Part 4: Business Section This is the Business section of the assessment. It contains 15 questions. Please carefully and thoughtfully complete each of these for the application(s) you have been assigned from the Business perspective. Business Question Number Indicator Question Question Explanation Response Response Explanation 1 Effectiveness How effective is the application at meeting your business requirements and process needs? Please consider the degree of fit between currently supported functionality and your business requirements and process needs, and whether functional gaps exist. Additional indicators include the need for ancillary tools such as personal spreadsheets and databases to accomplish tasks. RADIO BUTTONS: Label: “5 – Exceptional”, Value: 5 Label: “4 – Highly Effective”, Value: 4 Label: “3 – Effective”, Value: 3 Label: “2 – Somewhat Effective”, Value: 2 Label: “1 – Ineffective”, Value: 1 5 – Exceptional: Exceeds all business requirements and process needs; all processes are optimized, no functional gaps exist, and no ancillary tools are needed to complete tasks. 3 – Effective: Sufficiently meets business requirements and process needs; however, some processes are not optimized, some functional gaps exist, or ancillary tools/spreadsheets/databases are necessary to complete tasks. 1 – Ineffective: Does not meet business requirements or process needs; most processes are not optimized, major functional gaps exist, and numerous tools/spreadsheets/databases are critical to complete tasks.
2 Relevance How well has the application kept up with change? Please consider the degree to which functional enhancements have been met in a timely manner, relative to the number of change requests. Additional indicators include relevance to industry/market best practices, processes, and capabilities, and management attention and interest in keeping the application relevant. RADIO BUTTONS: Label: “5 – Proactive”, Value: 5 Label: “4 – Very Relevant”, Value: 4 Label: “3 – Relevant”, Value: 3 Label: “2 – Somewhat Relevant”, Value: 2 Label: “1 – Irrelevant”, Value: 1 5 – Proactive: Exceptionally responsive and agile; functional enhancements and process needs are proactively addressed; preempts industry/market changes. 3 – Relevant: Remains relevant and has efficiently kept up with changing business requirements, process needs and industry/market capabilities. 1 – Irrelevant: Functionality and processes are out of date; significant enhancements are backlogged or require substantial time and effort to implement. 3 Complexity To what extent is the application’s functionality complex, requiring experience and resources to learn, use and manage? Please consider whether this application is difficult to use, requires specialized expertise, needs significant training, or requires substantial overhead to manage changes, interfaces, and reports. RADIO BUTTONS: Label: “5 – Very Simple”, Value: 5 Label: “4 – Simple”, Value: 4 Label: “3 – Reasonable”, Value: 3 Label: “2 – Complex”, Value: 2 Label: “1 – Very Complex”, Value: 1 5 - Very Simple: Simple to use, little to no training to learn, and/or does not require specialized resources to manage or to get changes completed. 3 – Reasonable: Reasonable training and expertise to use, some expected attention is required to manage changes, interfaces, and reports. 1 – Very Complex: Difficult to use, very complex, requires significant training and highly specialized resources, significant overhead manage changes, interfaces, and reports.
