John Suffolk

100 questions to ask your tech vendors on their approach to cyber security. Let us all develop an ISO based standards for vendor security

When we look around today it is fair to say that almost everything we see has been shaped by the combination of Governments, regulators, vendors and consumers continuously improving the products and services that we use.

Your trip to the office, or home or school or shop today regardless of by car, bus, cycling, and yes even walking has sustained many years of functional and safety innovations and improvements.

The room you are meeting in has been shaped by health and safety considerations on maximum room size versus the size of the exits to allow a timely escape in the event of an incident. The materials to build and furnish the room are tested for structural, wear, chemical and fire protection and performance.

But what has not gone through the same security improvements is the technology you are using. Your mobile phone, your tablet, your computer - They have gone through enormous technical changes, enormous, functional changes, and enormous cost improvements but sadly security has not followed this same improvement curve.

Consider this when you purchased your phone nowhere did it state any warning about security of your personal details or protection of your identity. Nowhere would you have been able to find a commonly accepted certificate of security conformity or security testing. Electricity – yes, environmental waste disposal probably, security, absolutely not.

So we should stop and ask ourselves why technology security has followed a different improvement trajectory.

• First is the pace of change. It is sometimes hard to comprehend how technology has changed in such a short amount of time. The shelf life of products is short; the affects of Moore's law can be seen everywhere and because of this the cumulative impact of innovation built on innovation is breath-taking
• This cumulative innovation impact makes technology more usable, more comprehensive, more available and at the same time a lot more complicated – simplification for the end-user equals increased complication for the technology vendor – and increased complexity does lead to increased security risk
• Ubiquity has led to complacency. Today we take technology for granted. We do not really consider the power of what we are using, the interconnectedness of the device, the global supply chain that delivered the device and the experience and nor do we consider the amount of hands and prying eyes who have the ability to interact with our personal technology and the data we store

All of this leads to a lack of comprehensive knowledge of the technology by policy makers, regulators, buyers and users of technology. This lack of knowledge on how technology has been built, or should be built and what good security looks like leaves the buyer, whether it is a consumer an enterprise or a government helpless in deciding the good from the bad.

I started off by saying that the interplay between regulators, vendors and consumers have driven quality up, innovation up and price down. What is missing in technology is the knowledge of policy makers, regulators and buyers of technology to make informed decisions about security. This lack of knowledge manifests itself in the reality that few people are able to specify in any level of detail what security capability they want their vendors to have or build-in to the products and services they create. This in turn has not created the pressure on vendors to improve their security capability at a similar pace to that of functional, other quality and cost improvements – hence the divergence that has been created over many years.

Much good work is going on around the world to address cyber security laws but we must be realistic. It can be hard in a single country to introduce new laws. It is even harder in a region such as the EU with 28 member states; it is a lifetime journey to achieve some laws on an international scale. But we do not need laws to make progress. Good progress has been made on improving the standards and knowledge of users of ICT by the new versions of the ISO27000 standard, the work of NIST in the USA, the Open Group and ENISA in Europe. No work, as far as we can see, has been done to start the process of helping the ICT industry improve the inherent security of their products by creating the demand from buyers for better product security. To do this, buyers need to know what questions to ask of their vendors.

Today I have published our latest white paper and you can find it on our website here:

"100 requirements when considering end-to-end cyber security with your technology vendors"

We are blessed as a company of operating in 170 countries and having customers using our technology who support over one third of the planets population. This global insight provides a richness of culture, a wide understanding of requirements and laws and a comprehensive view of the differing approach people take to managing risks. Our campus in Shenzhen, China, is home to over 30,000 employees and is also our headquarters. Here we host guests from around the globe on a continuous basis. Every day large numbers of customers, Politicians, Government officials, experts and the media come and visit. We show them our exhibition centres, our manufacturing, they sit down and talk with us, work with us and importantly eat with us and through this closeness we detail everything we do – not just on security.

From this intimacy and this openness we take our guests through the approach we take to end-to-end cyber security and from this we have captured their questions, their thoughts and their concerns. This knowledge has formed the basis of the Top 100 questions detailed in this white paper.

We set out to detail the most frequent non-technical questions we are asked by our customers and other stakeholders when it comes to cyber security. In this context, "most frequent" also means the ones that generate the most conversation or review or follow-up questions.

