning and standards making activity for any

information resource is undesirable. When the information resources are microcomputers,

the absence of ongoing planning can have serious consequences.

Our experience has been that microcomputer support and standards making responsibility has been distributed throughout the organization. For example, the mainframe

support group, located at the topmost level of the organization, may determine a communications standard to allow access to the mainframe. Several microcomputer support

groups, each located at a level in the organization responsible for a specific mission, may

determine microcomputer standards appropriate for their departments. It can easily happen that a microcomputer support group might set a different communications standard

for communicating between its department's systems, while also supporting the communications standard to the mainframe. A department may have no need to communicate

with other projects in the organization except through the mainframe.

5.1.1 Advantages of In-house Standards

The advantages which can be realized from in-house standards can be grouped into two

broad catagories, namely, central support and compatibility. In-house standards make it possible for a group, or several groups, which may be at any level in an organization, to

provide services to end users. In-house standards also make it possible for microcomputer

users to share components, programs, and data.

Central Support

There are many services which a microcomputer support group can provide. In-house

standards can be chosen in such a manner as to minimize the cost of supporting the

microcomputer hardware/software systems. In general, the fewer system components, the

less costly the support. On the other hand, the fewer the system components, the narrower

the range of applications which can be implemented. A discussion of the kinds of support

services which can be provided is included in Chapter 4.

Compatibility

Even if central support is not provided at any level in the organization, in-house

standards can achieve any desired level of compatibility between microcomputer systems.

Among the levels of compatibility are:

• Media compatibility

Floppy diskettes, hard disk packs, tapes, and tape cartridges are compatible in

that they can be physically exchanged between systems. In addition to having the

same physical dimensions, media compatibility typically implies the same information

31
format at the lowest level. For example, two floppy diskettes may have the same

physical dimensions, but may have a difi'erent number of cylinders and/or sectors

per cylinder. Media compatibility usually does not imply that the structure of the

data files on the media are the same.

Communications compatibility

Compatibility in communications implies that the systems will be able to transfer

data by means of a communications link such as telephone network or local area network. Just as with media compatibility, this level of compatibility may only refer

to the reliable movement of bytes. However, communications compatibility may also

imply that information will be structured in a manner suitable for the receiving

application or operating system software.

Compatibility of hardware components

This level of compatibility makes system maintenance easier by permitting the

interchangeability of hardware components. With microcomputers, there may be

neither maintenance contracts nor maintenace personnel. Some systems are designed

to permit the end user to perform hardware diagnosis and replacement of defective

components.

File structure compatibility

This refers to the ability to exchange a data file, i.e. data structured in a specific manner, between microcomputer systems. This level of compatibility normally

requires that two systems have the same operating system software or have utility

programs which will translate one file structure to another.

Application package compatibility

This compatibility level permits data to be exchanged between applications packages. For example, file structure compatibility may guarantee that a text file can be moved between two systems, but the text may be in the wrong form when a different word processor is invoked. Many applications packages can produce standard

formats for exchanging data between itself and other applications packages.

System compatibility

Because microcomputers have relatively simple system hardware and software

architectures compared to mainframes, it is easy for one producer to produce a clone

of another producer's system. If X is a microcomputer system which is selling well,

then it is common to find microcomputer systems in the marketplace which are Xcompatible or X.- equivalent. The system compatibility level means that one hardware

system is identical to another even though the two systems are from difi'erent producers. Diskettes containing operating systems software and/or applications packages

may be exchanged between compatible systems and the software runs properly. Even

32
hardware boards may be exchanged between compatible systems. Although system

compatibility is theoretically possible, it is most often the ca^e that an ^-compatible

system is different in some way from X.

When setting an in-house standard to achieve compatibility, first determine the level of

compatibility to be achieved by the standard. Then specify the standard precisely enough

that the required compatibility is realized. For example, standardizing on 5 1/4 inch floppy

diskettes permits compatibility at the media level. However, it may be necessary to specify

5 1/4 inch soft-sectored floppy diskettes since, although the diskette may be inserted into

the drive, the extra holes in a hard-sectored diskette may prevent the drive from being

able to access the media.

One approach to setting an in-house standard for the system level might be to specify

that a microcomputer system be compatible to a system which is a standard in the marketplace. Since the system compatibility level implies many other levels of compatibility, the

specification of the standard is simplified. However, the validation of compatibility at the

system level is complicated because true system compatibility is rare. When validating at the system level, it is useful to assemble a collection of diagnostics, operating systems software, applications packages, and hardware components to test the degree of compatibility.

