Governance Archives

Innovation Scoring from 2nd Watch Boosts Cloud Optimization

Does this sound familiar? “You will move to the cloud, for right or wrong, because of a business imperative to get out of your data center, not tomorrow, but yesterday.” Or, “You’re sold on the idea that by migrating to the cloud, you’d be able to reduce your total cost of ownership (TCO), increase flexibility, and accelerate innovation projects.” The cloud practically sells itself, and as a result, you plan to ditch your legacy, on-premises technology and begin your cloud migration journey.

However, suppose you hop into the cloud without a defined strategy and approach. In that case, you’ll experience cloud sprawl, and spiraling cloud costs will negate the touted benefits of the cloud. This sort of “blind faith” in all the cloud offers is a common mistake many business leaders make. It has prevented you from considering cloud management and economics as part of your cloud migration strategy.

Without cloud cost governance, your organization will suffer O2: Overprovisioning and Overspending. You’re left confused because this is the exact opposite result you thought cloud migration would have. Additionally, if you find yourself in this predicament, you have difficulty pinpointing areas for improvement to initiate corrective action.

Enter Innovation Scoring by 2nd Watch. Our data-driven scoring system will help you assess your applications running in the cloud environment and identify where you are overprovisioning and overspending. Innovation Scoring is the first step to establishing cloud economics and maximizing the value of cloud computing to your business in the long run.

The Importance of Cloud Economics

If O2 is how you define your cloud environment, you’ve learned the hard way about the need for cloud economics. While cost savings is a component of cloud economics, the ultimate goal of the practice is to maximize the value of cloud computing for your organization. Implementing cloud economics will give your business insights into which departments are utilizing the cloud, what applications and workloads are using the cloud, and how these moving parts contribute to more impactful and cost effective business goals.

Without cloud economics, your business will deal with overrun cloud budgets, which are usually due to one or more of the following:

Ungoverned costs: your organization has no idea what it is spending on.
Unforecasted usage: you see more cloud projects than you had anticipated.
Uncommitted mindset: you don’t want to commit to a cloud contract (because you can’t predict its usage), so you miss out on contractual discounts.
Wasted dev/test resources: your dev team is overprovisioning their infrastructure.
Overestimated production headroom: you are not auto-scaling or have not set proper parameters for autoscaling for your applications.
Wrongsized production: your production environment is overprovisioned, and pay for the excess resources monthly.
Poor design and implementation: your architects make suboptimal design choices for cloud solutions because they are unaware of the costs to the business.

For cloud economics to work, there must be a company-wide commitment to the practice beyond simply calculating cloud costs. Just like implementing a DevOps practice, impactful cloud economics requires promoting a cross-functional and collaborative culture. Business leaders must encourage transparency and trackability to enable teams to work together harmoniously to manage their cloud infrastructure and prove the true business benefits of the cloud.

2nd Watch’s Innovation Scoring

Cloud economics is critical for your business to reap the maximum benefits of cloud computing. However, cloud economics is a pervasive cultural practice, so it won’t happen at the snap of your fingers. It will require time and effort for your business to establish cloud economics.

The first step in controlling your cloud budget and governing your cloud platform is to identify areas of improvement. 2nd Watch created the Innovation Scoring system, our proprietary scoring methodology, to help you identify opportunities for optimization and modernization in a data-driven way.

Our Innovation Scoring methodology will reveal the underlying problem with your cloud management. We’ll be able to identify the application needing improvement and determine why it is suboptimal. Did you set it up incorrectly and need to move to PaaS with autoscaling capabilities? Or did someone write your application in 2005, and you are in dire need of application modernization? Or is it a combination of both? 2nd Watch designed its Innovation Scoring to pinpoint areas for improvement in your database, infrastructure, and/or application. When we ascertain the source of inefficiency, we can address issues contributing to cloud sprawl and skyrocketing cloud costs.

To calculate your Innovation Score, we analyze several different dynamics related to your cloud applications. The ratings from each category are then cross-tabulated to generate a total view of your entire cloud environment. Your Innovation Score will not only reveal inefficiencies but also allow us to compare your efforts against other similarly sized companies and make sure you are up to industry standards.

2nd Watch understands that cloud economics is a cultural undertaking; therefore, when we assign Innovation Scores to our clients, we do so in a way that encourages company-wide participation. To promote engagement and commitment, we’ve gamified our Innovation Scoring: we split our clients’ technical leadership into teams and calculate each team’s score. When we check in with our clients, we reveal each team’s score to showcase which ones are being innovative and taking advantage of the cloud and which ones have room for improvement.