We have taken "poetic licence" to tweak the questions posed to us to make them generic. We have also added questions to reflect the latest issues, such as the Snowden revelations, and filled in any gaps in the questions to make each section cohesive. We fervently believe that the more demanding the buyer and the more consistent the buyers in asking for high quality security assurance the more likely the ICT vendors are to invest and raise their security standards.

Whilst this white paper is a start we are delighted to be working with the EastWest Institute (EWI) on cyber security. We are delighted to announce that the EastWest Institute has agreed to take this initial Top 100 and, using its extensive knowledge and networks, shepherd the evolution of updated and more tailored versions. We look forward to the Top 100 concept becoming an integral part of a buyer's approach and helping the ICT industry drive to greater improvements in product and service security design, development and deployment.

Together we can augment the quality of security considerations in technology products and services, and from this we can collectively do more to enrich people's lives through the use of ICT

The closure of Microsoft’s TwC Group – a wrong move at the wrong time. Sometimes different isn’t better

 I am saddened to see that changes to the trustworthy computing group within Microsoft. I have dealt with them for many years, first within the UK Government as the Government CIO and now at Huawei. Scott Charney and the team (some who have, over time, gone to pastures new) have developed a world class reputation for excellence in security.

They have been at the forefront of methodologies such as SDL, worked tirelessly to expand other technology vendor and user’s knowledge whilst at the same time dramatically improving the security quality of the Microsoft products.

I can see no real advantage to Microsoft changing this setup.  I do not buy the “imbed within the product team argument” because that was already the process and model at Microsoft. What this change does is to take away the focal point for security and instead scatter responsibility. It says to me the new CEO has no or little interest in security. If that is the case then he can kiss goodbye to his cloud first strategy.

My advice, be brave, put it back together again, rather than destroy, reinvigorate the success story and continue to drive TwC to be a strong foundation on which Microsoft products and services are built.

Seoul cyber security conference, more countries, more talking, not much progress. Huawei launch new white paper on end-to-end security

I have just finished speaking at the Seoul cyber security
conference, perfectly and warmly hosted by the Republic of Korea Government.
About 100 countries, plenty of Ministerial support as usual. Sadly the
conversation does not appear to have moved on in many ways relating to “international
laws, standards, behaviours”. In fact it is what most Ministers asked for, yet
I assume it is their job... Correct me if I am wrong but I have not seen since
the first conference in London some three years ago any G8, G20, UN or other
Government put this to the top of the list and say we are going to make this
happen. Perhaps with all of the Snowden revelations and the fact that some
enterprises and some Governments no longer trust American Tech titans we might
see more progress on this.

For our part at Huawei we are passionate about bringing the
world together to make progress on determining what does good end-to-end cyber
security look like and implementing globally accepted standards to help buyers
have more trust in what technology they are buying. To this end at the Seoul
conference I launched a new white paper that documents how Huawei builds-in
cyber security requirements into its end-to-end processes - we would love your
views on how we can improve on what we do.

http://pr.huawei.com/en/news/hw-310599-cyber.htm

Project reviews completed, moratorium holding firm, renegotiations well advanced, strategy imbedded - so time for me to leave

Sir Gus O'Donnell, the Cabinet Secretary, has announced my decision to leave the Civil Service after 7 years with almost 5 years being the Government Chief Information Officer and Senior Information Risk Owner.

the full statement is

"John Suffolk, Government Chief Information Officer at the Cabinet Office, has announced today that he will be leaving the Civil Service at the end of the year. John joined the Home Office in 2004 as the Director General leading the technology transformation of the Criminal Justice System and was appointed to the role of Government Chief Information Officer in 2006.

John made his intentions clear in March that he wished to consider his position once he had fully supported the new Coalition Government in their first 6 months of office.

John said:

'It has been a great honour to have been a civil servant and a huge privilege to have led the IT profession over the last 5 years. Without doubt we have transformed the UK into a leading user of technology benefiting Citizens and the UK economy.
 
'I am immensely proud of the way we have supported the new Coalition Government in its first 6 months and have greatly enjoyed working with Francis Maude and his team. I know that with his drive and passion for delivery the very good work we have started will continue and be a great success."

Cabinet Secretary Sir Gus O'Donnell said:

'John deserves the thanks and best wishes of everyone in the Civil Service for driving the transformation of technology in Government. His work with the CIO Council and technology professionals across Government has ensured that we are well placed to cope with the challenges that we will face. We wish him all the best for the future.'