Such hardware and software components may include components developed in-house.

Compatibility allows the easy interchange of programs, data, and components. In

addition, with or without a support group, the level of expertise in the user community

will be enhanced if all users are working with the same equipment. Questions and problems

can be resolved by asking a neighbor. New users will become more proficient more rapidly

in such an environment.

Moreover, end users may perform some amount of hardware maintenance, and learn to

program in the command languages of the applications packages. Programs written in these

languages can be implemented within and distributed throughout the user community.

5.1.2 Disadvantages of In-house Standards

There are several disadvantages to in-house standards for microcomputers:

Rapid Pace of Microcomputer Technology

Today's microcomputers may be well on the way to obsolescence in two years. This

means that the organizational mechanisms for microcomputer planning, support, and standards must be flexible. In-house standards can frustrate the ability of an organization to

respond to a changing marketplace. Since in-house standards will normally be closely re- lated to the defacto standards of a changing marketplace, the organization will have to

overcome the inertia of supporting a standard which is no longer relevent, and be able to

devise means for a transition to the new standards. The penalty for failing to make this

transition will be an inventory of obsolete equipment which is incompatible with equipment

dominant in the marketplace.

33
Inability to Meet All Applications Requirements

A very common occurrence is for an organization to set standards and discover an

application requirement which cannot be met by a system which meets the standard.

For example, a particular word processing package might be chosen as a standard. It is then discovered that the legal department is unable to use the standard word processing

package because it cannot paginate for legal size paper. Another word processing package

is available which will meet the requirement but is much more expensive, and would be

costly to standardize organization-wide.

Inability to Meet New Application Requirements

This is intimately related to the rapid pace of microcomputer technology. As the technology becomes cheaper and innovations are made, new application requirements begin to

appear. The systems which meet the in-house standards can become increasingly unable

to meet the new requirements. Parallel with changing requirements, the dominant systems

in the marketplace become those systems which can meet the new requirements. Consequently, the standards of the marketplace can move away from an organization's in-house

standards. The problems of changing technology, changing marketplace, and changing

application requirements are discussed more fully in another chapter.

Inhibition of Innovation

This is an unfortunate side-effect of all standards, including in-house standards. The

existence of a standard may inhibit the exploration of new approaches because a standard

may be interpreted by end users and support groups as the correct and best way to do

things. Moreover, innovative individuals may not be able to pursue an idea because of

the inherent inertia of a standard. In addition to meeting a requirement in terms of

central support or compatibility, a standard should probably not be adopted until it can

be justified as a correct and good solution. Adopting standards without sound technical

justification may lead to inefficient solutions and missed opportunities for better solutions.

5.2 Managing Technological Change

One of the most difficult problems in managing microcomputers is the rapid pace

of the technology. Whereas mainframe or minicomputer producers typically halve the

price/performance ratio of their systems every four years, microcomputer producers halve

the price/performance ration of their systems every two years. All indications are that

this pace in microcomputer technology will continue at least until the end of the century.

One of the effects of this rate of change of the technology is the creation of demand

for more capability in microcomputer systems. The net result of this creation of demand

is a rapidly changing perception of what is required in a microcomputer system. Thus, to

34
speak of the rapid pace of the technology is to speak of rapidly changing microcomputer

system application requirements.

One good example of this phenomenon involves the spreadsheet processor. When the

dominant microcomputer technology changed from systems which had a maximum memory

capacity of 64K bytes to systems which had memory capacities of several times that, the

capacity of the spreadsheets increased accordingly. The newer technology was quickly

embraced and larger memory sizes for spreadsheets quickly became a requirement. To say,

"as long as the system meets the needs, why should it be replaced?," is simply delaying

the inevitable. When newer systems come into widespread use, the requirement for their

capabilities will become very real. Before there were spreadsheet processors, no one ever had a requirement for one. More pointedly, before there were microcomputers no one had

a requirement for one. Throughout the thirty year history of computing, demand has

always exceeded capacity, and where any excess capacity has appeared, it has been quickly

utilized.