6 Information How well does the application support your information/data management needs? Please consider three aspects as to how the application supports the management of information: (1) the integrity and trustworthiness of the data (2) data quality such as searches and reporting accuracy; and (3) whether data are available to employees or customers when they need it. RADIO BUTTONS: Label: “5 – Exceptional”, Value: 5 Label: “4 – Excellent”, Value: 4 Label: “3 – Sufficient”, Value: 3 Label: “2 – Tolerable”, Value: 2 Label: “1 – Poor”, Value: 1 5 – Exceptional: Information is trustworthy with very high integrity, quality and timeliness. Decisions are confidently made based on information 3 – Sufficient: Information integrity, quality, and timeliness are sufficient; decisions can be made from information, but usually require additional supporting evidence 1 – Poor: Information integrity, quality, and timeliness are poor; no decisions can be based on information due to corruption and volatility. 7 Security How well does the application securely protect your information/data? Please consider enforcement of proper access controls, privacy issues, and regulatory compliance, and how those security controls adversely affect user accessibility, usability, productivity, and effectiveness. RADIO BUTTONS: Label: “5 – Optimized”, Value: 5 Label: “4 – Strong”, Value: 4 Label: “3 – Sufficient”, Value: 3 Label: “2 – Vulnerable”, Value: 2 Label: “1 – Exposed”, Value: 1 5 – Optimized: All applicable security policies, processes, and procedures are strictly enforced; security controls do not inhibit accessibility, usability, productivity, or effectiveness 3 – Sufficient: Critical security policies, processes, and procedures are enforced; some security controls inhibit accessibility, usability, productivity, or effectiveness; minor security vulnerabilities are known, but acceptable 1 – Exposed: Security policies, processes, and procedures are not properly enforced; known, critical vulnerabilities exist; any existing security controls significantly inhibit accessibility, usability, productivity, and effectiveness
8 Integration How well does the application integrate with business processes (and their related data) across different functional areas? Please consider the ease of process integration, the level of manual intervention (such as repetitive data entry), the timeliness of data updates, and the simplicity of process handoffs. RADIO BUTTONS: Label: “5 – Orchestrated”, Value: 5 Label: “4 – Automated”, Value: 4 Label: “3 – Sufficient”, Value: 3 Label: “2 – Manual”, Value: 2 Label: “1 – Disconnected”, Value: 1 5 – Orchestrated: Business processes and data are seamlessly and flawlessly integrated in real-time across functional areas; workflows and data translations are choreographed across applications without any manual intervention 3 – Sufficient: Business processes are mostly integrated with automated workflows; some manual rekeying (export/import) necessary for ancillary tools and analysis; data are generally updated in real-time, but some batch and/or manual updates inhibit efficiency 1 – Disconnected: Substantial manual data entry and re-keying across processes; data updates are largely batch and constrain process efficiencies; the application is disconnected from all other applications; data requires substantial translation to adapt with other applications 9 Resilience How well does the application function correctly during stressful conditions? Please consider the robustness of the application in handling high-transaction volume or congested activity, or if the application indicates issues or underlying problems with business process design, data access/entry, technology performance. RADIO BUTTONS: Label: “5 – Elastic”, Value: 5 Label: “4 – Very Resilient”, Value: 4 Label: “3 – Resilient”, Value: 3 Label: “2 – Somewhat Resilient”, Value: 2 Label: “1 – Rigid”, Value: 1 5 – Elastic: High volume and peak business throughput are handled on demand without failure or service degradation; demand is managed effortlessly without intervention; processes, data, and interfaces are optimized for scale. 3 – Resilient: Minor increases/spikes in volume and throughput without issue; major increases require a reasonable level of management intervention, planning and investment; congestion occurs with an acceptable level of service degradation. 1 – Rigid: Unable to handle increases in volume or throughput without significant service degradation and failure; substantial planning and investment required to meet any increase in demand; process design, data entry and technology are inflexible.
10 Satisfaction Please rate your overall satisfaction with the functionality of the application. Please consider all functional, information, and usage aspects. RADIO BUTTONS: Label: “5 – Elated”, Value: 5 Label: “4 – Very Satisfied”, Value: 4 Label: “3 – Satisfied”, Value: 3 Label: “2 – Somewhat Satisfied”, Value: 2 Label: “1 – Unsatisfied”, Value: 1 5 – Elated: Exceeds expectations; directly improves business performance; optimal business process automation; measurably increases data quality and accessibility. 3 – Satisfied: Meets expectations; indirectly improves business performance; acceptable level of business process automation; sustains and improves data quality and accessibility. 1 – Unsatisfied: Does not meet expectations; degrades business performance; impedes business processes; degrades data quality and accessibility. 11 Change Rate For the business processes that the application supports, how frequently do those business processes change? Please consider the broader environment surrounding the business processes including business strategy adjustments, regulatory updates, and economic impacts as well as operational changes. RADIO BUTTONS: Label: “Stable”, Value: 1 Label: “Recurrent”, Value: 2 Label: “Unpredictable”, Value: 3 Stable: The business processes are formally structured and stable with a high degree of standardization, repeatability and control. Changes to the processes are rare and infrequent. Recurrent: The business processes are defined with regular/periodic change in response to competitive pressures for differentiation. Processes are configurable and must adapt quickly even though change is minimized. Unpredictable: The business processes change frequently in response to dynamic and unknown business conditions. Processes are exploratory and innovative with continual change.