Francis Maude, who co-chairs the board which oversees the Efficiency and Reform Group, said:

"'I'd like to thank John for his enormous contribution to the technology transformation agenda, and the civil service as a whole over many years. 'His experience in both the public and private sector has helped to make the transition to the coalition government a smooth one. The Cabinet Office will certainly not be the same without him and I wish him well for the future.""

The Government has announced the most demanding public sector spending review in a generation. In that review the ICT Strategy that we have been working towards and delivering over the last 7 years is baked in, in some shape or other: the rationalisation of infrastructures to create a "cloud" model; the continued sharing of assets and systems; the continued drive to benchmark and drive operational excellence; putting more systems online - but based around horizontal citizen and business needs; focussing more on SMEs; reducing the scale of projects; fixing our procurement processes and finally putting technology at the heart of the next transformation.

I am a great believer in renewal and as new teams enter a business, or as in our case, Government, it is important that they themselves can bring in new ideas, new policies and processes, and crucially new people. Having achieved what I set out to achieve it is time for me to get out of the way and allow fresh thinking and impetus to drive forward the strategy. I know I leave our work in strong capable hands supported by a strong capable ICT supplier community.

The PM talks semantic web, Martha Lane-Fox, and tweaking the Tigers tail

I woke up at 03.18 with my head buzzing with so much exciting stuff. I had just spent 2 hours at the Computer Weekly 500 club talking to an excellent, vibrant group about our G-Cloud strategy. We probably could have gone on for days...thanks Bryan. This event was clearly built on the publication of our Government ICT Strategy and enabled us to talk about the opportunities and threats. My summary of the event would be that the strategy is good, we recognise the criticality of the culture change that will be required, getting SME's into the app store will be vital and that the EU procurement process, for SME's, has unintended consequences of being anti innovative and anti competitive because of the cost and time of bidding. We also discussed that the cloud provides the fundamental underpinning of other strategies such as Martha's work as without it, we will just not have the money to do everything.

The second thing buzzing around my head was how the hell did we manage to get the PM to talk about the semantic web? The hero who will have managed this (not me I might add) will have had to work across many departments and stakeholders to develop the evidence and buy-in to the suggested policy to ensure what we suggest we should do, can actually be done.

Three years ago my objective was to deliver the Transformational Government Strategy, Develop the ICT Community as Head of Profession and extend our strategies into Green ICT Strategy, Open Source Open Standards reuse, Power of Information etc etc. etc. We have strategies in the pipeline on offshoring and our standards catalogue and we will publish those as soon as they have been completed, reviewed and signed off.

Many of you might recall that the first strand of Transformational Government was "Citizen Centred Services" and this was all about putting the Citizen at the heart of what we do and deliver services on their terms, not ours.

So to see that Martha lane-Fox will become the UK's Digital Champion is a culmination of years of hard work by many people. At last the use of ICT is becoming centre stage of Government strategy with its rightful place to serve citizens (or people who serve citizens) on their terms at a price we can afford.

But tweaking the tail of the Tiger, and one of the Tiger's chums can be a dangerous thing to do. As the saying goes, "beware of what you ask for". The note from Gus to Martha makes clear the first activity is to focus on developing a digital public services strategy. In the PM's speech on Monday, the PM details what he expects to see: the creation of Mygov, which will "integrate" many backend systems such as pensions, tax credits or child benefits, and a simple approach to citizens identifying themselves to Government. This is no small feat. Neither the PM, nor Martha will take too kindly to people dragging their feet and spending their time in endless meetings talking about theory and governance, who does what, building big teams, lots of reporting, posturing and and and. We have raised the expectation and now we need to deliver, and deliver in an environment where as the Chancellor said yesterday "it will be very very tough on spending settlements" for the public sector. This almost certainly will entail diverting money from existing projects, websites, and indeed scrapping activity that does not conform to whatever strategy Martha agrees with the PM and Ministers. Many people talk about cross cutting delivery but few have done it –it's really tough - I carry 6 years worth of scars from doing this in Government.

This is a culmination of three years activity for me, and it is interesting to note that all the things we created over the last three years and spun off are now all being grouped back together again! What goes around comes around. So I look forward to continuing to work with Martha developing the strategy, and critically implementing it... I'll send one of my Tigers to all of the meetings...