In some cases, it is possible to anticipate the nature of new demands that will be placed

on microcomputer systems. As microcomputers became widely used, it was clear that there

was a need for methods of transferring data between the microcomputer software packages

of different producers. It was also clear that there was a need for methods of transferring

data between microcomputer software packages and mainframe software packages. Well

within the existing technology, the implementation of these capabilities, in the form of

integrated packages on the microcomputer and the integration of software packages on the

microcomputer with software packages on the mainframe through data communications,

came about as a result of demand from the user community.

On the other hand, innovations on the part of those bringing microcomputer products

to the marketplace create a demand for new capabilities which were unanticipated. As

mentioned above, the spreadsheet processor has become the classic example of an unanticipated technology, which became a requirement in any microcomputer system used in an

administrative/management application. A more recent example of unanticipated technology is the multi-window integrated environment, which permit users to design their

displays according to the needs of their current interactive activity.

In a microcomputer environment, dependence on a single producer for hardware and/or

software usually does not allow an organization to gain the maximum benefits from the

technology. The marketplace for both microcomputer hardware and microcomputer software is fragmented among many producers, both large and small. In addition, the dominant producers change over time.

When a large corporation enters the marketplace and achieves a certain level of prominence, it is tempting to accept this prominence as permanent. However, a permanent

prominence in the marketplace has not been part of the history of the microcomputer

marketplace. Instead, innovative, small companies become prominent, even dominant,

and large corporations, experienced in the technology, continue to enter the marketplace

with potentially innovative products.

35
5.2.1 Phasing in Systems Over Time

The methods of acquiring mainframes may not apply to acquiring microcomputers.

Acquiring a mainframe involves a large economic commitment made at one time. Microcomputers can be added to the organization in an incremental manner. To acquire large

numbers of the same microcomputer systems at one time increases the risk that the total

investment will not be able to meet new requirements. This approach has the advantage

of allowing an organization, which is unfamiliar with the use of microcomputers, to get a better feel for how the technology fits their applications. However, there is the disadvantage that many in the organization will not have their needs met until the phasing in

procedure reaches their application.

5.2.2 Acquiring Leading Edge Technology

Whenever new microcomputer systems are acquired, it is advantageous to obtain systems which are representative of the leading edge of technology, rather than the trailing

edge. Since microcomputer systems have approximately a two year life-cycle as the current

technology, it maximizes investment by acquiring systems toward the beginning of their

two year life-cycle. This is not to say that an organization should acquire experimental

systems for operational use. The concept is twofold. Insuring that the systems acquired

have demonstrated, yet innovative effectiveness for the applications in which the systems

will be used, and insuring that the systems acquired are not made obsolete in six months

by the arrival of new products.

One of the difficulties of understanding the microcomputer marketplace is determining

when a product actually exists. Because the market is so highly competitive among many

producers and because the producers strive so hard to establish and maintain market share,

product announcements can be made many months before shipping and products can be

absent from store shelves several months past announced shipping dates. Producers may

also distribute alpha and beta test versions of products to almost anyone. A definition of

product existence consistent across producers, such as, its in-stock availability from a local

computer store, should be used to determine what constitutes current technology.

The technique of acquiring on the leading edge fits well with the technique of phasing

in microcomputers over time. The use of both techniques insures that an organization

will have experience with both the systems reaching the end of their useful life, and the

systems just beginning their useful life.

5.2.3 Acquiring Systems from Several Producers

While the technique of acquiring microcomputers on the leading edge of technology can be applied to a single producer, the best application of the technique is to acquire

from any of those several producers whose systems make up a significant percentage of

the marketplace. It has never been the case that a single producer has a monopoly on the

leading edge of the technology.

36
However, it has been characteristic of the microcomputer marketplace that no single

producer is able to meet all of the requirements of a large organization. Thus, there are two advantages to this technique, better coverage of a large organizations' applications,

and better use of the technique of acquiring on the leading edge of technology. In addition,

by investing in several producers' equipment, an organization minimizes its dependence

on a producer who, while being prominent and having innovative, proven products, may

disappear from the marketplace as a result of financial failure.

The disadvantage of this technique is that an organization must support more than one system. This impacts all aspects of support, and in particular, may require the development of procedures to permit communication between dissimilar systems. However, in

some cases, the incompatibilities between systems from several producers may be small.

Incompatibilities between microcomputer systems from different producers are not comparable in scale to incompatibilities between mainframes from different producers. Operating system software, application packages, and even some hardware components are often

readily exchanged among microcomputer systems from different producers. In addition,

solutions to the problem of multi-producer inter-system communication can often be found

commercially and in the public domain.