Sample Innovation Scoring Output

Our approach to Innovation Scoring promotes friendly competition, which fosters collaboration between teams and a transparent high-level overview of how each team is leveraging the cloud. When our clients are a part of our Innovation Scoring system, it jumpstarts a culture of innovation, transparency, and accountability within their business.

Conclusion

Consider the importance of cloud economics when planning to run your applications in a cloud environment. It is easy to overspend, get overwhelmed, and have no sense of direction. Therefore, cloud economics is beneficial whether you implement it proactively or reactively.

2nd Watch’s Innovation Scoring is a practical first step to getting your cloud budget in order and establishing cloud economics as a standard cultural practice in your organization. Through data and analysis, our Innovation Scoring will help you identify how you can optimize your cloud instance so that you are receiving maximum cloud value for your business. Moreover, Innovation Scoring trains your teams to be communicative and cross-collaborative, which are the traits your company culture needs to succeed in cloud economics.

2nd Watch takes a holistic approach to cloud cost optimization and cloud economics. Contact us, and we’ll show you where and how you can improve your cloud-based applications with our Innovation Scoring.

Data Warehousing

Snowflake offers powerful features in the data warehousing space that allow 2nd Watch delivery teams to stay laser-focused on business outcomes. They use innovative technologies that optimize your data for storage, movement, and active use (cloud computing). They also have an ever-increasing array of valuable tools that significantly improve an organization’s ability to enrich and share large amounts of data with other companies.

But it doesn’t happen by magic…

2nd Watch can leverage our vast industry and technical experience to create a data warehouse for your organization that provides a fast, accurate, and consistent view of your data from multiple sources. Using best practices and well-established methodologies, 2nd Watch combines data from different sources into a centralized repository, creating a single version of the truth and a unified view.

The final design contains a user-friendly enterprise data warehouse that connects with both legacy and modern business intelligence tools to help you analyze data across your organization. The data warehouse is optimized for performance, scaling, and ease-of-use by downstream applications.

Potential Deliverables

Conceptual and physical data models for dimensional and analytical systems
Deployment of three semantic layers for tracking data in a central hub (raw, business using data vault, and data warehouse optimized for visualizations)
Design and development of departmental data marts of curated data
Training of end users for the cloud-based data solution and critical data applications and tools

Data Integration

Snowflake has a lot of flexibility when it comes to the data integration process, meaning Snowflake’s Data Cloud allows companies to go beyond traditional extract, transform, and load data flows. With the Snowflake ecosystem, companies can leverage data integration solutions that do everything from data preparation, migration, movement, and management, all in an automated and scalable way.

The consultants at 2nd Watch will partner with you every step of the way and guide the entire team in the right direction to meet your decision-makers’ specific goals and your organization’s business data needs. These are some of the popular data integration tools and technologies that 2nd Watch can help integrate to Snowflake:

Azure Data Factory
AWS Glue and Lambda
Google Cloud Data Fusion
Fivetran/HVR
Etlworks
IBM DataStage
SnapLogic
Plus, all the classics, including SQL Server Integration Services (SSIS) and Informatica

Potential Deliverables

Integration of any number of sources to a centralized data hub
Establishment of a custom system that operates well with niche sources
Speeding up the ingestion process and increasing the auditing power
End-game integration to a data warehouse and other target systems

Data Modernization

Snowflake is a paradigm-shifting platform. Micro partition storage, decentralized compute, and cross-cloud sharing opens up new opportunities for companies to solve pain in their analytics processing. Our consultants at 2nd Watch are trained in the latest technologies and have the technical expertise to tackle the challenges posed by making your legacy systems “just work” in modern ecosystems like Snowflake.

Using supplemental tools like dbt or sqlDBM, this process will transform your data platform by eliminating complexities, reducing latency, generating documentation, integrating siloed sources, and unlocking the ability to scale and upgrade your existing data solutions.

Potential Deliverables

Migration to Snowflake from existing high-maintenance deployments
Refactoring, redesigning, and performance tuning of data architecture
Deploying Snowpark API for integrating with Scala or Python applications
Supporting modern tool selection and integration

Data Governance

Data governance is critical to organizations hoping to achieve and maintain long-term success. Snowflake offers outstanding features such as object tagging or data classification that improve the security, quality, and value of the data. Additionally, when you work with 2nd Watch, we can help your organization establish a data governance council and program.

2nd Watch will assist you in identifying and coaching early adopters and champions. We will help with establishing roles and responsibilities (e.g., business owners, stewards, custodians), as well as creating and documenting principles, policies, processes, and standards. Finally, we will identify the right technology to help automate these processes and improve your data governance maturity level.