Project costing why do we add in everything, plus the kitchen sink?

I have been wondering why we cost projects as we do in IT. The model seems to be we have to estimate and take into account everything: all the project resource costs; all the hardware and software costs; all the training cost; all the integration, testing, parallel running, user costs for training, loss of productivity costs when we implement. Heaven forbid if the length of the contract takes you through a refresh cycle else that will need to be added in as well.

Can you image if this was the approach to buying a house and the purchase price was set the same way: house value, all the taxes, legal fees, as well as say ten years of heat, light, maintenance. Better throw in cleaning costs as well - it just isn't a sensible thing to do.

Would it better to show project costs net of cashable benefit. So anything with a positive number doesn't look too good, might get a bit more CEO and CFO attention that way.

Of course projects with big revenues for suppliers generate their own challenges. I have always been intrigued by the end of quarter/year deals that come our way. I always ask "do you prefer to reduce your revenue or your margin?". The answer is always reduce margin. I was taught when I was running a business or a bit of a business that "growth is for vanity and profit is for sanity" and as the ICT industry continue to change, this appears to be even more true.

Imagine the scenario that you have built your business on increasing revenues, indeed the analysts that set your credit rating, or even determine buy, hold and sell investor statements look for revenue growth. Margin decline is just put down to the competitive nature of the market. It is hard for the sales team to say lets reduce revenue, when the market expectation of success is revenue growth - a catch 22? But looking forward big revenue projects will continue to reduce - I have just seen this same sentiment expressed by SAP. So revenue declines, margins have declined so profitability will decline not slowly but quickly as the big existing contracts are not replaced. This is not unique to the ICT industry and as other industries have run this particular course evidence shows it leads to consolidation and cost cutting. If revenues are down and margins are down, costs must come down else it is buy-buy business.

Something for the weekend sir? A private patch perhaps?

First of all let me apologise for not being "on air" recently. I foolishly slipped a disc and caused a few other problems that laid me up over the last few weeks. I would like to say that the damage was caused by undertaking manly activities on the farm, sadly I fear it was more likely from slouching on the settee watching x-factor. Whilst lying on the floor I did have the opportunity to admire the creative genius of spiders and how greedy they are when it comes to flies. I also learned that whilst attempting to watch TV when lying on my back and wearing vari-focal glasses require the glasses to be at 45%, i.e. my left ear needs to be 2 inches higher - time was not wasted.

But now I want to introduce you to the sordid world of the private patch. For some reason this particular issue always makes me think of the song by Madness, House of Fun by Barson and Thompson.

"Good morning miss"

"Can I help you son?"

"sixteen today and up for fun"

"I'm a big boy now or so they say so if you'll serve me I'll be on my way"

Those of you who know the song, and certainly if you are male, will recognise the scenario of desperately attempting to buy one (or three) really important thing and ending up with something totally useless, and certainly not fit for the purpose you had in mind. Software seems to be just like that. You think you buy software that works and does what is says on the tin, but low and behold you have bought something that has a mind of its own and randomises it's operation.

Let me tell you a story, come close....

Once upon a time little Johnny bought three bits of world renowned software, inky, pinky and stinky. They were all meant to do their individual jobs and importantly live happily together. That's what their mummy and daddy said, fibbers - mummy and daddy didn't really know what they were on about.

Firstly inky didn't like to be used too heavily. Whilst on the tin, it said 25 people can use this together, inky didn't like this so added a "go slow" button all by itself and reduced it to 4 (i.e. it locked out each processor for "long" periods of time"). This makes 21 friends (well they were), very unhappy.

Pinky thought that was boring so pinky decided not to save all of the things you had taught it that day, but to add more spice not all the time. So when you came to use inky and stinky the following day it became a mystery tour. This was a real joy for everyone, it made coming to work really fun.

Stinky thought this was also boring. So stinky thought just when you thought you knew what he was doing, he will update himself and introduce half of what Inky does and half of what pinky does, and that way you won't know it is stinky.

Inky, pinky and stinky didn't really like each other much, and whilst everyone thought they would work together, they decided not to bother.

Little Johnny thought, well these things happen, not to worry he will telephone the technical support teams of inky, pinky and stinky and they would help him sort out the gremlins. As ever the technical support teams asked whether little Johnny had looked on the knowledge base. As you know most knowledge bases are self help groups for people with the same problem, but no answer.... and an answer never comes.