5.2.4 Combining Approaches

In any large organization, there are groups in which there are ADP professionals and/or

end users who are particularly adept in their use of microcomputers. This skill may have

come about because these individuals have a special interest in microcomputers, and/or

because their applications are particularly suitable for microcomputer systems.

The individuals and applications in such groups can serve as testbeds for the leading

edge of microcomputer technology. These groups can have the freedom to acquire and use any hardware or software prominent in the marketplace. As the technology is matured and

integrated into existing systems by such groups, it can be brought into more widespread

use throughout the organization.

If an organization is sufficiently large, it may have a group whose sole purpose is to

research and evaluate the application of microcomputer technology to the problems of the

organization. Thus, an organization can maintain a constant influx of the latest technology,

incrementally adding to its computing resources, maximizing the benefits from the use of

the newer technology, and minimizing the risks of having a large inventory of obsolete

equipment.

37
Chapter 6

Microcomputers and Organizations

.. ' ('' Organizations have the opportunity to take advantage of the benefits which can be

gained by the use of microcomputer technology. However, the realization of these benefits

requires that the organization consider carefully how it will manage the integration of this

new technology into the performance of its mission.

Unfortunately, as yet no clear methodology has emerged from the collected experience

of those organizations which have undertaken the task. This situation is in contrast with

organizations' previous experience with computer systems. Mainframe computer systems

are such costly resources that their use must be managed at the topmost level of the

organization in a highly structured manner. The cost of a single microcomputer is small

enough to be within the purchasing authority of a first level manager. From a management

point of view, this implies that, whereas with mainframes, only a centralized management

approach is feasible, with microcomputers, any management approach is possible. Not

only is any management approach possible, but we have observed that the management of

microcomputers in an organization tends to conform to the overall management style of

the organization.

Does this imply that, in the management of microcomputers, an organization should

simply follow existing overall management approach? There are several reasons why the

answer to this question is "probably not."

Most organizations have diverse management styles among departments in the organization. Those microcomputer systems which are only used to support the functioning of an individual department may be better managed in the style appropriate for that department. In addition, most organizations have multiple missions. Some missions may require

that microcomputers become part of a larger system so that the microcomputer loses its identity as an individual system. The total cost of all the microcomputers in such a system can exceed that of a mainframe and may be better managed as a single system rather

than as a collection of individual microcomputers. On the other hand, some missions may

require several diverse microcomputers which do not make up a part of a larger system,

but are dedicated to the productivity of separate specialized efforts whose joint output

performs the mission. Such systems may be better managed as individual systems.

38
A microcomputer system consists of many components, e.g., CPU, memory, communications interfaces, operating systems, applications software, etc. Because there are often

many different producers for each class of components which make up a complete microcomputer system, it is possible to manage and support the use of microcomputers by

focusing on some of the components of a microcomputer rather than treating the microcomputer as a indivisible unit.

Because of the low cost of an individual microcomputer system, the top management

of an organization is able to choose how it will manage its use of microcomputers. It is able to choose the style of management, the level at which decisions are made, and to

which components those decisions apply. Organizations will make effective use of microcomputer technology only if they understand the implications of the decisions regarding

the management of microcomputers.

There are several organizational factors which can significantly affect the use of microcomputers in an organization.

6.1 Nature of Microcomputer Usage

The way in which a microcomputer will be used to support an organizational mission can be broken into two broad catagories. First, the microcomputer can provide direct

support by being an integrated part of a larger system which performs the mission. A

microcomputer used in this manner essentially loses its identity as an individual computer

system and is used solely for the direct support of a single mission. Secondly, a microcomputer can be used as indirect support for a single mission or several missions. In this case, the microcomputer can be considered as the general purpose productivity tool of an

individual or a group, and has a clear identity as an individual computer system.

Because of the possibly varied requirements of microcomputer systems used in direct

support of different missions, and those used as general purpose productivity tools, careful

planning is required to insure that all requirements are met.

6.2 Nature of an Organizational Mission

An organization may be responsible for the delivery of several products or services that

may vary widely even within a single organization. For example, an insurance company

sells insurance and settles claims with clients. This service is high volume, routine and

requires a rigid management structure to operate efficiently. However, this insurance

company may also have a group that performs statistical studies to update actuarial tables.