2 Licenses What are the annual hardware maintenance and software license fees for the application? For the 2017 fiscal year, please consider all on-going annual hardware maintenance and software license fees. These fees include: application software, application server, database server, and other infrastructure that can be reasonably allocated to this application. Please only include annual recurring license costs. Do not include onetime “sunk costs” related to this application’s licenses(e.g. initial license fees). Please do not include initial license fees, client hardware licenses or network telephony that have negligible impact. Select the appropriate dollar range from the options provided. RADIO BUTTONS: Less than $5,000 $5,001 - $10,000 $10,001 - $25,000 $25,001 - $100,000 $100,001 - $200,000 $200,001 - $500,000 $500,001 - $1,000,000 Greater than $1,000,000 3 Remediation Costs Identify whether remediation costs have been identified and documented. Cost components of remediation cost estimates may include: new hardware, new software, re-factoring, architecture design, development, deployment, changes to workforce, etc. RADIO BUTTONS: Label: “Yes”, Value: 0 Label: “No”, Value: 1 Part 6: Technical Section This is the Technical section of the assessment. It contains 10 questions. Please carefully and thoughtfully complete each of these for the application(s) you have been assigned from the Technical perspective.
Technical Question Number Indicator Question Question Explanation Response Response Explanation 1 Standards How well does the application align with accepted architecture practices, development principles and technology standards? Please consider whether the application supports the architectural direction of the organization such as service oriented architecture (SOA), business process management (BPM) and master data management (MDM); adherence to design principles such as loose coupling and modular design; and alignment with standardized technology platforms, infrastructure, and vendors. RADIO BUTTONS: Label: “5 – Exemplary”, Value: 5 Label: “4 – Well Aligned”, Value: 4 Label: “3 – Aligned”, Value: 3 Label: “2 – Somewhat Aligned”, Value: 2 Label: “1 – Not Compliant”, Value: 1 5 – Exemplary: A model that demonstrates the architectural direction; implementation of all design principles; uses all standardized platforms, infrastructure, and vendors. 3 – Aligned: Compatible with most current practices, principles and standards (or work is under way that will render it so); waivers or rationale for non-compliance are documented and justifiable. 1 – Not Compliant: Incompatible with current practices, principles and standards without reasonable justification (and lacking intention of increasing alignment)
2 Extensibility How easily does the application adapt to changes and extend to meet new requirements? Please consider the degree to which changes are easily and responsively made to design, construction, integration and implementation of the application including: q Addition of business functionality. q Addition, deletion or modification of interfaces and integration to/from other applications. q Adaptation to infrastructure changes. q Collaborative interaction with external applications or services. q Evolution to new development languages and methods. RADIO BUTTONS: Label: “5 – Value: 5 Label: “4 – Very Configurable”, Value: 4 Label: “3 – Configurable”, Value: 3 Label: “2 – Somewhat Configurable”, Value: 2 Label: “1 – Programmatic”, Value: 1 5 - Model-Driven – Graphical, drag-n-drop technical adaptation and functional extensibility. Marginal effort needed to achieve additional capability and to sustain application relevancy. 3 – Configurable: Configurations enable responsive to most functional enhancements; technologies are reasonably adaptive with the exception of known core dependencies; extensibility is achieved through configuration and additional modules. 1 – Programmatic: Difficult and costly to extend functionality to any degree without significant modernization, programming, and database changes; technologies are unchangeable without significant investments;
3 Scalability How easily does the application scale to deliver additional capacity? Please consider the degree to which the application responds to additional demand including growth in the number of users, usage, and data volume. RADIO BUTTONS: Label: “5 – Elastic”, Value: 5 Label: “4 – Very Scalable”, Value: 4 Label: “3 – Scalable”, Value: 3 Label: “2 – Somewhat Scalable”, Value: 2 Label: “1 – Rigid”, Value: 1 5 - Elastic – On demand technical scalability and capacity. Marginal effort needed to achieve growth and sustain application relevancy. 3 – Scalable: Responsive to most demand growth. Technologies are reasonably adaptive with the exception of known core dependencies; increases in scale and capacity are achievable, but not without advanced planning and investment. 1 – Rigid: Difficult and costly to scale to any degree; technologies are unchangeable without significant modernization investments; increases in scale and capacity are unachievable without significant changes to software and hardware.