Potential Deliverables

Data governance strategy
Change management: identification of early adopters and champions
Master data management implementation
Data quality: data profiling, cleansing, and standardization
Data security and compliance (e.g., PII, HIPAA, GRC)

2nd Watch will make sure your team is equipped to make the most of your Snowflake ecosystem and analytics tools, guiding the entire process through deployment of a successful initiative. Get started with our Snowflake Value Accelerator.

Cloud Automation for I.T. Governance, Risk, and Compliance (GRC) in Healthcare

It has been said that the “hero of a successful digital transformation is GRC.” The ISACA website states, “to successfully manage the risk in digital transformation you need a modern approach to governance, risk and regulatory compliance.” For GRC program development, it is important to understand the health information technology resources and tools available to enable long term success.

What is GRC and why it important?

According to the HIPAA Journal, the average cost of a healthcare data breach is now $9.42 million. In the first half of 2021, 351 significant data breaches were reported, affecting nearly 28 million individuals. The needs have never been more acute among healthcare providers, insurers, biotechnology and health research companies for effective information security and controls. Protecting sensitive data and establishing a firm security posture is essential. Improving health care and reducing cost relies on structured approaches and thoughtful implementation of available technologies to help govern data and mitigate risk across the enterprise.

Effective and efficient management of governance, risk, and compliance, or GRC, is fast becoming a business priority across industries. Leaders at hospitals and health systems of all sizes are looking for ways to build operating strategies that harmonize and enhance efforts for GRC. Essential to that mission are effective data governance, risk management, regulatory compliance, business continuity management, project governance, and security. But rather than stand-alone or siloed security or compliance efforts, a cohesive program coupled with GRC solutions allow for organizational leaders to address the multitude of challenges more effectively and efficiently.

What are the goals for I.T. GRC?

For GRC efforts, leaders are looking to:

Safeguard Protected Healthcare Data
Meet and Maintain Compliance to Evolving Regulatory Mandates and Standards
Identify, Mitigate and Prevent Risk
Reduce operational friction
Build in and utilize best practices

Managing governance, risk, and compliance in healthcare enterprises is a daunting task. GRC implementation for healthcare risk managers can be difficult, especially during this time of rapid digital and cloud transformation. But relying on internal legacy methods and tools leads to the same issues that have been seen on-premises, stifling innovation and improvement. As organizations adapt to cloud environments as a key element of digital transformation and integrated health care, leaders are realizing that now is the time to leverage the technology to implement GRC frameworks that accelerate their progress toward positive outcomes. What’s needed is expertise and a clear roadmap to success.

Cloud Automation of GRC

The road to success starts with a framework, aligned to business objectives, that provides cloud automation of Governance, Risk, and Compliance. Breaking this into three distinct phases, ideally this would involve:

Building a Solid Foundation – within the cloud environment, ensuring infrastructure and applications are secured before they are deployed.

Image/Operation System hardening automation pipelines.
Infrastructure Deployment Automation Pipelines including Policy as Code to meet governance requirements.
CI/CD Pipelines including Code Quality and Code Security.
Disaster Recovery as a Service (DRaaS) meeting the organization’s Business Continuity Planning requirements.
Configuration Management to allow automatic remediation of your applications and operating systems.
Cost Management strategies with showback and chargeback implementation.
Automatic deployment and enforcement of standard security tools including FIM, IDS/IPS, AV and Malware tooling.
IAM integration for authorization and authentication with platforms such as Active Directory, Okta, and PingFederate, allowing for more granular control over users and elevated privileges in the clouds.
Reference Architectures created for the majority of the organization’s needs that are pre-approved, security baked-in to be used in the infrastructure pipelines.
Self-service CMDB integration with tools such ServiceNow, remedy and Jira ServiceDesk allowing business units to provision their own infrastructure while providing the proper governance guardrails.
Resilient Architecture designs

Proper Configuration and Maintenance – Infrastructure misconfiguration is the leading cause of data breaches in the cloud, and a big reason misconfiguration happens is infrastructure configuration “drift,” or change that occurs in a cloud environment post-provisioning. Using automation to monitor and self-remediate the environment will ensure the cloud environment stays in the proper configuration eliminating the largest cause of incidents. Since workloads will live most of their life in this phase, it is important to ensure there isn’t any drift from the original secure deployment. An effective program will need:

Cloud Integrity Monitoring using cloud native tooling.
Log Management and Monitoring with centralized logging, critical in a well-designed environment.
Application Monitoring
Infrastructure Monitoring
Managed Services including patching to resolve issues.
SLAs to address incidents and quickly get them resolved.
Cost Management to ensure that budgets are met and there are no runaway costs.
Perimeter security utilizing cloud native and 3^rd party security appliance and services.
Data Classification

Use of Industry Leading Tools – for risk assessment, reporting, verification and remediation. Thwart future problems and provide evidence to stakeholders that the cloud environment is rock solid. Tools and verification components would include:

Compliance reporting
Risk Registry integration into tools
Future attestations (BAAs)
Audit evidence generation

Where do you go from here?