Such a group most likely would be managed in a less rigid style where responsibilities are more distributed and flexible. The service group would probably use large computer

systems including mainframes with large databases. The systems supporting the study

group would probably be more general purpose programmable systems which could respond

39
to the changing needs of the study group. Thus, the nature of an organizational mission can significantly influence how microcomputers are used in support of that mission.

6.3 ADP and End User Experience

In the example of the insurance company, not only is the nature of the misson an important aspect of planning for microcomputers, but also the end user's previous experience

with ADP equipment. For example, a microcomputer system to be used by someone with

no previous computer experience should be easy to learn. The end users in the group that

prepares the actuarial tables may have considerably more ADP experience than the end

users in the sales and claims group. Thus, the systems for the latter group may have to

be significantly more easy to learn and use than the systems for the former group.

Another important factor to be considered is the quality and depth of the overall ADP

experience already within the organization. This pool of ADP experience can come from

two sources, the established groups of ADP expertise associated with existing mainframe

and/or minicomputer systems, and the unofficial (and perhaps recently discovered) pockets

of microcomputer expertise which have arisen out of the need for end users to solve their

computing problems by using the new technology. Good planning for an organization's use of microcomputers will have input from both sources of expertise. In particular, these

groups will have to be brought together in order to achieve successful microcomputer to

mainframe communications.

Special attention should be given to identifying and recognizing key individuals within

divisions, branches, or other groups within the organization who have special knowledge

and interest in the use of microcomputer technology. These local leaders in the uses of

this technology can be established as user coordinators, providing support within their

groups and liaisons to appropriate centralized support and management staff. This local user coordination function can frequently be an added responsibility for someone who has

shown interest and initiative to become knowledgeable about mcirocomputer technology.

These local leaders together within the organization may be the nucleus of an organizationwide user group that can foster information sharing and provide technical assistance in

microcomputer use. The key challenge for most organizations will be to recognize and properly assess the

new alternatives now possible because of the microcomputer technology. Agency managers

at all levels should be made aware of the potential of end user computing so that they will

be more comfortable with it. For most organizations the appropriate managerial strategy

for end user computing will be a mix between local autonomy and central control. The

pricipal difficulty faced by organizations will be in clearly defining the boudaries between

what should be controlled centrally and what should be controlled locally.

Our experience has been that few organizations had planned for integrating microcomputers into the performance of their missions before several microcomputer systems were

already in place. These initial systems were usually introduced by innovative individuals who were unable to receive support from existing overworked and understaff'ed ADP

40
groups.

6.4 Long Term Impact on the Organization

It should be recognized that this and related office automation technologies are likely

to lead to new ways of performing basic functions within organizations. Eventually, major

changes to the structure and way of doing business are quite likely through exploiting

these new capabilities. The potential for change should be nurtured and supported so long

as it is consistent with organizational objectives and information resources management

policies and procedures.

41
Chapter 7

SUMMARY:Developing a Policy

The development of a management policy that encourages the use of microcomputers, coupled with a meaningful education program and controls, can ultimately result in

increased productivity and optimization of information processing activities. The poHcy

can be formulated by one group (e.g., information resource management group) or by a

steering committee with members from the various departments within the organization.

It has been our experience that a steering committee with representatives from all organizational levels including end users can be the most beneficial in the development of a

policy. Organizational requirements, information on application requirements, and potential microcomputer usage, including the identification of who needs to have what types of

information and resources, can be solicited from these representatives. A policy that is formulated with input from the user community can be accepted and complied with more

readily.

7.1 Elements for Consideration

The successful evolution of a management strategy /policy requires that consideration

be given to the elements that will constitute that strategy. The outline below is based

on the discussions previously presented and constitute elements for consideration prior

to the development and implementation of a management policy. The sample outline is not intended to be a comprehensive listing of all possible elements but rather a trigger to

stimulate further discussions.

Sample Outline: Elements for Policy Consideration

1. Establish Policy Objectives

• clearly state the goals to be achieved by the policy

• define the role of the microcomputer within the organization's information management structure

42
• determine the nature and extent of microcomputer usage within the organization

• identify management's motivation for creating a microcomputer policy

• integrate microcomputer policy with the overall organizational policy

• assure consistency with organization missions

Establish Level and Means of Policy Implementation

• determine a management style, e.g., strict control vs. permissiveness vs. laissezfaire

• define the degree of control e.g., centralized control or decentralized control

• determine the form the policy will take, e.g., in-house standard, guidance, rec- ommendations, etc.

