Proving your data management and compliance strategy is working

Data Management Scorecard

I’ve written several blogs now on the remarks of a major CIO about measuring IT performance. This CIO told me in order for him to achieve the business transformation and ROI that he wants from an IT toolset, it’s necessary to have a performance management system alongside that measures whether the desired business transformation is delivered. In my last post, I talked about the importance of being able to measure the benefits for automation management software. This week, I turn to a final domain, data management.

What are your objectives for purchasing data management software?

 With the launch this week of COBIT 5 for Information Security, I’ve  been doing a lot of thinking about data management and continuity. (In fact, I’m planning to do an entire series on the impact and importance of COBIT 5, so watch this blog for more on the topic.) From the COBIT 5 perspective, the following should be our objective for data management and continuity:

• To ensure business-critical information is available to the business in line with minimum required service levels

To make this happen, COBIT 5 says that IT practitioners need to get a number of things right. First, you need to regularly test in order to verify the effectiveness of your continuity plan. This means looking at three topics:

• First, the percentage of successful and timely restorations from backup. This tells you whether you are good at restoration.
• Second, the percentage of backup media transferred and stored. This tells you how much will be lost in a disaster and how much coverage you need to improve.
• Third, the number of tests that achieved their recovery objectives. This tells you the quality of your backup process.

For the purposes of this blog, let’s say these objectives are your reasons for purchasing data management software.

What key performance indicators should go into a Data Management Scorecard?

So if following the four-quadrant model for Norton Kaplan, what key performance indicators (KPIs) should be in the scorecard for a data management software purchase?

First Quadrant—IT Value

The first quadrant in a balanced scorecard focuses on IT value.  KPIs on my list for this quadrant include: 1) the volume of data protected and 2) the number of servers being backed up. These were chosen because they represent the efficiency and effectiveness tradeoffs. Clearly if your procedures are set correctly then not everything in the world needs to be protected. —something covered explicitly in the customer quadrant. Backing up what’s necessary reduces cost while enabling the right things to be backed-up.

Second Quadrant—Customer

Moving to the customer quadrant, this is where IT leaders can show that they are increasing value for their customers. Since customers want their data protected and available when they need it, I focus here on what to measure to demonstrate that s this is the case.  I, also, focus on the measures that demonstrate an improvement from a customer perspective. At the top of this list is the mean time to recover business data. At its core, this KPI shows whether the business can continue to operate and if IT is down how soon it will be before it can operate again. Next is the acceptable amount of data loss. If this is too high then critical data may be missing when a continuity event concludes. Along the same dimension is the time elapsed since the last backup. If this is too long, then valuable information will not be there to restore.

Third Quadrant—Operational Excellence

From the operational excellence quadrant, there are many KPIs to measure and track that will either tell whether you are good at data management or improving over time. I have listed them by topic.

• Backup Success Rate: It is important to have a high number here to be successful at data management and continuity. I recommend a score in the mid to high 90s.
• Restore Operations Success Rate: This is the proof of the pudding. Restore Success Rate means that a backup could be reinstated. 
• Average Time to Restore: This has business impact written all over it. So you want your average time to restore to get smaller over time. This way you prove that you can handle a disaster.
• Time Elapsed Since Last Backup: This is really how well you are running operations. The more frequent your backups the better you run things.
• Consecutive Backup Failure Period: Something is wrong with your process if the number is too high.

Fourth Quadrant—Future Orientation

In future orientation, look for KPIs that show things will improve over time, such as Mean Time to Recover Business Data, Acceptable Amount of Data Loss, Volume of Protected Data, and Time Elapsed Since Last Backup. More could be included, but together these KPIs show, in my opinion, that you are achieving better control over data management and establishing the type of future IT organization needed to succeed at the business of IT. I cannot stress how important this is. Without good data management and continuity, business outcomes are at risk in a disaster. During Hurricane Katrina, a major insurance company could not process claims or retrieve important data for days. This is when IT is counted on by your business customers and their customers.

With this said, I would like to hear back from you. What measures would you put on a data management success scorecard? Where do you think I am missing something in the above list?

Related links:

 Professional Services: Dirk Reimer, HP COBIT 5 expert

Blog post: 3 ways IT leaders can strengthen compliance and control

COBIT 5

Solution page:  IT Performance Management

Twitter: @MylesSuer