Your organization needs to innovate faster and drive value with the confidence of remaining in compliance. You need to get to a proactive state instead of being reactive. Consider an assessment to help you evaluate your organization’s place in the cloud journey and how the disparate forms of data in the organization are collected, controlled, processed, stored, and protected.

Start with an assessment that includes:

Identification of security gaps
Identification of foundational gaps
Remediation plans
Managed service provider onboarding plan
A Phase Two (Foundational/Remediation) proposal and Statement of Work

About 2nd Watch

2nd Watch is a trusted and proven partner, providing deep skills and advisory to leading organizations for over a decade. We earned a client Net Promoter Score of 85, a good way of telling you that our customers nearly always recommend us to others. We can help your organization with cloud native solutions. We offer skills in the following areas:

Developing cloud first strategies
Migration of workloads to the cloud
Implementing automation for governance and security guardrails
Implementing compliance controls and processes
Pipelines for data, infrastructure and application deployment
Subject matter expertise for FHIR implementations
Managed cloud services

Schedule time with an expert now, contact us.

-Tom James, Sr. Marketing Manager, Healthcare

Governance, Risk and Compliance Drive Change Across the Organization

What is GRC?

Governance, Risk and Compliance (GRC) is a standard framework that helps to drive organizations towards a common set of goals and principals. The overarching theme is strategically focused on how technology utilization and operations tie directly back to an organization’s business goals and, in many cases, aspirations.

There are many facets to GRC. In the cloud it means the same thing as it did in the datacenter. We need to ensure IT organizes around the business, and we need to make sure risk is minimized and compliance is maintained.

At 2nd Watch we work with clients across all areas of GRC. Clients take various levels of focus in each area, and some areas are more important based on the vertical the client is operating in.

The cloud extends beyond the physical bounds of an organization, and with that institutes new challenges and requires a shared cloud responsibility model. The CSP is responsible for the underlying infrastructure setup and physical maintenance of their cloud infrastructure. We work with our cloud ISV and providers’ tools, technologies and best practices to help maintain strong governance and lower risk while meeting compliance.

The landscape of software, tools and solutions to support governance, risk and compliance is daunting in the cloud marketplace. 2nd Watch focuses on providing a holistic support to our clients around GRC. We believe there are fantastic capabilities directly inside the cloud management portals to help customers along the journey to strong GRC framework and institution.

Microsoft Azure Compliance Manager

In Microsoft Azure we can utilize Compliance Manager. Compliance Manager is a workflow-based assessment tool that enables organizations to track, assign and verify regulatory compliance procedures and activities in support of Microsoft Cloud technologies – including Office 365 and Dynamics. It supports ISO 27001, IS0 27018 and NIST and supports regulatory compliance around HIPAA and GDPR. It is a foundational tool to utilize within Microsoft Azure to help you along the path to achieving strong governance, risk and compliance around Microsoft Cloud technologies.

With Amazon Web Services we have a complete set of core cloud operations management tools to utilize within the AWS console to help us bolster governance and security and reduce risk. Amazon provides resources with a full prescriptive set of compliance quick reference guides, which provide an overview of how to maintain a cloud compliant environment through strong security and controls validation, and insight and monitoring for activity and security assurance.

Amazon has a complete Cloud Compliance Center where clients can tap into an abundant set of resources to help along the way.

Beyond the tools, both Microsoft Azure and AWS provide strategic support with partners around compliance. There are many accelerators and programs that organizations can request from and Amazon and Microsoft to help them achieve and maintain GRC specifically tuned to the cloud.

GRC is unique to each organization. Cloud providers bring a substantial set of resources and technologies, along with great prescriptive guidance and best practices to help and guide you in achieving a strategic GRC framework and set of processes and procedures in your organization.

Take advantage of these built-in capabilities as you start to look at other tools and technologies to complete your holistic approach to governance, risk and compliance, and please reach out to 2nd Watch to find out how we can support you along the way.

-Peter Meister, Sr Director of Product Management