• identify the resources that will be managed, e.g., information, personnel, telecommuncations, application, hardware, or software

• identify the level at which the policy is formulated and the areas to which

the policy will be applied, e.g., the information resource management group

develops policy on microcomputer acquisition whereas the ADP system staff

formulates policy on micro-mainframe connections

• specify a method for keeping the policy dynamic and adjustable to changing

technology and user needs

Establish Short and Long Range Strategies

• develop a method to enable the adequate planning, coordination, review, and

evaluation of proposed and current microcomputer resources

• determine the pace at which microcomputers are introduced and integrated into

the organization

• investigate the implications and associated risks of implementing microcomputer

systems and identify alternative solutions and contingency plans

• examine the resources (people, hardware, software, communications, and facilities) associated with and required for the use of microcomputer systems

• develop a methodology for acquisition, implementation, and support of microcomputer systems

• develop mechanisms to continuously monitor and evaluate technical trends with

respect to the current/planned environment

• provide a coordinated and practical transition strategy to bridge from current

to future systems/environments, in a non-disruptive way

43
4. Acquisition

• develop criteria for system (hardware and software) selection

• define the level of approval and justification needed for the procurement of

microcomputer systems

• specify the funding conditions and requirements for all procurements

• provide for the coordination and consolidation of microcomputer purchases in

order to take advantage of volume purchasing

5. Develop a Clear Definition of Microcomputer Roles and Responsibilities

• examine and determine the skills required to manage and effectively utilize the

technology

• examine and realign organizational structures and responsibilities wherever nec- essary to minimize disruption

• define and assign responsibilities for the planning, selection, acquisition, management, operation, and support of microcomputer systems.

• determine who will be the customer/user of the microcomputer systems

• identify the role and involvement of the end user, the user's management, the

systems staff", information resource management group, etc.

• acquire knowledgeable technical personnel to support microcomputer activities

6. Define Adequate Support Structures

• Determine the support activities that will be off"ered, e.g., system assessments,

training, maintenance, and/or assistance and guidance in selection, acquisition,

installation, and operation of the microcomputers

• determine the means of providing support, e.g., one centralized group, many

local support centers, user groups, producer obtained, etc.

• develop procedures to promote literacy and education of all levels of management so as to encourage knowledge-based decision making

• develop procedures to provide training and assistance to help end users to more

productively use microcomputers and to intelligently anticipate and specify their

requirements

• explore methods for the dissemination of information, e.g., user groups, newsletters, workshops, conferences, electronic bulletin boards, etc.

• examine potential maintenance techniques and practices

• consider the security implications and risks associated with microcomputer us- age

44
7. Explore Opportunities for Information Sharing

• determine the requirements and consequences of inteconnecting microcomputers

with other computer systems (mainframes, minicomputers, other microcomputers)

• explore the need and possibilities for sharing and interchanging software programs, files, and data

• investigate the implications associated with the sharing of information, e.g., data naming, organization, collection, and security

7.2 Policy Topics

The decisions derived from the policy elements above can form the basis of the actual

microcomputer management policy. An example of the topics that may be contained in

such a policy follows. The example is not intended to be an in-depth, comprehensive listing

of all possible topics in a management policy; nor should it imply that all topics listed must

be included in a management policy. The objective of the example is to present areas that

may be contained in a management policy or at least be considered for one.

Sample Outline: Policy Topics

I. Purpose

II. Applicability and Scope

III. Background - General Information

IV. Objectives

V. Organizational Issues

A. Role of the Microcomputer within the Organization

B. Roles and Responsibilities

C. Planning and Evaulating Microcomputer Resources

1. Current

2. Multi-year Planning

VI. Technical Issues

A. Standards and Recommendations

1. System Components

45
2. Software

3. Potential Applications

B. Resource Sharing

1, Communication Requirements and Procedures

a. Hardware Configuration

b. Software

c. Software Compatibility (shared programs, files, data)

2. Information Issues

a. Data Sharing and Ownership

b. Data Naming and Organization

c. Data Integrity

C. Security and Risk Assessment

VII. Acquisition

VIII. Support

A. Microcomputer Assessment

B. Education and Training

C. Dissemination of Information

D. Equipment Installation and Maintenance

E. Software Development or Modification

46
Chapter 8

REFERENCES AND RELATED

READING

Attewell, Paul and Rule, James, "Computing and Organizations: What We Know and

What We Don't Know", Communications of the ACM, Volume 27, Number 12,

December 1984.