Then one of the technical support people said "oh I have heard of this somewhere else, I think we have a private patch". Little Johnny thought his night of fun is on the way but was a bit confused about what a private patch was. The nice technical support man said "well we think it will fix your problem, we don't tell people about it, and you can't use it in a live environment". Little Johnny thought that doesn't sound like fun at all.

end of story... because I am bored with it.

The reality is that individual pieces of software have become increasingly sophisticated and with this sophistication, it becomes increasingly difficult to assure quality. We have always had the issue of integrating software but it appears to getting worse not better. We might all say well that is the world we live in, and I think you are right but it has consequences. I really feel for project managers and SI's, when they take in good faith supposedly quality, widely used software and estimate/bid on the basis of time and capability. The reality is, on occasions, it turns out to be a bit of a lottery. It is also very unhelpful when developers of software do not publish the knowledge they have on problems, even if the problem might seem obscure, or hasn't really been proven as a problem yet.

And as for private patches they should be banned, as the song goes:

"I'm sorry son but we don't stock party gimmicks in this shop"

"Try the 'House of F'un' it's quicker if you run"

"this is a chemist not a joke shop"

Computer operations a real joy, is it today?

I started my career in technology as a trainee computer operator on a very old ICL 1902, one of those things that had paper tape (look it up youngsters) and you had to boot the machine by flicking switches in a certain order... She was an unpredictable beast who would, for no apparent reason, get a parity error after 18 hours of processing and you had to start all over again... lovely for the overtime and you always prayed it took you into double time.

I only operated on that machine for about 6 months before they replaced it with a beauty of a machine called a Honeywell Level 66 and she was housed in a massive computer room. This was a huge time for my personal learning and development: timesharing; real time processing transaction processing; distributed computing; a mix of a dozen computer languages. But what was even better was big computer cabinets all placed in rows and lots of flashing lights. This was important because:

Those cabinets gave us the ability to play computer room cricket. Bring in a bat, take some computer print out, screw it into a ball and surround it with sellotape – Bob's your uncle. There was a slight problem when the batsmen in his over enthusiasm to get a six let go of the bat and it crashed into the back of a computer cabinet causing a huge unsightly dent. No matter off with the door, find the brick and hammer it back into some sort of shape, if that didn't work sticking up procedures over the bump was a dead cert for a cover upJ

However the true joy was competitive computer room Olympics...I'm getting tense just thinking about it. Take two waste paper trolleys (you know the ones where you can sit in). Design a course around the cabinets, around the tape decks, consoles; throw in a few hazards like chairs etc. Split into two teams of two (as at least four on a shift) and see who can get around the quickest, cheating is allowed. We did have a slight crash in one particularly heavily fought competition. Just by the tape racks, there was a very tight left hand corner which you had to take at speed, and you must turn left else you went through the emergency crash exists which had horizontal blinds covering them. You guessed it, didn't quite might make the corner and went head first through the blinds and through the doors...down came the blinds and off went the security alarm...oops

As you can see I went through a torrid time, but it made me what I am today.

Computer Operators, does such personal development exist today?

Technology innovation, are we keeping up and does it matter?

I presented at an IT industry day run by the department of Business Innovation and Skills, on technology innovation. It kicked off with a speech from Stephen Timms, who has a background in technology, reinforcing the importance and criticality of technology to the United Kingdom. I gave an overview of the way technology is used extensively within the public sector, and then we had IT industry innovators detailing how they see technology moving forward. Microsoft presented on how they see Citizen and consumer experience changing - new ways of interacting; BT presented on The "cloud" economy – new models for service delivery; Security and cybercrime – doing business in a dangerous world was presented by Martin Sadler of Hewlett Packard; Healthcare - how our lives will change was presented by Steve Battersby, Philips; Nigel Jefferies of Vodafone presented on how everything is going mobile and last but certainly not least Iain Gray, Technology Strategy Board detailed how they are investing in the IT industry research and supporting key developments.

As ever the best bit is always the Q&A. There were quite a few comments about how difficult it can be to do business with government given its size and complexity, a question on whether Government is structured right to get the best out of technology innovation as there is no one single department in charge of this and a lot of comment on skills.