4 Integration How easily does the application integrate data and processes? Please consider the efficiency of both data (e.g., batch, ETL) and process (e.g., real-time, Web Services) integrations; the ease with which integration can be changed to reflect changing business processes; the degree to which data translations, technology adapters, and interfaces are hard-coded within the application or abstracted into integration hubs. RADIO BUTTONS: Label: “5 – Orchestrated”, Value: 5 Label: “4 – Automated”, Value: 4 Label: “3 – Sufficient”, Value: 3 Label: “2 – Manual”, Value: 2 Label: “1 – Disconnected”, Value: 1 5 – Orchestrated: Business processes and data are choreographed through an enterprise service bus or integration hub without manual intervention; interfaces adhere to standards for simplicity; connectors are adapted for modularity and efficient change; data translations are mapped for configurability. 3 – Sufficient: Critical business processes are integrated with automated workflows; point-to-point integration is the primary integration mechanism; ancillary business processes require some manual rekeying (export/import); data are generally updated in real-time, but some delayed batch and/or manual updates exist. 1 – Disconnected: Applications are siloed and compartmentalized; substantial manual data entry and re-keying with minimal integration; data updates are largely batch and constrain process efficiencies; data requires substantial, mostly manual translation to adapt with other applications
6 Recovery What assurances are in place to recover the application in the event of a disruption or disaster? Please consider redundancy in hardware and software platforms, physical locations of data centers, frequency and comprehensiveness of replication, global and local failover, specificity of recovery time and point objectives, and the frequency and success of disaster recovery exercises. RADIO BUTTONS: Label: “5 – Full”, Value: 5 Label: “4 – Most”, Value: 4 Label: “3 – Sufficient”, Value: 3 Label: “2 – Insufficient”, Value: 2 Label: “1 – None”, Value: 1 5 – Full: Business continuity is fully implemented including physically separate, redundant environments, replication, and clustering/grid failover as necessary; disaster recovery exercises consistently meet or exceed recovery time and point objectives 3 – Sufficient: Impacts of data loss are generally understood; some redundancy exists for critical processes and data, but most loss is acceptable or recoverable given time; disaster recovery exercises are conducted periodically with known and acceptable deficiencies 1 – None: Impacts of loss are not understood; no redundancy or recoverability; in the event of a disaster, all assets are lost.
10 Security Please identify which (if any) of these security risks are applicable. It is expected per TAC 202 requirements, that agencies have assessed the security posture of their software and hardware environments. As a result of these reviews, agencies should have identified various security risks exposed by any system in their environment. CHECK BOXES (select one or several): Software security fixes are no longer available from the manufacturer, or cannot be applied due to compatibility constraints in the current environment. Software lacks support for encrypted transport. Lack of effective modern Authentication, Authorization and Accounting (AAA) mechanisms. Forced to use old security protocols or configurations within the security infrastructure; which introduces legacy risks to new systems. Hardware is easily impacted by Denial of Service (DoS) attacks due to limited performance. Hardware is unable to support the necessary modern secure software systems. None