Barkley, John, Gilbert, Dennis, and Hankinson, Al, "Selection of Microcomputer Systems",

National Bureau of Standards, Special Publication 500-112, March 1984.

Brown, Gary D. and Sefton, Donald H., "The Micro vs. the Applications Logjam", Datamation, January 1984.

Kahn, Beverly K., "Some Realities of Data Administration", Communications of the

ACM, Volume 26, Number 10, October 1983.

Damm-Luhr, David L., "Microcomputers in Transporation, Selected Readings Volume 3,

Addressing Organizational Issues", U.S. Department of Transporation, September

1984, UMTA-URT-41-84-2.

"End User's Guide to Buying Small Computers" , Office of Information Resources Management, U.S. General Services Administration, August 1984.

"Final Report on the GSA End User Computer Pilot Project", End User Computer Support Staff (KGS-1), U.S. General Services Administration, September 28, 1983.

Gilbert, Dennis, Parker, Elizabeth, and Rosenthal, Lynne S., "Microcomputers: A Review

of Federal Agency Experience", National Bureau of Standards, Special Publication

500-102, June 1983.

"Managing End User Computing in the Federal Government" , Office of Information Resources Management, U.S. General Services Administration, June 1983.

47
Mazursky, Alan D., "On Managing Change", Journal of Information Systems Management, Winter 1985.

"Merlin Improvements", Office of Information Resources Management, U.S. General Services Administration, January 1985.

Meyer, N. Dean, "The Dimensions of a PC Policy", N. Dean Meyer and Associates Inc.,

1984.

"Microcomputer Management Guidelines", Federal Software Testing Center, Office of

Software Development and Information Technology, Report OIT/FSTC-83/019,

November 1983

"Personal Computers - Guidelines", Profit Oriented Systems Planning Programs, POSPP

Serial P-23-3.

Pyke, Thomas N. Jr., "Information Resource Centers - Organizing to Serve End Users",

Proceedings of COMPCON 83, Fall.

Rockart, John, "Chief Executives Define Their Own Data Needs", Harvard Business Review, March-April 1979.

Rockart, John and Flannery, Lauren, "The Management of End User Computing", Communications of the ACM, Volume 26, Number 10, October 1983.

Steinauer, Dennis D., "Security of Personal Computer Systems: A Management Guide",

National Bureau of Standards, Special Publication 500-120, January 1985.

48
NBS-n4A (REV. 2-ec> U.S. DEPT. OF COMM. 1. PUBLICATION OR 2. Performing Organ. Report No. 3. Publication Date BIBLIOGRAPHIC DATA

REPORT NO.

SHEET (See instructions) NRS/SP-500/125 Sept. 1985

4. TITLE AND SUBTITLE Computer Science and Technology:

Issues in the

Management of Microcomputer Systems

5. AUTHOR(S)

John Barkley and Lynne S. Rosenthal

6. PERFORMING ORGANIZATION (If joint or other than NBS. see instructions)

NATIONAL BUREAU OF STANDARDS

DEPARTMENT OF COMMERCE

GAITHERSBURG, MD 20899

7. Contract/Grant No.

8. Type of Report & Period Covered

Final

9. SPONSORING ORGANIZATION NAME AND COMPLETE ADDRESS (Street, City. State, ZIP)

Same as item 6

10. SUPPLEMENTARY NOTES

Library of Congress Catalog Card Number: 85-600588

Document describes a computer program; SF-185, FIPS Software Summary, is attached.

11. ABSTRACT (A 200-word or less factual summary of most significant information. If document includes a si gnificant

bibliography or literature survey, mention it here)

This document provides general guidance on the management of microcomputer systems.

It addresses the need for establishing a management policy and presents background,

issues and alternatives which can help an organization in its management and

support of microcomputers.

12. KEY WORDS (S;x to twelve entries; alphabetical order; capitalize only proper names; and separate key words by semicolons)

Computers; information management; microcomputers; microcomputer management;

microcomputer standards, support structure issues

13. AVAILABILITY

Unlimited

I I For Official Distribution. Do Not Release to NTIS

fxl Order From Superintendent of Documents, U.S. Government Printing Office, Washington, D.C.

3.0402.