I posed a question to the audience which was "do you believe that technology and innovation is continuing to increase at a pace?" – The vast majority of hands went up. I followed this question with a second "are you or your boards keeping up with this change and the consequence of this change" – only 4 hands went up. I have asked these two same questions to thousands of people now, and the answers are always the same.

Are you keeping up, take my survey...

If not what are the consequences, if any?

The hidden treasure that lurks within a TCO

A few weeks ago I had the pleasure of spending time with about 20 CIO's ranging from multi-national organisations to local USA health providers, together with a number of CTO's from large software vendors. The subject of ROI and TCO came up in the context of which desktop model is the most cost effective in terms of justifying increased capital expenditure to enable desktop virtualisation.

I was slightly surprised that only two CIO's could state their TCO, but on reflection should I have been? The sad fact is that many organisations have lost sight and control of their IT estate. The continuous drive for new products and services at a pace that is set to beat the competition at the expense of infrastructure efficiency is all too well known by CIO's and CTO's. You only need to keep upper most in your mind that we virtualise because we have servers that are underutilised. I think the figure is still sub 10% utilisation for server's pre virtualisation. How many CEO's know they have capital tied up and not making a return? Not enough in my opinion!

So to the subject of money, ROI and TCO, which one should we focus on? One of the group, who is an analyst, and ponders these things for a living, believed that we should focus on ROI, but my view is that you need to focus on both, as TCO is an element of ROI. However there is more to this than an academic debate about method and calculation. Consider this hidden box of treasure:

TCO = SUPPLIER BASE COST multiplied by a

SUPPLIER EFFICIENCY FACTOR to which you add an

R&D FACTOR as well as a PEOPLE INVESTMENT FACTOR and the PROFIT MARGIN

Then multiply this by a RISK FACTOR (you will be seen as a risk by the supplier in some shape or form)

And then modify up or down depending on how tough the competition is or soft you areJ

Many people I talk to do not give a second thought to the overall efficiency of the supplier they are buying from and even less thought to the efficiency of their supply chain. In my simplistic view as detailed above if we could work out what the base cost of a supplier was we would modify this up or down depending on how efficient, or inefficient they were. Again we need to consider if a supplier is investing in R&D (assuming they need to) and importantly are they growing the skills of their people to fulfil the demands their clients are putting upon them. In moments of madness I do compare and contrast what salesmen are attempting to sell me (me being Government rather than me being an actual buyer) and what is actually being bid. It might surprise you to know that invariably what is bid is a lot more mature, polite for old. We shouldn't be surprised as our suppliers are full of people like you and me, all working hard to do a good job, but skilled in what the business needs today, not what the business might need in a few years time. After all would you look to sell something that wasn't your core competence and something that you were not particularly experienced in?

The red herring of the profit margin, yes red herring. Many a time I have split my sides guffawing at procurement experts haggling over a 1% reduction in profit margin, although the bulk of the TCO is in the suppliers base cost, the supplier's efficiency, the suppliers R&D etc. It's the table magician trick of deflecting the eye from the hand that is doing all the workJ finally to the final two elements, risk and competition. In terms of risk suppliers rightly have to ask themselves if the client is going to increase or decrease the risk of the project. If you give the impression of being disorganised, if you have a track record of failure, or are always changing your mind, it would be right for suppliers to factor this into their costings, after all time is money. I know we get agitated every time a supplier raises the change control card, but that is what it is there for, it is a valid control point, but be under no illusion an element of risk will be in the TCO somewhere. Finally in the TCO there is always an element of judgment in the price. Some of this is driven by how stiff the competition is. Suppliers don't bid on the basis that they want to lose. Bidding costs money, someone has to pay for it, but suppliers won't throw away a deal for a small shift in the overall TCO calculation.

That's a lot about TCO, but what about ROI. Well for me this is simple, well not that simple but we will keep it high level. Basic ROI is about ensuring that the overall benefit you are getting from the investment you are making is greater than the cost. TCO is just an element of the cost of a project but important to know if you really want to drive ROI. I have never brought the idea of an IT project; every project is there to deliver a business outcome whether it is customer driven, or internal efficiency or effectiveness. It just so happens that today a lot of projects are fundamentally underpinned by the use of IT. Our jobs as CIO's is to help the business deliver its objectives at the most appropriate capability for the most appropriate price.