Who makes the decisions?
Agree on responsibilities, priorities and provider boundaries. Keep the rules and decisions connected to the work.
Ask: Who approves, who carries it out and who checks it?
Programs / Technology Review and Planning
Technology review and planning.
Understand what needs attention, decide what comes next and give the work an owner.
Start with a review of the work your technology needs to support. RDA connects the findings to the way your organization works, the people responsible and the money available.
Guide + programs and practices: under 10 minutes
ManagementPriorities and responsibility
SoftwareApplications and information
NetworkInfrastructure and continuityDaily support connected to the longer-term plan.
01 / Start with the work
What needs to keep working?
Talk with the people using the systems. Find out where work slows down and what happens when a key person or service is unavailable. Include the applications, information, equipment and providers they depend on.
Check what is actually in place. Who owns it? Who supports it? What has been tested? What is coming up for renewal or replacement? Give missing answers an owner and a next action.
Plan technology into the building early
In a construction or renovation project, technology requirements belong in the early discussions about how the building will be used. Space, pathways, power, cooling, connected systems and ongoing support affect one another. Resolving those dependencies while the design can still change helps avoid rework, delay and operating costs discovered after construction.
Our construction experience informs those questions. An owner's technology representative helps keep decisions and responsibilities connected across the project, including the building and network dependencies and the handover the operating team will need.
Define the responsibilities before they become urgent
People, systems and provider arrangements keep changing. A planned departure, a renewal or a network change can be manageable when the knowledge, authority and next steps are already clear. Leaving them undefined can add delay, rework and interruption when a decision is needed quickly.
Use the product and vendor review, network coverage review and people and continuity plan to identify those dependencies. The service review connects current results and exceptions to the next authorized action.
A backup is something you have. A successful restore that staff can use tells you whether it did the job.
02 / The RDA method
Agree on the work.
Then carry it through.
Technology Portfolio Governance (TPG) connects needs, options, risk, cost and available capacity before work is authorized. Your organization keeps its approval and funding authority.
- 1Intake
Need and owner
- 2Assess
Options, risk and cost
- 3Authorize
Priorities, funding and approval
- 4Deliver
Implement, test and accept
- 5Operate
Support and results
- 6Review
Improve, renew or retire
Review brings results and changing needs back into the next decision.
Programs establish requirements and responsibilities. Practices apply expertise to those responsibilities. The RDA Program Framework connects decisions to instructions, training, evidence and review. The Service Matrix relates the work across Management, Software and Network.
03 / Security review
Six areas to work through.
NIST's Cybersecurity Framework 2.0 provides the government reference. These are RDA's practical questions for its six functions. They work together; they are not a sequence or a score.
Look for a recent record, example or test. Treat anything you cannot confirm as unknown and assign the follow-up.
What does the work depend on?
Know the systems, information, people and providers involved. Record the gaps and risks that need attention.
Ask: What is missing an owner or a current record?
Are the safeguards in use?
Check access, account protection, updates, information handling and staff instructions against the agreed requirements.
Ask: Can we show that the agreed safeguards are working?
Who notices something wrong?
Agree on what needs monitoring, who reviews alerts and how staff report concerns.
Ask: Does each report or alert reach someone responsible?
Who takes the next action?
Set response roles, contacts and escalation. Practice how staff and providers coordinate and record decisions.
Ask: Who leads when more than one provider is involved?
Can staff use the restored service?
Agree on recovery priorities, protect backups and test restoration with the people who rely on the service.
Ask: When did we last demonstrate a usable recovery?
04 / Why RDA
We work as or with your IT department.
An embedded, outsourced IT department.
ManagementPriorities and responsibilitySoftwareApplications and informationNetworkInfrastructure and continuityDaily support connected to the longer-term plan.
Your staff need someone who understands their work and follows through. Management needs to know what requires attention, what it will cost and when a decision is needed. We bring that work together.
We can take on the IT function or work alongside the people you have. We get to know your staff, systems and providers and help maintain the knowledge and records needed to keep the work moving.
Technology Portfolio Governance (TPG) helps us work with you on what should be done and when. The program framework gives agreed work a way to get done, checked and maintained. Support, security, projects, replacement and the budget stay connected.
Recommendations start with your needs, with no allegiance to a particular vendor or solution. You should be able to see what we are responsible for, what has improved and what decision comes next.
05 / What the plan shows
Enough information to act.
For each priority, we would want the service and need, the reason it matters, the owner, the options and cost, the next action, the acceptance test and the review date.
- 1First 90 days
Confirm the starting point, agree on priorities and test a manageable piece of work.
- 2This year
Prepare the decisions that need funding, coordination or staff time.
- 3Longer term
Look ahead at renewals, replacement and changes in the organization.
Dates follow the agreed priorities, funding and capacity. Review the plan as the work changes.
The plan should show what changed, what remains unresolved and what decision is needed. A completed project still needs someone responsible for the service it leaves behind.
Foundation and government reference
RDA's Technology Portfolio Governance (TPG) package, Program Framework v1.0 and Service Matrix provide the foundation. The security review uses the six functions of the NIST Cybersecurity Framework 2.0 as its government reference. The explanations and diagrams on this page are RDA's own.
NIST also provides an editable Organizational Profile spreadsheet for comparing current conditions with intended outcomes and identifying gaps.
Applicable obligations and technical requirements are confirmed for the organization during assessment. This overview does not establish compliance or local approval.
Include the people the plan depends on
A technology plan also needs a coverage plan. Identify knowledge held by one person, responsibilities that need another trained person and vendor relationships that would be difficult to continue after a departure. Connect cross-training, usable records and succession arrangements to the same priorities and budget.