I I Order From National Technical Information Service (NTIS), Springfield, VA. 22161

14. NO. OF

PRINTED PAGES

54

15. Price

USCOMM-DC 6043-P80

ANNOUNCEMENT OF NEW PUBLICATIONS ON

COMPUTER SCIENCE & TECHNOLOGY

Superintendent of Documents,

Government Printing Office,

Washington, DC 20402

Dear Sir:

Please add my name to the announcement list of new publications to be issued in the

series: National Bureau of Standards Special Publication 500-.

Name

Company

Address

City State Zip Code

(NotificaCion key N-S03)

Technical Publications

Periodical

Journal of Research—The Journal of Research of the National Bureau of Standards reports NBS research ana development in those disciplines of the physical and engineering sciences in which the Bureau is active. These include physics, chemistry, engineering, mathematics, and computer sciences. Papers cover a broad

range of subjects, with major emphasis on measurement methodology and the basic technology underlying

standardization. Also included from time to time are survey articles on topics closely related to the Bureau's

technical and scientific programs. Issued six times a year.

Nonperiodicals

Monographs—Major contributions to the technical literature on various subjects related to the Bureau's scientific and technical activities. Handbooks—Recommended codes of engineering and industrial practice (including safety codes) developed in cooperation with interested industries, professional organizations, and regulatory bodies.

Special Publications—Include proceedings of conferences sponsored by NBS, NBS annual reports, and other

special publications appropriate to this grouping such as waU charts, pocket cards, and bibliographies.

Applied Mathematics Series—Mathematical tables, manuals, and studies of special interest to physicists,

engineers, chemists, biologists, mathematicians, computer programmers, and others engaged in scientific and

technical work.

National Standard Reference Data Series—Provides quantitative data on the physical and chemical properties

of materials, compiled from the world's literature and critically evaluated. Developed under a worldwide pro- gram coordinated by NBS under the authority of the National Standard Data Act (Public Law 90-396).

NOTE: The Journal of Physical and Chemical Reference Data (JPCRD) is published quarterly for NBS by

the American Chemical Society (ACS) and the American Institute of Physics (AIP). Subscriptions, reprints,

and supplements are available from ACS, 1155 Sixteenth St., NW, Washington, DC 20056.

Building Science Series—Disseminates technical information developed at the Bureau on building materials,

components, systems, and whole structures. The series presents research results, test methods, and perfor- mance criteria related to the structural and environmental functions and the durability and safety

characteristics of building elements and systems.

Technical Notes—Studies or reports which are complete in themselves but restrictive in their treatment of a

subject. Analogous to monographs but not so comprehensive in scope or definitive in treatment of the subject

area. Often serve as a vehicle for final reports of work performed at NBS under the sponsorship of other government agencies.

Voluntary Product Standards—Developed under procedures published by the Department of Commerce in Part 10, Title 15, of the Code of Federal Regulations. The standards establish nationally recognized re- quirements for products, and provide all concerned interests with a basis for common understanding of the

characteristics of the products. NBS administers this program as a supplement to the activities of the private

sector standardizing organizations.

Consumer Information Series—Practical information, based on NBS research and experience, covering areas of interest to the consumer. Easily understandable language and illustrations provide useful background

knowledge for shopping in today's technological marketplace.

Order the above NBS publications from: Superintendent of Documents, Government Printing Office,

Washington, DC 20402. Order the following NBS publications—FIPS and NBSIR's—from the National Technical Information Service, Springfield, VA 22161.

Federal Information Processing Standards Publications (FIPS PUB)—Publications in this series collectively constitute the Federal Information Processing Standards Register. The Register serves as the official source of

information in the Federal Government regarding standards issued by NBS pursuant to the Federal Property

and Administrative Services Act of 1949 as amended. Public Law 89-306 (79 Stat. 1127), and as implemented

by Executive Order 1 1717 (38 FR 12315, dated May 11, 1973) and Part 6 of Title 15 CFR (Code of Federal

Regulations).

NBS Interagency Reports (NBSIR)—A special series of interim or final reports on work performed by NBS

for outside sponsors (both government and non-government). In general, initial distribution is handled by the sponsor; public distribution is by the National Technical Information Service, Springfield, VA 22161, in paper copy or microfiche form.
U.S. Department of Commerce

National Bureau of Standards

Gaithersburg, MD 20899

Official Business

Penalty for Private Use $300